The short answer
ISO 20000 (ISO/IEC 20000-1:2018) is the international standard for an IT service management system. It requires defined, controlled processes across the service lifecycle, including the service catalogue, service levels, incident, change and supplier management. Unlike ITIL, which is guidance, an organisation can be certified to ISO/IEC 20000-1 after an independent two-stage audit.
On this page
- What is ISO 20000?
- What does ISO/IEC 20000-1 require?
- Which ISO 20000 processes do auditors look at most?
- How do the service catalogue, incident and change processes work?
- Is ISO 20000 the same as ITIL?
- Who needs ISO 20000?
- How do you get ISO 20000-1 certification?
- How much does ISO 20000 certification cost?
- How do ISO 20000 and ISO 27001 work together for MSPs?
- Who issues the ISO 20000 certificate?
- Why Sovereign Secure
- Get an ISO 20000 quote
ISO 20000 is the international standard for IT service management. Its first part, ISO/IEC 20000-1:2018, sets the requirements for a service management system (SMS) covering how you plan, design, transition, deliver and improve services. It is the part organisations are certified to. Sovereign Secure provides the consultancy that builds the SMS around your real services and tooling; an independent certification body audits it and makes the certification decision.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy and an IASME-licensed Cyber Essentials certification body, headquartered in Accrington, Lancashire. ISO 20000 sits within our wider ISO certification service.
What is ISO 20000?
ISO 20000 is a series of standards. ISO/IEC 20000-1 contains the requirements; other parts support it, including guidance on applying Part 1 (Part 2) and on defining scope (Part 3). Part 1 is written for services in general, but in practice it is used mainly by IT and technology service providers. The current edition was published in 2018 and confirmed by ISO at its 2023 review. A 2024 amendment added climate action changes: you must determine whether climate change is a relevant issue for your SMS, and a new note points out that interested parties can have climate-related requirements.
Certification shows customers that your IT services are delivered through defined, measured and continually improved processes, not through individual heroics. It suits any organisation that provides IT services, whether to external customers or to the rest of its own business.
What does ISO/IEC 20000-1 require?
ISO/IEC 20000-1 requires a management system (clauses 4 to 7, 9 and 10, the same structure as ISO 27001 and ISO 9001) and a set of service management processes in clause 8.
| Clause 8 group | Processes it covers |
|---|---|
| 8.1 Operational planning and control | Planning, controlling and documenting the SMS processes |
| 8.2 Service portfolio | Service delivery, planning services, control of other parties in the service lifecycle, service catalogue, asset and configuration management |
| 8.3 Relationship and agreement | Business relationship management, service level management, supplier management |
| 8.4 Supply and demand | Budgeting and accounting for services, demand management, capacity management |
| 8.5 Service design, build and transition | Change management, service design and transition, release and deployment management |
| 8.6 Resolution and fulfilment | Incident management, service request management, problem management |
| 8.7 Service assurance | Service availability, service continuity and information security management |
Clause 9 adds service reporting to the usual monitoring, internal audit and management review. If suppliers or other parts of your group run some of these processes, you must show that you control them (clause 8.2.3); you cannot outsource accountability.
Which ISO 20000 processes do auditors look at most?
Nine clause 8 processes generate most of the day-to-day records in an SMS, so they are where a certification auditor spends most of the Stage 2 audit. The table shows what each one expects in practice and the evidence that is usually sampled.
| Process (ISO/IEC 20000-1 clause) | What it expects in practice | Evidence usually sampled |
|---|---|---|
| Service catalogue management (8.2.4) | A catalogue describing each service, its intended outcomes and the dependencies between services | The current catalogue, linked to agreements and configuration records |
| Service level management (8.3.3) | Agreed services and targets in service level agreements, with performance monitored and reviewed | SLAs, service reports against targets, review minutes |
| Supplier management (8.3.4) | Contracts or documented agreements with suppliers, agreed targets and performance monitoring | Supplier register, contracts, supplier performance reviews |
| Capacity management (8.4.3) | Planned capacity for people, technology, information and finances, with utilisation monitored | Capacity plan, utilisation reports and the actions they led to |
| Incident management (8.6.1) | Incidents recorded, classified, prioritised, escalated and resolved, with a procedure for major incidents | Incident records, priority definitions, major incident reports |
| Service request management (8.6.2) | Requests recorded, prioritised, fulfilled and closed, with instructions for fulfilment | Request records and fulfilment procedures |
| Problem management (8.6.3) | Problems identified, root causes analysed and known errors recorded | Problem records, known error records, trend analysis |
| Change management (8.5.1) | A change policy, with requests assessed for risk and impact, approved and reviewed, plus an emergency route | Change records, approvals, post-implementation reviews |
| Release and deployment management (8.5.3) | Releases planned, tested and deployed against agreed criteria, with a way to reverse or remedy a failed release | Release plans, test results, deployment records |
Most service desk tools hold these records already. The usual work is making definitions consistent, closing records properly and linking them to the catalogue, so that a sample tells the same story from request to change to release.
How do the service catalogue, incident and change processes work?
These three processes show most clearly whether the SMS controls day-to-day service, so expect the certification auditor to sample their records closely.
Service catalogue
The service catalogue describes each service you deliver, its intended outcomes and the dependencies between services (clause 8.2.4). In practice it should link to your service level agreements and configuration records, so a change or an incident can be traced to the services and customers it affects.
Incident and service request management
Incidents are recorded, classified and prioritised by impact and urgency, then escalated and resolved within agreed targets. Major incidents follow a defined procedure, with top management kept informed. Service requests (a new starter, a password reset, access to an application) are handled through their own process (clause 8.6.2), which keeps incident figures meaningful.
Change management
A change management policy defines what is under change control and which changes could have a major impact on services. Requests for change are recorded, assessed for risk and impact, approved and reviewed after implementation, with a route for emergency changes. Changes with a major impact, such as a new service or a service being removed, go through service design and transition. Most ITSM tools support this workflow; the work is usually agreeing the policy and making the records consistent.
Is ISO 20000 the same as ITIL?
No. ITIL is guidance on how to run IT service management; ISO/IEC 20000-1 is a standard that sets auditable requirements for what must be in place. They are complementary, and many organisations use ITIL practices to meet ISO 20000 requirements.
| Aspect | ITIL | ISO/IEC 20000-1 |
|---|---|---|
| What it is | Best-practice framework | International standard with requirements |
| Tells you | How practices can be run | What must be in place and evidenced |
| Who is certified | Individuals, through ITIL qualifications | Organisations, by a certification body |
| Audited? | No organisational audit | Stage 1 and Stage 2 audits, then surveillance |
| Flexibility | Adopt and adapt what suits you | Every requirement in clauses 4 to 10 applies to the SMS in scope |
Who needs ISO 20000?
ISO 20000 is aimed at organisations that need to prove their IT services are well controlled, usually because a customer, contract or tender asks for it.
- Managed service providers that want to stand out in competitive bids and show clients how service levels are run.
- IT outsourcers and hosting or cloud providers whose contracts depend on availability, continuity and change control.
- Internal IT departments in larger organisations that deliver services to the business under internal agreements.
- Suppliers to the public sector and regulated firms, where service management maturity is part of supplier assessment.
You do not have to certify every service. The scope can cover specific services, customers or locations, as long as it is clearly defined and you control the processes inside it.
How do you get ISO 20000-1 certification?
You get ISO 20000-1 certification by building and running an SMS, then passing a two-stage audit by an independent certification body.
- Define scope. The services, customers, locations and other parties involved.
- Gap analysis. Compare current processes and tooling with every requirement of ISO/IEC 20000-1.
- Design the SMS. Service management policy, objectives, service catalogue, agreements and process definitions mapped to your ITSM tool.
- Run it. Produce the records auditors sample: incidents, changes, releases, service reports, SLA and supplier reviews, capacity plans.
- Internal audit and management review. Both must be complete before Stage 2.
- Stage 1 audit. The certification body reviews your documentation and readiness.
- Stage 2 audit. Interviews and record sampling to confirm the SMS works. The certificate follows once any major nonconformities are closed.
The certificate lasts three years, with surveillance audits in years two and three and a recertification audit before expiry.
How much does ISO 20000 certification cost?
There is no fixed price. ISO 20000 certification cost has two parts: the certification body’s audit fees across the three-year cycle and any consultancy you buy to get ready, plus your own team’s time. These drivers set both:
| Cost driver | Why it changes the cost |
|---|---|
| Services, customers and locations in scope | A narrower scope means fewer processes and records to build and sample |
| People in scope | Certification bodies set audit days largely from headcount |
| Other parties running processes | Suppliers or group functions that run parts of the SMS have to be brought under control and evidenced |
| Maturity of your service desk tooling | Consistent incident, change and request records cut the build work |
| Existing certificates | An ISO 27001 or ISO 9001 system shares the management system clauses, so less is new |
| Level of support | A full SMS build costs more than a gap analysis or an internal audit on its own |
Combining ISO 20000 audits with ISO 27001 audits can reduce audit time if the certification body agrees. We give you a fixed quote for the consultancy once the scope is clear.
How do ISO 20000 and ISO 27001 work together for MSPs?
ISO 20000 and ISO 27001 fit together closely: both use the clause 4 to 10 structure, and ISO/IEC 20000-1 includes information security management (clause 8.7.3), which an ISO 27001 information security management system can largely cover if its scope includes the same services. ISO also publishes guidance, ISO/IEC 27013, on implementing the two standards together.
| ISO/IEC 20000-1 process | Related ISO/IEC 27001:2022 Annex A controls |
|---|---|
| Change management | A.8.32 Change management |
| Incident management | A.5.24 to A.5.28 Information security incident management |
| Supplier management | A.5.19 to A.5.22 Supplier relationships |
| Capacity management | A.8.6 Capacity management |
| Configuration management | A.8.9 Configuration management |
| Service continuity management | A.5.29 and A.5.30 Security during disruption and ICT readiness |
The 20000-1 processes are broader than the security controls they map to (a service incident is not always a security incident), but for an MSP one set of change, incident and supplier records can serve both certificates, with one internal audit programme and one management review. See the ISO 27001 Annex A controls for the security side of each pair; our ISO 27001 consultancy covers the ISMS itself, and service continuity overlaps with ISO 22301 business continuity. Many MSPs also need Cyber Essentials for themselves and their clients; our Cyber Essentials partner programme for MSPs covers that, and we issue those certificates directly as an IASME-licensed certification body.
Who issues the ISO 20000 certificate?
An independent certification body issues the certificate, never the consultant. ISO/IEC 17021-1 requires certification bodies to stay impartial, so a certification body cannot audit a management system it helped design. We build the SMS with you; the certification body audits it, samples records from your service desk tool and makes its own decision. No consultant can guarantee the outcome. Our partner certification body, MQA International, is accredited for ISO/IEC 20000-1 by IAS, the International Accreditation Service. If a tender specifies a particular accreditation body, tell us at the start and we will confirm how your certificate will be issued before you commit.
Why Sovereign Secure
- Security and service management in one team. We are ISO 27001 certified ourselves, and our security work covers the change, incident and supplier controls the two standards share.
- Built on your tooling. We map the SMS to the service desk and monitoring tools you already use, rather than adding a parallel document set.
- Consultancy and certification kept separate. Our partner certification body is MQA International, an independent body that makes its own certification decisions and is accredited for ISO/IEC 20000-1 by IAS.
- One partner for MSP compliance. ISO 20000, ISO 27001 and Cyber Essentials from one UK company, in business since 2012.
Get an ISO 20000 quote
Tell us which services and customers the certificate should cover, the tools you use for service desk and monitoring, any certificates you already hold (such as ISO 27001 or ISO 9001) and your deadline. We will send a fixed quote for the consultancy and explain the certification audit stages for your scope. Request your ISO 20000 quote or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
