Who is ISO 20000-1 for?

ISO 20000-1 is the international standard for organisations that deliver IT services and want to prove it. It covers companies and departments that provide IT services on an ongoing basis to customers or to an internal client, with agreements on quality and availability. The standard is published by ISO  and is available in the Netherlands through NEN (Netherlands Standardisation Institute) . You can read more about the standard itself on what ISO 20000-1 is. Are you a managed service provider? Then go straight to the page ISO 20000-1 for managed service providers.

The standard is not equally relevant to everyone. Use the table below to see quickly whether you are in the target group.

Which organisations is it relevant for?

Managed service providers (MSPs)

An MSP manages IT for other companies: workstations, servers, networks and cloud infrastructure. Clients pay for a reliable service and want to know there is a system behind it. Not just a brochure full of promises.

ISO 20000-1 gives that client the proof. An independent auditor has checked whether the processes for incidents, changes and SLAs actually work. That is different from “we work according to ITIL”: that has not been checked externally.

Hosting and cloud providers

Data centres and cloud providers sign contracts with strict availability agreements, often 99.9 percent uptime or more. The standard asks for exactly what you need to meet them: working processes for incident management, capacity planning and continuity.

Internal IT departments

An internal IT department has no external customers, but it does have an internal client: the rest of the company. That business wants to know what the IT department delivers and whether it can rely on it. ISO 20000-1 helps the IT department structure and measure that service.

For example. The IT department of a healthcare organisation manages workstations for 500 employees. With ISO 20000-1, it records what it delivers, how fast it resolves outages, and how it decides on changes. The board now sees figures, not gut feelings.

Suppliers in public tenders

In European public tenders and procurement processes of large companies, ISO 20000-1 increasingly appears as a requirement or an award criterion. This is especially true if you deliver services that overlap with information security. Read more on the Ondernemersplein (Dutch government business portal) page about ISO certification in public tenders .

When is it not needed?

Honestly, ISO 20000-1 does not make sense for every company. You can probably skip it if:

• Your small internal IT department only manages workstations without formal agreements
• You have no clients who ask for certified service quality
• There is no tender pressure for this certificate in your market
• You do not yet have basic processes for incidents and changes (start without a certificate first)

The standard requires that your processes really work and that you can provide evidence. If you do not have that evidence, it is better to invest in the processes themselves first.

ISO 20000-1 in public tenders

The Dutch central government (Rijksoverheid) encourages the use of ISO standards in public tenders . IT service providers bidding for government contracts increasingly see ISO 20000-1 listed alongside ISO 27001 for information security. If you have both, you meet the most frequently requested combination.

Next steps

Is your question not listed here? Then see the frequently asked questions about ISO 20000.