ISO 20000 baseline measurement: what does a gap analysis involve?
An ISO 20000-1 baseline measurement assesses your current service delivery against the requirements of the standard, usually clause by clause. The result is a gap register: a list of what is already in place, what is partly in place and what is missing, with an action and an owner for each line. You do not need a certificate to do this, and the standard does not require a baseline measurement. But without one, you do not know where to start. The requirements themselves are in ISO/IEC 20000-1:2018 , sold via NEN , and are explained clause by clause on the requirements of ISO 20000-1.
A baseline measurement is the first step of the step-by-step plan and sets the course for the rest of the process. Anyone who skips it often finds the gaps only during the audit. By then, they have to fix them under time pressure.
What do you measure in a baseline measurement?
You check two things. First, whether you have defined the requirement: is there a policy, a process or a work instruction? Second, whether you actually do it: is there evidence that it works in practice? A policy document without evidence counts as partly met, not as met.
| Clause | Topic | Question at the baseline measurement | Evidence an auditor wants to see |
|---|---|---|---|
| 4 | Context | Do you know your services, customers and the requirements of interested parties? | Service catalogue, list of customers and agreements |
| 5 | Leadership | Has top management set a policy and assigned roles? | Service policy, roles and responsibilities |
| 6 | Planning | Have you recorded risks and objectives for the SMS? | Risk register, objectives with measurable targets |
| 7 | Support | Are people, resources and documents in order? | Competence overview, document control |
| 8 | Operation | Do the service management processes work? | Tickets, change records, SLA reports |
| 9 | Performance evaluation | Do you measure performance and carry out internal audits? | Reports, audit report, management review |
| 10 | Improvement | Do you handle nonconformities and improvement opportunities in a structured way? | Improvement register, corrective actions |
Clause 8 gets the most attention in the baseline measurement. This is where the operational processes sit, such as incident, problem and change management. At stage 2, the auditor wants to see the most examples there, and this is often where most of the gaps are. What the processes look like is explained on the service management processes.
Step by step
Set the scope of the measurement
Only measure the services and locations that fall within your scope. A measurement across the whole company that you then have to cut back takes more time than necessary.
Collect the existing documents and records
For each requirement, ask for the evidence. Think of your tickets, change log, SLAs, meeting minutes and internal audit reports. Anything that does not exist, you note as a gap.
Score per clause
Use three scores: met (policy and evidence in place), partly met (policy or evidence missing), and not met (neither). Write a short explanation with each score.
Set up the gap register
Translate each gap into an action, an owner and a date. Bundle gaps that are related, such as a missing change process and a missing registration form.
Discuss the outcome with management
Management needs to know the priorities and must free up the resources. Without that support, the gap register stays a document in a folder.
Example: baseline measurement at a small MSP
A fictional managed service provider (MSP) with 18 employees and one customer with a service contract carries out the measurement. Below is an extract from the gap register.
| Requirement | Score | Explanation | Action | Owner |
|---|---|---|---|---|
| 4.2 Interested parties | Met | Customer list and contracts are in place | None | Account manager |
| 5 Service policy | Partly met | Policy exists, but management has not approved it | Have the policy approved and signed | Director |
| 6 Risks for the SMS | Not met | No risk register for the service delivery | Draft a risk register | Operations lead |
| 8 Incident management | Partly met | Incidents are recorded, but without priority or resolution time | Extend the registration with priority and an SLA timer | Service desk |
| 8 Change management | Not met | Changes go by email and are not recorded | Introduce a change form and approval step | Operations lead |
| 9 Internal audit | Not met | No internal audit carried out yet | Plan the internal audit after the processes are set up | Quality manager |
The example shows why the measurement is useful. The policy gap is small, but the change gap affects several requirements in clause 8 and therefore calls for a different order of work.
Who carries out the baseline measurement?
This can be an internal quality manager or an external consultant. An external consultant brings a fresh view and knows the requirements of the standard, but still has to learn your processes. An internal person knows the processes, but often does not see their own blind spots.
The certification body does not carry out the baseline measurement. At the stage 1 audit, it only assesses whether your documentation and readiness meet the requirements. A baseline measurement is therefore for your own benefit, not for the auditor.
Common mistakes
The most common mistake is limiting the baseline measurement to documents. A policy that looks right on paper says nothing about whether it works. Always ask for evidence from practice over the past few months.
- Vague scores. “Sufficient” says nothing. Write down what is missing.
- No owner per action. A gap without a name attached stays open.
- Scope too broad. First measure the services you want to certify.
- Only measuring clauses 4 to 7. Clause 8 determines most of the outcome and must not be underexposed.
What does a baseline measurement cost?
The cost depends on the size of your service delivery and the amount of evidence you need to go through. There is no fixed price list for a baseline measurement, so we do not quote amounts here. Ask for quotes and compare them on the scope they include. The total cost structure of the process is set out in costs and timeline.
The method resembles the one used for ISO 27001. With ISO 20000 and ISO 27001 together, you can do one measurement for both standards, provided you write out the requirements for each standard separately.
What do you deliver?
A baseline measurement ends with three things: the gap register, a short summary for management and a plan with the order of remediation. The gap register is the most important document. Keep it up to date until certification, and use it as the basis for the internal audit.
Next steps
Sources
- NEN: IT service management with ISO/IEC 20000 - Netherlands Standardization Institute (NEN)
- BSI: ISO/IEC 20000-1 Service Management - British Standards Institution