In brief:
- ISO 20000 is the international standard that certifies an IT organization’s service management system (SMS).
- It imposes documented, verifiable requirements, unlike ITIL, a best-practice framework that cannot be certified for an organization.
- The standard is structured in two parts, the certifiable SMS requirements and application guidelines, built around a continual improvement cycle.
- Certification follows a multi-step process leading up to an audit by an accredited body, then maintained through surveillance audits.
The ISO 20000 standard is the international framework that governs and certifies an IT organization’s service management system (SMS). Unlike a best-practice framework such as ITIL, it sets formal requirements, verifiable through an external audit and recognized through a certificate. IT departments rely on it when the maturity of their service management needs to be demonstrated to clients, principals or regulatory authorities.
What is the ISO 20000 standard?
ISO 20000 is published by ISO (the International Organization for Standardization) together with IEC (the International Electrotechnical Commission), which explains its full reference, ISO/IEC 20000-1. The current version dates from 2018 and succeeds a first publication from 2011. The standard traces back to BS 15000, a British standard published by the British Standards Institution in the early 2000s, before being internationalized by ISO.
Its subject is the service management system: the set of policies, processes, roles and tools an organization puts in place to plan, deliver and improve its IT services. ISO 20000 does not describe how to handle an incident or configure a ticketing tool: it sets requirements on how the system as a whole is governed and documented.
What is the service management system (SMS) for?
The SMS aims to ensure that IT services meet the needs of the business and its customers in a planned, controlled and continually improved way. It covers service governance, relationship management with stakeholders, service design and transition, and their resolution and improvement over time, a logic close to the one described in Enterprise Service Management.
An effective SMS gives IT leadership a documented view of its commitments, its risks and its room for improvement, rather than an organization built on informal practices that depend on a few individuals.
The structure of the standard: ISO/IEC 20000-1 and 20000-2
The ISO/IEC 20000 family breaks down into two texts with distinct roles.
| Part | Role | Nature |
|---|---|---|
| ISO/IEC 20000-1 | SMS requirements to satisfy for certification | Certifiable |
| ISO/IEC 20000-2 | Guidelines for applying the requirements | Not certifiable, an implementation guide |
Only part 1 is subject to a certification audit. Part 2 helps teams interpret the requirements and translate them into practice, without any audited compliance. The whole relies on a PDCA cycle (Plan, Do, Check, Act), which structures the planning, implementation, monitoring and continual improvement of the SMS.
The benefits of ISO 20000 certification
Certification brings international recognition of the maturity of IT services, useful in tenders or negotiations with demanding clients. It also structures service management internally, with clarified roles and responsibilities, a concern close to the one explored in ESM vs ITSM.
Finally, it embeds a discipline of continual improvement: surveillance audits require regular measurement of SMS performance, rather than treating service quality as a one-off topic.
The ISO/IEC 20000-1 certification process
Certification follows a structured path, which generally starts with a gap analysis between existing practices and the standard’s requirements, then continues with bringing processes and their documentation into compliance.
The PDCA cycle applied to the SMS
The PDCA cycle structures the process over time: plan the SMS objectives, implement the processes, check how they work through internal audits, then act to correct any gaps found. This cycle repeats after the certificate is obtained, through surveillance audits carried out by the certification body.
Choosing an accredited certification body
The certification audit is carried out by an accredited body, in two stages: a documentation audit that checks the SMS exists and is coherent, then an operational audit that checks it is actually applied. Only the body’s accreditation guarantees that the certificate issued is recognized internationally.
ISO 20000 and ITIL: two complementary frameworks
ISO 20000 and ITIL are often confused even though they answer different questions. ITIL is a best-practice framework that describes how to organize incident management, change management or the service catalogue, as detailed in the ITIL methodology. It is not certifiable for an organization: only individuals obtain individual ITIL certifications.
ISO 20000, by contrast, is a standard certifiable for the organization itself. In practice, the two frameworks combine naturally: ITIL practices often supply the operational substance that satisfies the documentation and governance requirements of the ISO 20000 standard, somewhat like how COBIT structures governance above ITIL practices. An organization certified to ISO 20000 does not have to choose between the two: it typically relies on ITIL for execution and on ISO 20000 to have that control certified.
Frequently asked questions
What is the ISO 20000 standard?
ISO 20000 is the international standard that defines the requirements for an IT service management system (SMS). Published by ISO together with IEC under the reference ISO/IEC 20000-1, it can be certified by an accredited body, unlike a best-practice framework such as ITIL. It is aimed at organizations that need to demonstrate, with evidence, that they are in control of their IT services.
What is ISO 20000 certification used for?
It confirms that an organization plans, delivers and improves its IT services in a structured and verifiable way. Certification serves as a trust signal to clients and principals, particularly in tenders that require a demonstrated level of maturity. It also embeds a discipline of continual improvement that goes beyond a one-off audit exercise.
What is the difference between ISO 20000 and ITIL?
ISO 20000 is a certifiable standard: an organization can gain or lose certification depending on whether it meets precise requirements verified by an external auditor. ITIL is a best-practice framework that is not certifiable for an organization as such, only individuals take ITIL certifications. In practice, ITIL often supplies the operational practices that help satisfy the standard’s documentation and governance requirements.
Who issues ISO 20000 certification?
Certification is issued by accredited certification bodies, such as AFNOR Certification, Bureau Veritas or DNV, following an audit of the service management system. The accreditation of these bodies guarantees the independence and rigor of the audit, a necessary condition for an ISO 20000 certificate to be recognized internationally.
Do ISO 20000 and ISO 27001 belong to the same family of standards?
Both are certifiable ISO standards that follow the same management-system logic and the same continual improvement cycle, but their scope differs. ISO 20000 covers IT service management, while ISO 27001 covers information security management. An organization can hold both certifications in parallel, sharing common governance and documentation processes.