ISO 20000-1 for managed service providers (MSPs)

Managed service providers are the most obvious target group for ISO 20000-1. An MSP delivers IT services as its core business: workplace management, hosting, cloud management or a combination of these. Clients pay for reliable, demonstrably well-managed services. ISO 20000-1 is the international standard that shows exactly that: your processes for incidents, changes and service agreements work, and an independent party has assessed them. The standard is published by ISO  and is available via NEN . Read more about the standard and who uses it on what ISO 20000-1 is and who ISO 20000-1 is for.

For most MSPs in the Netherlands, ISO 20000-1 cannot be separated from ISO 27001. Clients and tenders almost always ask for both together.

Why clients and tenders ask for ISO 20000-1

An MSP that says “we work according to ITIL” sounds good. But it has not been assessed. There is no ITIL certificate for organisations, only for individuals. A client who outsources its IT cannot check that claim.

ISO 20000-1 solves that problem. The certificate proves that an independent auditor has assessed the processes and approved them. Clients do not have to take your word for it. They only have to ask for the certificate.

What clients want to know: the table

Competitive advantage over “we work according to ITIL”

In government and large company tenders, ISO 20000-1 increasingly appears as a requirement or an award criterion. Providers without it are sometimes excluded straight away. Providers with it stand out from competitors that only promise processes.

This also applies outside tenders. Enterprise clients and healthcare organisations increasingly ask for certified suppliers. The certificate speeds up the sales process: you no longer need to persuade with brochures, because the evidence is set down in black and white.

The combination with ISO 27001

Almost all MSPs that achieve ISO 20000-1 combine it with ISO 27001. Clients want to know both that their data is secure and that the service is delivered reliably. ISO 27001 covers the first, and ISO 20000-1 covers the second.

The combination is also practically logical. Both standards follow the same High Level Structure (HLS), so you set up document control, internal audit and management review only once. A combined audit with bodies such as DNV  or Kiwa  costs less than two separate processes. Read more on ISO 20000 and ISO 27001.

If you also work for SaaS clients serving the American market, you will also come across SOC 2.

Concrete MSP examples

Workplace management. An MSP manages 2,000 workplaces for ten clients. ISO 20000-1 shows that there is a working incident process, that SLAs are monitored, and that changes are introduced in a controlled way. Clients receive a monthly SLA report.

Hosting and cloud management. A hosting provider promises 99.9 percent availability. The standard requires that this is set up and measurable: capacity planning, monitoring and continuity measures. The auditor checks whether it holds up.

SOC services. An MSP that provides security operations combines ISO 20000-1 with ISO 27001 for a fully demonstrable package: the service works (20000-1) and the information is secure (27001). See also ISO 27001 for SaaS companies for a similar approach.

Choosing the scope: which services do you include?

You do not have to include all your services in the scope. Start with the services for which clients request certification, and expand later. An MSP that provides workplace management and hosting can start with workplace management alone.

A clear scope keeps the audit manageable and the costs predictable. Starting too broadly leads to a longer process and higher audit costs.

Costs and timeline for MSPs

Plan for six to twelve months for the process, depending on your starting position. An MSP with existing ITIL processes has a head start: the ways of working already exist, and you now set them up so they can be demonstrated. The full cost breakdown is on costs and timeline.

Next steps