ISO 20000-1 for IT service providers
ISO 20000-1 for IT companies
ISO 20000-1 shows customers that your IT services run on defined processes: a service catalogue, agreed service levels, and controlled handling of incidents and changes. With Zertify you answer 36 questions online and receive the certificate within 4 hours after passing and payment. No on-site audit is needed.
01: Demand
Why do customers and tenders ask for ISO 20000-1?
IT services are bought on a promise: the system is available, tickets are answered, changes do not break production. A purchasing department cannot test that promise before signing. It looks for evidence instead, and a certificate against ISO 20000-1 is evidence that is easy to file.
The request arrives as a line in a tender, a question in a supplier questionnaire or a point raised during a customer audit. Managed service providers meet it most often. Software-as-a-service providers and internal IT departments serving subsidiaries hear it as well.
Many IT teams already work along ITIL. ITIL cannot be certified. ISO 20000-1:2018 can, which is why buyers name it in their requirements.
02: Scope
What does ISO 20000-1 require from an IT service provider?
The standard describes a service management system (SMS) and follows the high level structure, from context in clause 4 to improvement in clause 10. In daily IT work, the requirements show up as the following elements.
- Service catalogue
- A written list of the services you offer, for example managed workplace, backup as a service or hosting of a customer's ERP, each with a description and an owner.
- Service level agreement
- Agreed targets per service, such as the response time for a priority 1 ticket or the monthly availability of a hosted application, and a way to report against them.
- Incident management
- Every disruption is logged, prioritised, assigned and closed. A failed mail server and a locked user account follow the same path with different priority.
- Problem management
- Recurring incidents are traced to a root cause. If the VPN drops every Monday morning, someone owns the investigation.
- Change and release management
- Patches, configuration changes and new releases are requested, assessed, approved and recorded before they reach production.
- Capacity and availability management
- You watch storage, bandwidth and uptime against what customers have agreed, and plan before a limit is reached.
- Continual improvement
- Findings from tickets, customer feedback and service reviews end up in a list of improvements with owners and dates.
03: Risks
Which risks of IT operations does the standard address?
Most failures in IT services come from unclear agreements and uncontrolled changes, rarely from the technology itself. The table links typical situations to the requirement that deals with them.
| Risk | Typical situation | Requirement |
|---|---|---|
| Unclear scope | A customer expects round-the-clock support, the contract says office hours | Service catalogue and service level agreements |
| Lost requests | Requests sit in personal mailboxes and chat, nobody owns them | Incident management with logging, priority and closure |
| Recurring faults | The same outage returns every few weeks and is fixed by restarting | Problem management with root cause analysis |
| Failed changes | A patch goes live on a Friday afternoon without a rollback plan | Change and release management with approval and records |
| Unnoticed overload | Storage fills up before anyone orders more | Capacity and availability management |
| Knowledge in one head | Only one engineer knows how the backup restore works | Documented processes and competence (clause 7) |
04: Practice
How does an IT company meet the key requirements in practice?
The examples below show what auditors and customers expect to see. None of them needs a new tool.
Managed service provider
Describes three service packages in the catalogue, links each to an SLA and uses the monthly report from the existing ticket tool as evidence.
SaaS provider
Keeps a release calendar, requires a second person to approve each production release and records every rollback. Availability is read from the monitoring tool.
Internal IT department
Treats the business units as customers. A one-page description per service and agreed response times replace informal arrangements.
Data centre
Tracks capacity for racks, power and storage in a plan that is reviewed at fixed intervals, and ties maintenance windows to the change process.
Most of this exists in a working IT team already. The task is to write it down and to show that it is followed.
05: Zertify
How do you get ISO 20000-1 certified quickly with Zertify?
You take an online self-assessment with 36 yes/no questions. 13 of them are mandatory requirements of the standard and must all be answered yes. Among the other 23 questions you need at least 16 yes answers.
After you pass and pay, the certificate arrives within 4 hours. G6 Agency AG issues it under licence from SICE, and SICE reviews every assessment before the certificate is issued. There is no on-site audit. The PDF carries a certificate number and a QR code that lead to a public verification page, so a purchasing department can check it without contacting you.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel it at any time to the end of the current year in your customer account, and the certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.
06: Route
Which certification route suits an IT company?
The classic route means an on-site audit by a certification body. It fits when a tender names that route explicitly or when a customer wants an auditor on your premises. If the requirement is a verifiable ISO 20000-1 certificate, the online route covers it. Read the exact wording of the tender or questionnaire before you decide.
IT providers are often asked about information security in the same questionnaire. If you certify ISO 20000-1 together with ISO 27001, you receive 20% off for two standards, also on the yearly fee. For three or more standards the discount is 30%.
07: FAQ
Questions about ISO 20000-1 for IT companies
08: Guide
Related pages
Check in a few minutes whether your IT services pass
Answer 36 yes/no questions about your service management and see at once whether you meet ISO 20000-1.
Free and without registration.