Defining the ISO 20000-1 scope
The scope of ISO/IEC 20000-1 describes which services, locations, teams and suppliers fall under your service management system (SMS). ISO/IEC 20000-1:2018 uses the scope to determine which organisation plans, designs, transitions, delivers and improves services. Read the service management processes and the step-by-step plan as well before you record a scope statement.
ISO/IEC 20000-3 gives specific guidance on scope and applicability. You may limit the scope to a part of a larger organisation, but the limitation must be honest and demonstrable. A tool, department or customer name on its own is not a good scope. The auditor must be able to see which services and responsibilities are included.
Gather the building blocks first
Make a service inventory that lists, for each service, the customer, owner, delivery location and supporting processes. Also note the systems, teams, suppliers and interfaces that make the service possible. For every boundary, ask: who decides, who carries it out, and who can affect the result?
Include at least these elements:
- services and service levels, including internal services;
- locations and relevant infrastructure;
- teams that plan, deliver, support and improve;
- processes such as incident, change, configuration and supplier management;
- external suppliers and the agreements through which you control their performance;
- customers, users, and contractual or legal boundaries.
A supplier may sit outside your organisation and still be relevant to your SMS scope. You do not certify the supplier automatically. However, you must show how you manage the dependency you receive from them.
Examples of scope statements
| Organisation type | Example scope | Boundary to check |
|---|---|---|
| Internal IT department | Delivery and support of workplace, network and identity services to employees in the Netherlands | Which cloud and telecom suppliers fall under supplier management? |
| MSP | Design, transition, delivery and support of managed cloud and backup services to business customers from two data centres | Which customer processes and subcontractors are interfaces? |
| Hybrid organisation | IT service desk and application management for the production sites in Utrecht and Eindhoven | Which central security and HR processes support the SMS? |
The examples are fictional. Put your own service names, locations, contracts and interfaces into the statement. Do not write “all IT” if you can only demonstrate one managed service.
Describing boundaries without arbitrary exclusions
Your scope must not become so narrow that essential activities disappear. An MSP that names only the service desk, but leaves changes and suppliers out of view, cannot credibly control its delivery. For each excluded activity, describe why it is not part of the service, who holds the responsibility, and how the interface is monitored.
For example, HR falls outside the SMS, but HR does provide access management. Then record which request, approval, execution and check sit with HR, and which evidence your service process receives. If a process is needed to deliver the service, it must be in the scope or be demonstrably controlled through an interface.
Self-test before the stage 1 audit
Ask someone outside the project team to read your scope statement and answer these questions:
- Which services exactly do we deliver?
- For which customers or users?
- From which locations and with which teams?
- Which suppliers and interfaces are critical?
- Where does our responsibility begin and end?
- For each sentence, can I point to an SLA, process, record or performance indicator?
If employees give different answers, the scope is not yet sharp enough. Then check whether the scope comes back in SLAs, the service catalogue, incident records, change management and management reporting.
Fictional case: a growing MSP
An MSP wants to certify only “cloud management”, because that sounds clear commercially. During the scope workshop, it emerges that the service desk logs incidents, an external party performs backups, and a different team approves changes. The new statement therefore names managed cloud and backup services, the service desk and the change process for business customers from two locations. The external backup provider remains a supplier, with measurable agreements and periodic review.
The MSP excludes development projects because they do not fall under the managed services. That choice is stated explicitly in the scope, including the interface for when a project moves into operations.
A scope is not a way to write difficult requirements out of the picture. Make the boundaries traceable and discuss the wording with your certification body in advance.
Frequently asked questions
Does the whole organisation have to be in scope?
No. ISO describes that a part of a larger organisation can manage and deliver services. The chosen scope must, however, include all activities needed to demonstrably control those services.
Can I certify just one customer?
Only if the scope, service and responsibility are clear and the certification body accepts the wording. A customer name does not replace a description of the service and processes.
Where can I read more about the scope?
Use ISO/IEC 20000-3 for guidance, and discuss applicability with your auditor.