Readiness checklist
ISO 20000-1 checklist: what your IT service management must show
This checklist follows clauses 4 to 10 of ISO 20000-1:2018 and names the evidence most IT service providers already hold for each point. Go through it with your service desk lead, mark the gaps, then check your result in a free online self-assessment.
01: Overview
How to use this ISO 20000-1 checklist
The points below follow the clause structure of ISO 20000-1:2018. For each one you see what the standard asks for and which records usually prove it. Ticket exports, signed policies, customer contracts and meeting minutes all count. A document written only for the purpose is rarely needed.
Mark every point as in place, partly in place or missing. The missing ones are your work plan. Clauses 4 to 7 are mostly decisions and paperwork. Clause 8 is where your daily operation is examined.
ISO 20000-1 builds on ITIL practices, but you do not need ITIL training to use the list. What counts is that your processes exist, that people follow them and that they leave records.
02: Clauses 4 and 5
Context and leadership: settle these points first
These points set the frame for the service management system (SMS). They are quick to fix, and every later clause refers back to them.
The scope of the SMS is defined
State which services, locations and customers the system covers. Evidence: a one-page scope statement and your current service list.
Interested parties and their requirements are known
List customers, suppliers, regulators and internal departments, and what each expects from your services. Evidence: a stakeholder register, customer contracts, supplier questionnaires.
Management has set a service management policy and objectives
The policy must fit the purpose of the organisation and be approved by top management. Evidence: a signed policy and the minutes of the meeting where it was adopted.
Roles and responsibilities are assigned
Someone owns each process, and someone is accountable for the SMS as a whole. Evidence: an organisation chart, role descriptions, a process owner list.
03: Clauses 6 and 7
Planning and support: risks, objectives, people and documents
Planning turns the policy into measurable goals. Support covers the people, knowledge and records that keep the system running.
Risks and opportunities are assessed
Consider what could stop you from delivering the agreed services, and what you could improve. Evidence: a risk register with owners and actions.
Service management objectives have plans
Each objective needs a measure, an owner and a date. Evidence: an objectives list, for example a target for incident resolution times.
Staff are competent and aware of the policy
Engineers and service desk staff know their process and the policy. Evidence: training records, certificates, onboarding checklists.
Documented information is controlled
Documents carry a version, an approver and a place where everyone finds the current one. Evidence: a wiki or document repository with change history.
Knowledge about services is available
Staff can find the information they need to support a service. Evidence: a knowledge base, runbooks, service descriptions.
04: Clause 8
Operation: the points your service desk is judged on
Clause 8 is the longest part of the standard. Your ticketing tool already holds much of the evidence, so start with exports from it.
Service portfolio and catalogue
Every service you offer is described, with its scope and who may order it. Evidence: a service catalogue, a portfolio overview.
Service level agreements and supplier agreements
Targets are agreed with customers and backed by agreements with your own suppliers. Evidence: SLAs, underpinning contracts, monthly service reports.
Incident management
Incidents are logged, prioritised, resolved and closed under a defined procedure. Evidence: a monthly ticket export showing priority, owner and resolution time.
Problem management
Recurring incidents lead to a root cause analysis and a permanent fix. Evidence: problem records linked to incidents, a known error list.
Change and release management
Changes are requested, assessed, approved and tested before release. Evidence: change tickets with approvals, a release calendar, rollback plans.
Capacity and availability management
You watch the capacity and uptime of each service against its targets. Evidence: monitoring dashboards, capacity plans, availability reports.
Continuity and information security
Services can be restored after a disruption, and access to customer data is controlled. Evidence: a continuity plan, a restore test record, an access rights review.
05: Clauses 9 and 10
Performance evaluation and continual improvement
The last two clauses ask whether the system works and whether you act on what you find. Many providers run these loops informally. The standard wants them on record.
Services and processes are monitored and measured
You track results against the objectives and the SLAs. Evidence: service reports, process KPIs, customer satisfaction results.
An internal audit has taken place
Someone who does not own the audited process checks it against the standard and your own rules. Evidence: an audit plan, an audit report, a list of findings.
Management has reviewed the SMS
Top management looks at results, audit findings and customer feedback, and decides on actions. Evidence: management review minutes.
Nonconformities lead to corrective action
When something goes wrong, you fix the cause and check that the fix worked. Evidence: a corrective action log with dates and status.
Improvements are collected and followed up
Ideas from staff, customers and incident reviews end up in one list with an owner. Evidence: an improvement register and the actions completed from it.
06: With Zertify
From checklist to certificate with Zertify
Once the checklist shows no major gaps, you answer the self-assessment for ISO 20000-1:2018 online. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. There is no on-site audit. You receive the certificate within 4 hours after passing and payment.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Anyone can check it on the public verification page with the certificate number or the QR code on the PDF, which helps when a customer sends you a supplier questionnaire or a tender asks for proof.
| Question group | Questions | Needed to pass |
|---|---|---|
| Mandatory requirements of the standard | 13 | All answered yes |
| Further questions | 23 | At least 16 answered yes |
| Total | 36 | 13 plus at least 16 yes answers |
Most points on this checklist map directly to these questions, so your evidence folder doubles as preparation.
07: FAQ
Questions about the ISO 20000-1 checklist
08: Guide
Related pages
Test your ISO 20000-1 readiness
Answer 36 yes/no questions online and see within minutes whether you pass.
Free and without registration.