ISO/IEC 20000-1:2018
ISO/IEC 20000-1 certification for IT service management
Independent certification that your services are planned, delivered and improved under a managed service management system.
- Valid for
- 3 years
- Surveillance
- Years 1 and 2
- Verification
- Public register
Accredited and empanelled
What is ISO 20000-1?
ISO/IEC 20000-1 specifies requirements for a service management system (SMS). It covers how a service provider plans, designs, transitions, delivers and improves services so that they meet agreed requirements, and it is the international standard most associated with IT service management.
The 2018 edition follows the harmonised structure and sets out its operational requirements in clause 8: service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. It is less prescriptive than the 2011 edition, so ITIL, other frameworks or in-house practice all work, provided the requirements are met.
Managed service providers, outsourcing companies and internal IT functions use the certificate to show clients that services run under defined agreements with measured performance. It is often paired with ISO/IEC 27001, since many clients ask about service quality and information security together.
Who it is for
- Managed service and IT outsourcing providers
- Internal IT departments serving large organisations
- Cloud and data centre operations teams
- Service desks and technical support centres
- Telecoms and network service providers
What sets audit time and cost
Most providers reach a certification decision ten to fourteen weeks after application, depending on how much operating history the service records show.
- Number of people involved in delivering the services in scope
- Number of services and customers covered
- Number of locations, including service desks and data centres
- Processes operated by other parties on your behalf
- Integration with ISO 27001 or ISO 9001
Why it matters
What ISO 20000-1 gives you
- 01
Measurable service levels
Agreed targets, regular reporting and service reviews make performance visible to you and your customers.
- 02
Fewer repeat incidents
Problem management finds underlying causes so the same failures stop recurring.
- 03
Controlled change
Changes are assessed, approved, tested and reviewed, reducing outages caused by releases.
- 04
Credibility in outsourcing
Clients evaluating providers recognise the certificate as evidence of managed service delivery.
The audit
What our auditors examine
- 01
Service portfolio and catalogue
The services in scope, their dependencies and how the catalogue is kept current.
- 02
Agreements and suppliers
Service level agreements with customers and the supplier agreements and internal agreements that support them.
- 03
Resolution and fulfilment
Incident management, service request handling and problem management, with prioritisation and escalation.
- 04
Change, release and deployment
Assessment and approval of changes, release planning and verification after deployment.
- 05
Service assurance
Capacity, availability, service continuity and information security management for the services in scope.
- 06
Reporting and improvement
Service reports against targets, customer satisfaction and improvement actions taken from them.
How certification works
Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
ISO certification
ISO 22301
Independent certification that your organisation can keep prioritised activities running, or restore them in time, after a disruption.
ISO certification
ISO 9001
Independent assessment of your quality management system against ISO 9001:2015, by an accredited certification body.
CMMI appraisals
CMMI Maturity Level 3
An independent appraisal of whether your organisation's standard processes are defined and followed across projects.
Industries we audit for
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
Government and public sector
CERT-In empanelled audits and accredited certification for departments, public sector undertakings and their suppliers.
ISO 20000-1 questions
We audit; we do not consult.
To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your ISO 20000-1 certification
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.