Frequently asked questions about ISO 20000-1

On this page, we answer the questions asked most often about ISO 20000-1. The standard is published by ISO  and is available via NEN . For the full overview, read what ISO 20000-1 is.

What is ISO 20000-1 in brief?

ISO 20000-1 is the international standard for IT service management. The standard describes what a service management system (SMS) must contain: a way of working to deliver, monitor and improve IT services reliably. An organisation can be certified against it. The current version is ISO/IEC 20000-1:2018.

An SMS is not a software package. It is a way of working: how you resolve incidents, introduce changes, monitor SLAs and manage suppliers. The auditor checks whether that way of working actually exists and works.

Is ISO 20000-1 mandatory?

No. No Dutch law makes ISO 20000-1 mandatory for IT service providers. Even so, it can in practice be necessary. In government or large company tenders , the certificate regularly appears as a requirement or an award criterion. Providers without it can be excluded.

The standard is therefore not a legal obligation, but a market requirement. Read more on who ISO 20000-1 is for.

What is the difference between ISO 20000-1 and ITIL?

ISO 20000-1 is a standard: a set of testable requirements against which your organisation can be certified. ITIL is a framework: best practice that tells you how to set up service management in practice. No organisational certificate is possible for ITIL.

Put simply, the standard says what you must manage, and ITIL helps with how. Many organisations use ITIL to implement their SMS and then certify against ISO 20000-1. Read the full comparison on ISO 20000 vs. ITIL 4.

Can you certify an organisation against ITIL?

No. ITIL certificates exist only for individuals, not for organisations. An employee can be ITIL certified, but a company cannot.

If you want to show that your organisation meets the requirements of ITIL-based service management, you need an ISO 20000-1 certificate. That is assessed by an independent auditor. An employee’s ITIL certificate is not.

What is an SMS?

SMS stands for service management system. It is the whole of ways of working, processes, documentation and agreements with which you deliver, monitor and improve IT services. The SMS is not a software package you install, but a way of working.

For example, an MSP that provides workplace management has an SMS if it has fixed processes for resolving faults (incident management), introducing adjustments (change management) and monitoring service agreements (SLAs). The SMS describes all those processes together.

How long is an ISO 20000-1 certificate valid?

Three years. Each year, a surveillance audit follows to confirm that the SMS keeps working. After three years, there is a full recertification.

Anyone who neglects their SMS after the first certification risks suspension or withdrawal of the certificate.

What does ISO 20000-1 cost?

The costs depend on your organisation’s size and starting position. As an indication:

These are indications, not quotes. You can read the full cost breakdown on costs and timeline.

How long does the process take?

Plan for six to twelve months from start to certificate. If you already have working processes for incidents and changes, you are at the lower end of that range. If you start from zero, you are more likely at the upper end.

The step-by-step plan explains the full process step by step.

Can I combine ISO 20000-1 and ISO 27001?

Yes. Both standards follow the same High Level Structure (HLS), so clauses 4 to 7, and clauses 9 and 10, overlap strongly. You build document control, internal audit and management review only once.

A combined audit is also possible with certification bodies such as DNV and Kiwa. That saves audit days and costs. For official guidance, there is ISO/IEC 27013 . Read the full approach on ISO 20000 and ISO 27001.

What is the current version of the standard?

The current version is ISO/IEC 20000-1:2018, the third edition. In 2024, a small amendment was published: Amendment 1:2024  on climate action. This is a standard addition and does not mean a substantive revision of the standard.

No full new version has been announced for 2026.

Who is ISO 20000-1 intended for?

In short, for organisations that deliver IT services on an ongoing basis and want to demonstrate that. Think of managed service providers, hosting and cloud parties, internal IT departments and IT outsourcers. Read the full overview on who ISO 20000-1 is for.

Which processes are in the standard?

The service management processes are in clause 8, the heart of the standard. Think of incident management, service level management (SLAs), change management, release management, problem management, configuration management, supplier management and capacity management. The full explanation is on the service management processes.

Next steps