ISO 20000: How to Manage IT Services by the Standard with Software
What does ISO 20000-1:2018 require, and what does this guide cover?
ISO/IEC 20000-1:2018 (the international standard for IT service management) specifies requirements for a service management system (SMS) that enables an organisation to plan, establish, implement, operate, monitor, review, maintain, and improve its IT services. It applies to IT service providers whether internal, outsourced, or a combination of both.
The standard follows the High Level Structure shared by recent ISO management system standards, so its clauses for context, planning, support, performance evaluation, and improvement mirror those of ISO 9001 and ISO 27001. This alignment makes it practical to combine an SMS with an existing information security or quality management system.
Building an SMS starts with defining its scope: which services, which customers, and which organisational boundaries are included. From there, the organisation maps and implements the required service management processes, establishes service level agreements (SLAs) with customers, and puts in place processes for incident, problem, and change management. Clause 9 requires monitoring of SLAs and periodic internal audits.
This guide covers the four main implementation steps and explains how SMS software addresses each clause.
How do you define the SMS scope and its processes under ISO 20000?
ISO/IEC 20000-1:2018 clause 4 requires the organisation to determine the scope of the SMS, specifying the services, customers, and organisational units included. The scope must be documented and available as formal documented information.
Within the scope, the standard requires the organisation to plan, implement, and maintain processes for: service catalogue management, service level management, incident management, service request management, problem management, change management, release and deployment management, configuration management, availability and continuity management, capacity management, and information security management related to IT services.
SMS software provides the structure to define and trace each process, document its inputs, outputs, and interfaces, and link it to the services and customers it covers. Without a structured tool, process documentation quickly fragments across different team wikis and shared drives, making it difficult to demonstrate to an auditor that all required processes are covered and operating as documented.
How do incident, problem, and change management work under ISO 20000?
ISO/IEC 20000-1:2018 clauses 8.6, 8.7, and 8.5 respectively require formal processes for incident management, problem management, and change management. These three processes are interconnected: incidents trigger problem investigations when root causes are unknown, and problems may trigger changes to resolve the root cause permanently.
Incident management requires classification by priority, assignment, resolution within agreed SLA targets, and closure with customer satisfaction confirmed where appropriate. Problem management requires logging the problem record, identifying root cause, implementing a workaround where possible, and tracking to permanent resolution. Change management requires assessment, authorisation, and scheduling before implementation, with post-implementation review.
SMS software records each incident, problem, and change in linked registers, so the relationship between them is traceable. For ISO 27001, the complementary standard to ISO 20000 for IT information security, the same incident record may feed both the SMS and the information security management system, reducing duplicate data entry.
How do continual improvement and internal audit work under ISO 20000?
ISO/IEC 20000-1:2018 clause 10 requires the organisation to continually improve the SMS and its services. Continual improvement should be driven by analysis of service performance data, audit findings, customer satisfaction surveys, and management review outputs.
Clause 9.2 requires internal audits at planned intervals to verify that the SMS conforms to the standard's requirements and to the organisation's own documented requirements. Audit findings generate nonconformities that must be corrected and their root causes eliminated through corrective action.
SMS software supports the continual improvement cycle by capturing improvement initiatives alongside corrective actions, linking both to their source evidence, and tracking them through to verified closure. Management review preparation is simplified because the system provides a consolidated view of SLA performance, audit findings, customer satisfaction data, and open actions.
How does SMS IT software cover ISO 20000-1:2018 requirements?
An SMS software tool structured around ISO 20000-1:2018 provides dedicated modules for: service catalogue and scope documentation, SLA management and reporting, incident and problem management, change and release management, configuration management, capacity and availability planning, internal audit management, nonconformity and corrective action, and management review preparation.
The Optivalue.ai platform operates 85 specialised agents (72 business agents, 12 sector agents, and 1 librarian agent, as documented in the platform's own product description [lu: iso-20000-software.com/en/index.md]), which train on the organisation's service documentation to cross-reference each clause of the standard against actual evidence. As a GRC platform that integrates ISO 20000 with other IT regulatory obligations, it allows an IT service organisation to manage ISO 20000 and ISO 27001 requirements in a single compliance layer.
The key selection criterion is whether the software connects live service performance data to the SMS compliance framework, so that audit preparation is a reporting exercise rather than a manual data-gathering project.
See how Optivalue.ai guides your ISO 20000 SMS. Book a demonstration
Frequently asked questions
What is ISO/IEC 20000-1:2018 and what does it certify?
ISO/IEC 20000-1:2018 is the current version of the international standard for IT service management systems. Certification confirms that an IT service provider has established, implemented, and maintained an SMS that meets the standard's requirements. It is sought by IT departments, managed service providers, and outsourcing companies to demonstrate service quality to customers and procurement teams.
What is the difference between ISO 20000 and good practice frameworks for IT service management?
ISO 20000 is a certifiable standard specifying what an SMS must achieve. Good practice frameworks for IT service management describe how to design and deliver IT services using recommended practices and processes. The two are complementary: an organisation may use a framework as a source of practices to implement within its ISO 20000-compliant SMS, but framework adoption alone does not result in ISO 20000 certification.
How does ISO 20000 relate to ISO 27001?
ISO 20000 and ISO 27001 are complementary standards that often apply to the same IT organisation. ISO 20000 covers the management of IT services; ISO 27001 covers the management of information security risks. Clause 8.8 of ISO 20000-1:2018 requires the organisation to manage information security within the SMS, so the two standards share some requirements and can be managed within a single integrated system.
Which organisations seek ISO 20000 certification?
ISO 20000 certification is sought by IT service providers that wish to demonstrate service quality to customers, by organisations whose customers or procurement contracts require certification, and by IT departments that want a structured framework for managing service quality. As stated in the iso-20000-software.com source [lu: iso-20000-software.com/en/index.md], the standard applies to IT departments, managed service providers, and internal shared service centres.
Can ISO 20000 be managed alongside ISO 9001 in the same tool?
Yes. ISO 20000-1:2018 and ISO 9001:2015 both follow the High Level Structure and share common clauses for context, planning, support, performance evaluation, and improvement. A multi-standard platform handles these shared requirements once, avoiding duplication of policies, audit programmes, and corrective action processes.
<!-- JSON-LD -->
Back to top