ISO 20000-1 requirements in plain language

ISO 20000-1:2018 follows the high level structure used by most modern ISO management standards. Clauses 4 to 10 contain the requirements. Clauses 1 to 3 cover scope, references and definitions and need no action from you.

The standard describes a service management system (SMS). It builds on ITIL practices, but ITIL is a framework you adopt as you see fit, while ISO 20000-1 is a standard against which you can be certified. The table shows what each clause asks for.

• ISO 20000-1 standard page

These four clauses build the frame. They are short compared with clause 8, and in a small IT company one or two people usually write most of the documents.

Clause 4, Context

You identify who has expectations of your services, such as customers, suppliers and regulators, and you define the scope of the SMS: which services, which locations, which organisational units. Typically documented: the scope statement and a list of interested parties with their requirements.

Clause 5, Leadership

Top management owns the system. It approves a service management policy and makes sure roles are assigned. Typically documented: the policy, the service management objectives and an overview of roles.

Clause 6, Planning

You assess risks and opportunities that could affect the services, then set measurable objectives and plan how to reach them. Typically documented: a risk register and an objectives plan with owners and dates.

Clause 7, Support

This clause covers resources, competence, awareness, communication, documented information and knowledge. Typically documented: training and competence records, a communication plan, and a controlled set of procedures with version and approval status.

Clause 8 is the largest clause and the one a customer will look at first. It describes the service lifecycle in six groups. You do not need a separate department for each. You need each process to exist, to be defined and to produce records.

Service portfolio

Planning and delivering the services, controlling third parties involved, managing the service catalogue, assets and configuration. Typically documented: the service catalogue, an asset register and a configuration database or equivalent list.

Relationship and agreement

Business relationship management, service level management and supplier management. Typically documented: service level agreements (SLAs), contracts with suppliers, customer feedback and complaint records.

Supply and demand

Budgeting and accounting for services, demand management and capacity management. Typically documented: service budgets, a capacity plan and demand forecasts.

Design, build and transition

Change management, service design and transition, release and deployment management. Typically documented: change requests with approval, test results, release plans and post-implementation reviews.

Resolution and fulfilment

Incident management, service request management and problem management. Typically documented: the incident log with priorities and resolution times, request records, and a problem register with root causes.

Service assurance

Service availability management, service continuity management and information security management. Typically documented: availability targets and measurements, a continuity plan with test results, and security policies for the services.

Clause 9 asks you to measure. You monitor service performance against your SLAs, run an internal audit of the SMS, hold a management review and produce service reports for customers. Clause 10 asks what you do with the findings: you correct nonconformities, remove their causes and keep improving the services.

This is where many providers fall short. The processes exist, but nobody has recorded that they were checked. The records below are the ones a customer audit or a tender questionnaire most often asks for.

1. 01

   Service reports

   Monthly or quarterly figures on availability, incidents and response times, compared with the agreed service levels.

2. 02

   Internal audit report

   A dated report from someone who does not audit their own work, with findings and agreed actions.

3. 03

   Management review minutes

   Evidence that management looked at results, risks and objectives and made decisions.

4. 04

   Corrective action log

   Each nonconformity with cause, action, owner and closing date.

5. 05

   Improvement list

   Open ideas and decided improvements to services and processes, with status.

Zertify turns the requirements into an online self-assessment with 36 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 23 questions you need at least 16 yes answers. The questions follow the clauses described above, so the assessment also shows which records you still have to create.

SICE reviews every assessment. The certificate is issued by G6 Agency AG under licence from SICE, within 4 hours after you pass and pay. It carries a number and a QR code, and anyone can check it on the public verification page. There is no on-site audit. The certificate is confirmed each year by a short online re-audit.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the re-audit. The certificate is valid for 3 years. The assessment itself is free and needs no registration. If you want to compare this with the classic route, the guide on certification routes sets them side by side.

• Start the free self-assessment
• See pricing
• Compare certification routes