What is ISO 20000-1?
ISO 20000-1 is the international standard for IT service management. The standard describes how to set up a service management system (SMS): a system for delivering, monitoring and improving IT services reliably. You can get certified against it. The standard was created by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), which is why its full name is ISO/IEC 20000-1. In the Netherlands, you can buy the standard from NEN .
Where ISO 27001 focuses on information security, ISO 20000-1 focuses on the quality of your service. Do you deliver IT services to customers or to your own organisation? Then this certificate shows that you have incidents, changes and service agreements (SLAs) under control. The current version is ISO/IEC 20000-1:2018 , with a small addition on climate change added in 2024 (Amendment 1:2024 ).
| Feature | Detail |
|---|---|
| Full name | ISO/IEC 20000-1:2018 |
| Publisher | ISO/IEC, in the Netherlands via NEN |
| Subject | IT service management (an SMS) |
| Certifiable part | Part 1 (20000-1) |
| Certificate validity | 3 years, with a yearly surveillance audit |
| Mandatory? | Not required by law, sometimes a requirement in tenders |
ISO 20000-1 is a standard, not a framework. That is an important difference from ITIL 4. You can have your organisation certified against a standard. ITIL is best practice that helps you meet it, but it does not give you an organisational certificate.
What is a service management system (SMS)?
The SMS is the heart of the standard. It is not a software package you install, but a way of working. The SMS describes how you plan, deliver, monitor and improve IT services. Think of clear agreements with customers, a working helpdesk, and a fixed process for changes.
An example makes this concrete. A hosting company promises 99.9 percent availability. The SMS then covers: how you measure that, what you do during an outage, who informs the customer, and how you prevent it from happening again. Together, all these agreements form the system.
A good SMS is a living system. If you launch a new service or take over a supplier, the SMS changes with it. The British Standards Institution (BSI) calls it the “global standard for service management systems”.
Who is ISO 20000-1 for?
The standard is mainly relevant for organisations that deliver IT services and need to prove it. The benefits are concrete: fewer outages, faster resolution times and more trust from customers.
- Managed service providers (MSPs) that provide IT management to customers
- Hosting and cloud providers with availability agreements
- Internal IT departments that want to show their service to the business
- Suppliers in tenders where the government or large enterprises ask for certification
Read more on who ISO 20000-1 is for. Are you a service provider? Then see ISO 20000-1 for managed service providers.
Is ISO 20000-1 mandatory?
No. No Dutch law requires ISO 20000-1. However, it is sometimes effectively necessary. Government and large corporate tenders often list it as a requirement or a plus. It is frequently requested alongside ISO 27001 for information security.
A certificate sets you apart from competitors who only say they “work according to ITIL”. An ISO 20000-1 certificate is checked by an independent party. A working method is not.
How much does ISO 20000-1 certification cost?
The costs depend on your size and how much you already have in order. The biggest items are the preparation (often with a consultant) and the audit by an accredited body such as Kiwa , DNV or TÜV .
| Company size | Indicative total cost in year one |
|---|---|
| Small (1 to 25 employees) | €10,000 to €25,000 |
| Medium (25 to 100 employees) | €25,000 to €60,000 |
| Large (100+ employees) | €60,000 to €150,000+ |
These are indications, not quotes. After certification, there are yearly costs for surveillance audits and maintenance. The full breakdown is on costs and timeline.
How long does the process take?
Plan for six to twelve months, depending on your starting point. You begin with a baseline assessment, build your SMS, and run the system for a while before the auditor comes. The whole process is in the step-by-step plan. We explain the audit process separately.
The relationship with other standards
ISO 20000-1 follows the High Level Structure (HLS) , as do ISO 27001 and ISO 9001. Clauses 4 to 10 therefore look very similar. If you are already ISO 27001 certified, you can reuse a lot: document control, internal audit and management review. You can read how that works on ISO 20000 and ISO 27001.
Are you delivering a SaaS service to the American market? Then you often come across SOC 2 as an addition to your service management. For the “how” of service management, many companies use ITIL 4 to implement the standard.
Next steps
Sources
- ISO/IEC 20000-1:2018: service management system requirements , International Organization for Standardization
- NEN: IT service management with ISO/IEC 20000 , Nederlands Normalisatie-instituut (Dutch Standardisation Institute)
- BSI: ISO/IEC 20000-1 Service Management , British Standards Institution
- DNV: ISO 20000 IT service management certification , certification body