ISO 20000-1:2018 IT Service Management
Is ISO 20000-1 mandatory for your IT services?
No. ISO 20000-1 is a voluntary standard, and no general rule obliges an IT service provider to be certified. In practice, a customer contract, a supplier questionnaire or a tender can turn it into a condition. If a customer is asking now, you can have the certificate within hours.
01: Short answer
Is ISO 20000-1 mandatory?
ISO 20000-1:2018 is an international standard for IT service management. Companies adopt it by choice. Running IT services does not by itself oblige you to certify against it, and this page does not claim otherwise.
The question is therefore rarely a legal one. It is commercial. A contract, a security annex or an audit right in a framework agreement may name the standard, and in some sectors the rules or guidelines you work under may refer to it. Read the exact clause before you assume anything.
A standard that is voluntary on paper can still decide whether you win an order.
02: De facto required
When does ISO 20000-1 become a requirement in practice?
The obligation usually arrives through a business relationship, not through a statute. These are the five situations we see most often.
- Customer contract
- A larger customer writes certification into the service agreement or its supplier code. Without the certificate you cannot sign, or you risk the next renewal.
- Supplier questionnaire
- The purchasing department sends a form with the line "ISO 20000-1 certified: yes or no". A "no" can remove you from the shortlist before anyone reads your quote.
- Tender
- A tender may list the certificate as a qualification or award criterion. The tender documents state which, and whether an equivalent is accepted.
- Supply chain
- If you work as a subcontractor for a managed service provider, your customer may have to pass its own certification duties on to you.
- Industry expectation
- In hosting, managed services and SaaS, competitors show the certificate on their websites. Buyers start to ask why you cannot.
03: Evidence
What to hand over for each kind of request
Most requests are met with the same document: the certificate as a PDF. It carries a number and a QR code that lead to a public verification page, so the person checking does not have to phone anyone.
| Request | Typical wording | What you hand over |
|---|---|---|
| Supplier questionnaire | Do you hold ISO 20000-1? | Certificate PDF with number and link to the verification page |
| Tender | Certificate as qualification criterion | Certificate attached to the bid |
| Customer audit | Evidence of a service management system | Certificate plus your documented incident, problem and change processes |
| Framework agreement | Certification maintained during the contract term | Certificate confirmed each year by the online re-audit |
Whatever the request, the certificate only helps if your processes really exist. An auditor from the customer's side will ask to see them.
04: Fast route
How to get ISO 20000-1 quickly when a customer asks
A request with a deadline calls for a short, ordered path. Five steps cover it.
Read the request exactly
Find out whether the customer wants a valid ISO 20000-1 certificate or names a specific route, such as an on-site audit. If the wording is unclear, ask.
Compare your services with the requirements
The standard expects a service catalogue, agreed service levels, incident and problem management, change and release management, capacity and availability management, and continual improvement.
Take the self-assessment
It has 36 yes/no questions. 13 are mandatory requirements of the standard and must all be answered yes. Among the other 23, at least 16 must be yes.
Pay and receive the certificate
After you pass and pay, the certificate is issued within 4 hours.
Send it to the customer
Forward the PDF to purchasing or attach it to the bid. The QR code takes the reader to the verification page.
If the assessment shows gaps, close them first. Write down the missing process, run it for a while, then answer again. The assessment is free, so you lose nothing by finding out where you stand.
05: Zertify
How Zertify fits in
The Zertify certificate rests on an online self-assessment. There is no on-site audit. G6 Agency AG issues it under licence from SICE, and SICE reviews every assessment before the certificate goes out. Each certificate can be checked publicly by number and QR code, and a short online re-audit confirms it every year.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. Customers in Switzerland and Liechtenstein pay 8.1% VAT, already included. You do not need an account to buy.
If you certify against two or more standards, a discount of 20% (two standards) or 30% (three or more) applies, also to the yearly fee.
06: Before you apply
Check whether your customer accepts an online certificate
Some customers name the route they expect. The alternative to Zertify is the classic route with an on-site audit by a certification body. If your customer's wording points to that route, you should know before you spend anything.
Send your contact one short question: does the requirement ask for a valid ISO 20000-1 certificate, or for a certificate obtained in a particular way? Most replies settle the matter in a day. A customer who only needs proof that you operate a defined service management system will usually accept a certificate that can be verified online.
07: FAQ
Questions about ISO 20000-1 and obligation
08: Guide
Related pages
A customer is asking for ISO 20000-1?
Take the self-assessment and find out today whether your service management meets the standard.
Free and without registration.