The requirements of ISO 20000-1
ISO 20000-1 sets the requirements for your service management system (SMS). The requirements are in seven chapters: clauses 4 to 10. Clauses 1 to 3 cover the introduction and terms, so you are not assessed on them. The standard follows the High Level Structure (HLS) , the same structure as ISO 27001 and ISO 9001. If you already have an ISO standard, much of this will look familiar.
On this page we go through the chapters in plain language. Want the overview first? Then read what ISO 20000-1 is. We cover the individual service management processes separately on the processes. You can buy the official text from NEN or ISO .
The standard says what you must arrange, not how. You choose how you meet it. Many companies use ITIL 4 as their approach, but you do not have to.
On this page
Below we cover the seven auditable chapters. For each chapter, you read what the standard asks and see a concrete example. Clause 8 is by far the largest: it contains the service management processes.
Who are your customers and what is your scope?
4. ContextManagement takes ownership and sets the policy.
5. LeadershipRecord risks, opportunities and service objectives.
6. PlanningArrange people, knowledge and documentation.
7. SupportThe service management processes in practice.
8. OperationMeasurement, internal audit and management review.
9. Performance evaluationFix errors and keep improving.
10. Improvement4. Context of the organisation
You start with the question: in what environment do you deliver your services? Who are your customers, users and suppliers? Which internal and external factors affect your service? Based on that, you set the scope of your SMS: which services and locations it covers.
An example. An MSP provides workplace management and hosting. The company decides that only workplace management falls within the scope. That is a valid choice, as long as it is clearly defined and the auditor can check it.
5. Leadership
Management must be visibly responsible for the SMS. Not just a signature, but real involvement: making resources available, assigning roles and drawing up a service management policy. That policy describes what you promise customers and how you deliver on it.
In practice, this means one board member is ultimately responsible. That person regularly reviews how the service is running, not only whether the revenue is right.
6. Planning
You look ahead. Which risks threaten your service, and which opportunities do you see? Think of a supplier that might fail, or a new service you want to launch. You set service objectives, for example a maximum resolution time for incidents, and you plan how to meet them.
7. Support
No system works without the right people and resources. This chapter asks for sufficient capacity, demonstrable knowledge and good communication. Document control also belongs here: you record what is needed and keep it up to date.
An example: your helpdesk staff receive training in the new ticketing system, and you record who is responsible for what. No thick manual, just clear agreements.
8. Operation: the heart of the standard
Clause 8 is by far the largest chapter. This is where the service management processes sit: the day-to-day practice of IT service delivery. During the audit, half of the time often goes here. We cover these processes in detail on the service management processes.
In short, the standard asks, among other things, for:
| Process | What it covers |
|---|---|
| Service level management | Agreements in SLAs, and monitoring whether you meet them |
| Incident management | Resolving disruptions quickly |
| Service requests | Handling standard requests |
| Problem management | Addressing underlying causes |
| Change management | Making changes in a controlled way |
| Release management | Rolling out new versions safely |
| Configuration management | Keeping track of your IT components |
| Capacity and availability | Making sure services keep working |
| Supplier management | Securing agreements with your own suppliers |
9. Performance evaluation
You measure whether your SMS works. Are you meeting your SLAs? How many incidents were there? You carry out an internal audit regularly, and management reviews the results in a management review. Without measuring, you do not know whether your promise to the customer holds.
10. Improvement
No system is perfect from the start. When something goes wrong, a nonconformity in standard terms, you correct it and prevent it from happening again. The standard asks for continual improvement: small steps, built into the structure. This links to the PDCA cycle (Plan-Do-Check-Act).
A common mistake: companies write good processes but do not follow them. The auditor looks for evidence from practice. Tickets, SLA reports and evaluations count. A document alone does not.
What the requirements deliver together
Together, the seven chapters form a working SMS. You know what customers expect, you deliver it in a way you can demonstrate, and you improve where things go wrong. Want to know how to build this? Read the step-by-step plan. Are you combining it with information security? See ISO 20000 and ISO 27001.
Sources
- ISO/IEC 20000-1:2018: service management system requirements , International Organization for Standardization
- NEN: IT service management with ISO/IEC 20000 , Nederlands Normalisatie-instituut (Dutch Standardisation Institute)