Iso Iec 20000

ISO/IEC 20000 is the international formal standard for IT service management. Part 1 specifies requirements for a service management system (SMS) that an organization can have independently audited and certified. It is best for organizations that need auditable, certifiable proof of their ITSM capability for regulatory or procurement demands.

Input required

• The organization, the services in scope, and the locations and teams involved.
• The edition of ISO/IEC 20000-1 that applies. Confirm the current edition from ISO.
• Existing ITSM practices, such as ITIL-based processes, and existing management systems (for example ISO 9001 or ISO/IEC 27001).
• The driver: customer tender, regulation, or internal improvement.

Questions to ask first

1. Which services and sites are in scope for certification?
2. Which edition and certification body are involved?
3. What ITSM processes and records exist today?
4. What is the target audit date?
5. Is the SMS to be integrated with other management systems?

Method

1. Define scope. Name the services, customers, and sites, and justify exclusions.
2. Gap assessment. Compare current practice to the requirements in the official standard text the user holds. Do not rely on memory of clauses.
3. Plan the SMS. Set policy and objectives, assign roles, plan resources, and define the processes the standard requires, such as incident, change, service level, supplier, and continual improvement.
4. Document. Produce the documented information the standard requires, kept proportionate.
5. Operate and record. Run the processes and keep records that serve as audit evidence.
6. Internal audit and management review. Audit the SMS internally, then hold management review and fix nonconformities.
7. Certification audit. Engage an accredited certification body, then maintain through surveillance audits and continual improvement.

Output format

• Scope statement.
• Gap table: requirement area, current state, gap, action, owner.
• Evidence checklist for audit.
• Timeline to certification.

Ground rules

• Do not quote clauses or claim certification status. Use only the standard text and facts the user supplied.
• Do not invent audit findings or certificate details.
• Certification is of the organization's SMS within a stated scope, not of a person or a product.

Self-check before answering

• Is the scope explicit?
• Is every requirement claim traced to the standard text the user holds?
• Is there audit evidence for each process?

Common pitfalls

• Scope too wide or vague.
• Documents without operating records.
• Skipping internal audit and management review.
• Assuming ITIL adoption equals conformity — ITIL is guidance, and ISO/IEC 20000 sets requirements.

Example prompt

"Plan a path to ISO/IEC 20000-1 certification for our managed hosting service, starting with a scope statement and gap table."

Learn more

• Related: Itil 5, Fitsm, Yasm, Service Level Agreement, Vendor Management.
• Official source: ISO.