ISO 20000-1 IT Service Management Certificate: How to Get One

An ISO 20000-1 certificate confirms that you deliver IT services through a defined, managed system rather than through habit and individual effort. There are two routes to it: the classic on-site audit by a certification body, or an online self-assessment such as the one Zertify offers.

What the ISO 20000-1 certificate covers

ISO/IEC 20000-1:2018 is the international standard for IT service management. It sets requirements for a service management system, or SMS: the policies, processes, roles and records you use to plan, deliver, support and improve your IT services.

The certificate says nothing about whether your technology is good. It says your way of running services is organised, documented and improved over time. Customers who buy IT services understand that distinction.

Any organisation that provides services to customers can apply the standard, whether those customers are external clients or internal departments. A managed service provider, a software-as-a-service company, a web agency with hosting and support contracts and an internal IT team all qualify.

Who benefits from the certificate

The certificate helps when someone outside your company wants evidence that your service delivery is under control. Typical cases:

• A client or a public tender asks for proof of structured IT service management.
• You sell support, hosting, managed services or operations and want to stand apart from providers who only make promises.
• You are growing and need a common way of working, so that service quality no longer hangs on two or three key people.
• You already hold another ISO certificate and want to add service management.

Size is less of an obstacle than it seems. A team of ten can run a clear service management system if the scope stays honest and the processes simple. The guide on ISO certification for small and medium businesses shows what proportionate looks like.

What the standard requires

ISO 20000-1:2018 follows the high level structure shared by other management system standards. You must meet clauses 4 to 10, which say the following in plain terms.

Clause 4: Context of the organization

You describe your interested parties, what they expect and which services fall inside the scope of your system. The scope statement tells readers which services and which locations the certificate refers to, so keep it accurate and do not stretch it.

Clause 5: Leadership

Top management commits to the system, sets a service management policy and assigns responsibilities. In a small company that is usually the owner or managing director. An auditor or assessor looks for proof that management is actually involved, and a signature on a policy does not count as that.

Clause 6: Planning

You identify risks and opportunities, set service management objectives and plan how to reach them. Objectives can be measured simply, for example by response targets or the share of incidents resolved within agreed times. Pick measures you can really track.

Clause 7: Support

This clause covers resources, competence, awareness, communication and documented information. You need people who know their tasks, a way to talk to customers and staff, and controlled documents and records. The knowledge your team relies on to run the services belongs here too.

Clause 8: Operation

This is the largest part and the core of IT service management. It covers how you plan and control operations and the service processes themselves:

• the service portfolio and the agreements with customers
• managing supply and demand, including suppliers and budgets
• designing, building and transitioning new or changed services
• handling incidents and service requests, and managing problems
• change management, release and deployment
• service continuity and availability
• configuration management and information security

None of this requires heavy tooling. You need a defined process, clear ownership and records showing that the process is followed.

Clause 9: Performance evaluation

You monitor and measure your services, run internal audits and hold management reviews. Customer feedback is part of this. The purpose is to look at the facts regularly and decide what to change.

Clause 10: Improvement

When something goes wrong, you correct it, find the cause and prevent a repeat. You also improve the system continually. Records of corrective actions are among the most convincing evidence you can show.

Checklist: are you ready for ISO 20000-1?

Go through this list before you start. If you can tick most of it, preparation will be short.

• We have written down which services are in scope and for which customers.
• We know our interested parties and what they expect from us.
• Management has approved a service management policy.
• Roles and responsibilities for service delivery are named.
• We have measurable service objectives and a way to track them.
• Service agreements with customers are documented.
• Incidents and service requests are logged and handled in a defined process.
• We manage problems, not only incidents, and record root causes.
• Changes are assessed, approved and recorded before they go live.
• We keep an overview of our configuration items and key suppliers.
• Continuity, availability and information security are addressed in writing.
• We have carried out an internal review and a management review, or have a date set.
• We keep records of corrective actions and improvements.

Two routes to the certificate

Which route fits depends on what your customers and your situation require.

The classic route is an on-site audit by a certification body. Auditors visit, interview staff and inspect records. Expect planning, scheduling and usually several weeks or more. If a tender or a customer explicitly asks for this form of certification, this is the route to take.

The online route is a self-assessment. You answer structured questions about your service management system, supply the required information and receive a result, with no on-site visit. The guide to ISO certification without an audit explains in detail what that means in practice.

Neither route removes the need for a working system, because the certificate is only as meaningful as the management practice behind it. Ask your customer what they actually require before you decide.

How Zertify fits in

Zertify issues ISO certificates based on an online self-assessment. The page for service management is ISO 20000-1, which shows what the assessment covers before you begin.

The process:

1. You complete the self-assessment online, at your own pace.
2. SICE (Swiss Institute of Certification and Education) reviews every assessment before a certificate is issued.
3. After a passed assessment and payment, the certificate is issued within 4 hours. It is issued by G6 Agency AG under licence from SICE.
4. The certificate is publicly verifiable, so a customer can check it themselves.

The certificate is valid for three years and is confirmed every year by a short online re-audit, which is part of a yearly subscription. Budget for that as well as for the first assessment. Current conditions are on the pricing page.

When you are ready, start the assessment. Keep your scope statement, your policy and your process descriptions at hand, and it goes faster.

Common mistakes to avoid

Scope too wide. If you list every service you have ever offered, the system becomes hard to maintain. Begin with the services that matter to your customers.

Processes on paper only. A well-written incident process is worth little when tickets are handled by email and memory. Describe what you actually do, then improve it.

No evidence. Records prove that a process works. Keep logs of incidents, changes, reviews and corrective actions.

Ignoring suppliers. If part of your service depends on a hosting provider or a subcontractor, the standard expects you to manage that relationship.

Treating it as a one-time project. The system has to keep running. Reviews, measurements and improvements continue after the certificate is issued.

Next steps

Start with the scope and the policy. Then compare your current practice against clauses 4 to 10 using the checklist above, close the gaps you can see, collect your records and decide which route suits your customers. If the online self-assessment fits, the assessment page guides you through it step by step.