ISO 20000 vs. ITIL 4
ISO 20000 and ITIL 4 are often confused, but they are fundamentally different. ISO 20000-1 is a standard: a set of requirements against which you can have your organisation certified. ITIL 4 is a framework: best practice that tells you how to set up service management in practice. In short, the standard says what you must arrange, and ITIL helps with the how. Both are about IT service management, but they do not exclude each other. You can read more about the standard itself on what ISO 20000-1 is, and the official relationship is set out in ISO/IEC TS 20000-11 .
ITIL 4 was developed by PeopleCert/Axelos , and ISO 20000-1 by the International Organization for Standardization (ISO) . Many companies use ITIL as the basis for their SMS and then certify against ISO 20000-1. This way, you get the best of both worlds.
A common misunderstanding: you cannot “ITIL-certify” your organisation. ITIL certificates only exist for individuals, not for companies. If you want to demonstrate compliance as an organisation, you need ISO 20000-1.
The core difference: standard versus framework
A standard and a framework have different purposes. A standard contains requirements that can be checked. An independent auditor checks whether you meet them and issues a certificate. A framework is a collection of advice. Nobody checks whether you do it “correctly”, because there are no hard requirements.
A comparison makes this concrete. ITIL describes what a good incident process can look like, with tips and steps. ISO 20000-1 requires that you have a working incident process, and the auditor checks the evidence. You can follow ITIL without an ISO certificate, and you can achieve ISO 20000-1 with a framework other than ITIL.
ISO 20000 and ITIL 4 side by side
The table sets out the main differences.
| Feature | ISO 20000-1 | ITIL 4 |
|---|---|---|
| Type | Standard (requirements) | Framework (best practice) |
| Certifiable | Yes, the organisation | No, only individuals |
| Independent audit | Yes | No |
| Says | What you must arrange | How you can do it |
| Owner | ISO/IEC | PeopleCert (Axelos) |
| Central concept | Service management system (SMS) | Service value system (SVS) |
| Freedom | You choose the framework | Gives concrete practices |
How ITIL 4 is structured
ITIL 4 revolves around the service value system (SVS): a model that shows how an organisation creates value with services. Within the SVS are 34 practices, divided into general management, service management and technical management. Think of incident management, change management and continuity.
ITIL gives detailed advice for each practice. That is useful when you want to build or improve your processes. But ITIL does not require anything. You take from it what fits your organisation.
Which ITIL practice corresponds to which clause is set out in the technical specification ISO/IEC TS 20000-11.
How they work together
In practice, many organisations use ITIL to meet ISO 20000-1. The approach is logical: ITIL provides proven working methods, and the standard provides the testable structure and the certificate. The official guidance on this is in ISO/IEC TS 20000-11 , a separate part that describes the relationship between the standard and frameworks such as ITIL.
A typical route looks like this. You set up your service management processes with ITIL as a guide. Then you measure whether everything works and fill the gaps that the standard requires. Finally, you get certified against ISO 20000-1. The step-by-step plan describes that route.
Many companies tell customers “we work according to ITIL”. That sounds good, but it has not been checked. Tenders increasingly ask for an ISO 20000-1 certificate instead, because that has been independently verified.
Which one should you choose?
It is not either-or. ITIL and ISO 20000-1 complement each other. If you want to improve your service with practical working methods, start with ITIL. If you want to demonstrate this to customers or in tenders, go for ISO 20000-1 certification.
Do you deliver services as a managed service provider? Then the combination is strong: ITIL for your way of working, ISO 20000-1 for the proof. If you also combine information security, read ISO 20000 and ISO 27001.
Next steps
Sources
- ISO/IEC TS 20000-11: relationship with frameworks (ITIL) , International Organization for Standardization
- ISO/IEC 20000-1:2018: service management system requirements , International Organization for Standardization
- PeopleCert: ITIL 4 , manager of ITIL