ISO 20000-1 for service companies

A purchasing department that buys IT services cannot walk through your service desk. It reads your answers in the supplier questionnaire instead. Is there a defined incident process? Are changes approved before they go live? Who decides what counts as a priority-one fault? A certificate answers these questions in one line and saves both sides a round of follow-up emails.

Some tenders for managed services, hosting or software support list a service management certificate as an award criterion or ask for equivalent evidence. Partners who resell your service ask for the same reason: your outage becomes their outage, and they have to explain it to their own customers.

ITIL describes good practice, but a company cannot be certified against it. ISO 20000-1 builds on those practices and can be certified, which is why it is the standard that appears in questionnaires.

• Compare the certification routes

The standard sets requirements for a service management system (SMS). It follows the common structure of ISO management standards: context (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). The operational core sits in clause 8, and this is where service companies feel it most.

Service companies rarely fail because of one big mistake. They lose customers through small gaps that repeat. The standard targets exactly these gaps.

Unlogged incident

A customer reports an outage by phone, nobody opens a ticket, and the same fault returns next week. Incident and problem management close this gap.

Unapproved change

An engineer patches a customer server on Friday afternoon without sign-off, and logins fail on Monday. Change management requires approval and a record.

Unclear scope

The customer assumes a backup restore is included, the contract says nothing, and the dispute lands on your invoice. The catalogue and the SLA settle it beforehand.

Key person dependency

Only one technician knows how a customer's environment is built. Documented procedures and defined competence under clause 7 reduce this dependency.

Subcontractor failure

Your hosting comes from a third party, and your promised availability depends on theirs. The standard expects you to control services that others deliver for you.

You do not need a new tool landscape. Most companies already have a ticket system, a shared calendar and a customer contract template. The work is to align them with the requirements.

1. 01

   Write one page per service

   Name the service, its scope, hours, contact route and exclusions. Together, these pages form your catalogue.

2. 02

   Set targets you can measure

   Define SLAs that your ticket tool can report, for example a first response within 30 minutes for a total outage during service hours.

3. 03

   Define incident priorities

   Agree on three or four priority levels, with an example for each, so that every technician classifies a fault the same way.

4. 04

   Make changes visible

   Use a ticket type or a shared calendar for planned changes. Record who requested, who approved and what was done.

5. 05

   Hold a monthly review

   Look at the ticket report, discuss repeated faults and missed targets, and write the resulting actions into a list with names and dates.

Decide first which services are in scope. A managed service provider usually certifies its customer-facing services. An internal IT department certifies the services it delivers to colleagues and branches.

Keep five documents at hand: your service list, a sample SLA, an export from the ticket tool, recent change records and the notes from your last service review. The questions are yes/no, so you answer from evidence you can find in these files. Start with the 13 mandatory questions, because all of them must be answered yes.

• ISO for small and medium businesses
• How Zertify works

The self-assessment has 36 questions. The 13 mandatory requirements of the standard must all be answered yes, and at least 16 of the other 23 questions must also be yes. No on-site audit takes place. SICE reviews every assessment, and the certificate is issued by G6 Agency AG under licence from SICE. You need no account to buy.

Your customer can check the certificate on a public verification page, using the certificate number or the QR code on the PDF. A short online re-audit each year confirms that the certificate still reflects how you work.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Swiss VAT of 8.1% is included for customers in Switzerland and Liechtenstein. The yearly subscription renews automatically and can be cancelled at any time to the end of the current year in your customer account. If you cancel, the certificate ends with the paid year. If you certify two standards, you get 20% off, and with three or more you get 30%, also on the yearly fee.

• ISO 20000-1 standard page
• Pricing
• Start the free self-assessment