ISO/IEC 20000 — IT Service Management System (ITSMS)
- ClassificationCategoryIT Governance & Service ManagementDomainIT GovernanceFramework FamilyISO Management Systems
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherInternational Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), ISO/IEC JTC 1/SC 40
- VersioningVersionThird edition (ISO/IEC 20000-1:2018; Amendment 1:2024)Effective DateSeptember 14, 2018Issue DateSeptember 2018 (third edition; replaces the 2011 edition)
- AdoptionAdoption ModelCertificationImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
ISO/IEC 20000-1:2018 is a paid standard sold by ISO and national standards bodies, and the text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- ISO/IEC 20000-1:2018 specifies requirements for a service management system covering planning, design, transition, delivery, and improvement of services.
- ISO/IEC JTC 1/SC 40 published the third edition on September 14, 2018, replacing the 2011 edition; Amendment 1:2024 applies.
- It applies to any organization delivering services to internal or external customers, including internal IT departments and managed service providers.
- Excluding any requirement in Clauses 4 to 10 is not acceptable when conformity is claimed.
- SmartSuite IT Service Management runs the Clause 8 service processes, from service catalog to incident, problem, change, and release management.
Overview
ISO/IEC 20000-1:2018 is the international standard that specifies requirements for a service management system (SMS): how an organization plans, designs, transitions, delivers and improves services so that they meet agreed requirements and deliver value. ISO and IEC published the third edition on September 14, 2018, prepared by ISO/IEC JTC 1/SC 40 (IT service management and IT governance); it replaced the 2011 edition and an amendment on climate action changes followed in 2024.
It applies to any organization that manages and delivers services to internal or external customers, whatever its type, size or the nature of the services (Clause 1.2), including internal IT departments and managed service providers. Excluding any requirement in Clauses 4 to 10 is not acceptable when the organization claims conformity, and an organization cannot show conformity if other parties provide or operate all of the services, service components or processes in the SMS scope.
Organizations implement it by determining the SMS scope (Clause 4.3), setting a service management policy and objectives (Clauses 5.2 and 6.2), planning the SMS in a service management plan (Clause 6.3) and running the service processes in Clause 8, from service catalog and service level management to incident, problem, change and release management. They then evaluate and improve the system through internal audit, management review and service reporting (Clauses 9 and 10). The standard itself calls the system an SMS, not an ITSMS.
Why does it matter?
IT services fail at the handoffs: a change nobody planned for, an incident that cannot be traced to a supplier, a service target nobody owns. ISO/IEC 20000-1 turns those handoffs into requirements that apply across the whole service lifecycle, and it lets an organization, or an auditor on its behalf, show that the system works.
Key benefits include:
- Requirements, not a prescribed method
The 2018 edition removed detail to concentrate on what to do and to leave organizations free to choose how to meet the requirements (Foreword, change c).
- Whole service lifecycle
Clause 8 covers planning, design, build, transition, delivery and assurance of services, with separate requirements for incident, service request, problem, change, release, availability and continuity management.
- Control of suppliers and other parties
Clause 8.2.3 requires control of parties involved in the service lifecycle, and Clause 8.3.4 covers supplier management, including internal and external suppliers.
- Fits other management systems
It follows the high level structure of Annex SL, so an SMS can be integrated with a quality management system based on ISO 9001 or an information security management system based on ISO/IEC 27001 (Introduction).
- Provable by an outside party
An organization can show its own evidence of conformity (Clause 1.2) or be audited by a certification body working to ISO/IEC 20000-6:2017.
How does it work?
The requirements are in Clauses 4 to 10, which follow the high level structure used by all ISO management system standards: context of the organization (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). Clause 3 separates terms specific to management system standards (3.1) from terms specific to service management (3.2), and Clause 2 lists no normative references.
Clause 8 holds the service-specific requirements: service portfolio (8.2, including service catalog management, asset management and configuration management), relationship and agreement (8.3), supply and demand (8.4), service design, build and transition (8.5), resolution and fulfillment (8.6) and service assurance (8.7). The organization decides how to combine these requirements into processes.
Documented information is kept to key items such as the service management plan (Clause 6.3 and 7.5.4). The 2018 edition replaced the documented capacity plan, availability plan and release policy with requirements to plan capacity, document service availability requirements and targets, and define release types and frequency, and it no longer requires a configuration management database, only configuration information (Foreword, change h).
Key Elements
- Context, leadership and policy (Clauses 4 and 5)
Determine external and internal issues and interested parties, define the SMS scope, and have top management establish and communicate the service management policy and assign roles and authorities.
- Planning and the service management plan (Clause 6)
Address risks and opportunities (6.1), set service management objectives and plans to achieve them (6.2) and plan the SMS (6.3).
- Support and knowledge (Clause 7)
Resources, competence, awareness, communication, documented information (7.5) and a requirement on knowledge (7.6) that is new in this edition.
- Service portfolio (Clause 8.2)
Service delivery, planning the services, control of parties involved in the service lifecycle (8.2.3), service catalog management (8.2.4), asset management (8.2.5) and configuration management (8.2.6).
- Relationship and agreement (Clause 8.3)
Business relationship management (8.3.2), service level management (8.3.3) and supplier management (8.3.4).
- Supply, demand, design and transition (Clauses 8.4 and 8.5)
Budgeting and accounting for services, demand and capacity management (8.4), change management (8.5.1), service design and transition (8.5.2) and release and deployment management (8.5.3).
- Resolution, fulfillment and assurance (Clauses 8.6 and 8.7)
Incident, service request and problem management (8.6), then service availability, service continuity and information security management (8.7).
- Evaluation and improvement (Clauses 9 and 10)
Monitoring and measurement, internal audit, management review and service reporting (9.1 to 9.4), then nonconformity and corrective action and continual improvement (10.1 and 10.2).
What does it cover?
ISO/IEC 20000-1 applies to the SMS and the services in its scope, which the organization defines (Clause 4.3). It can be used by customers who want assurance about service quality, by organizations that want to demonstrate or improve their capability, by conformity assessors and by training or advice providers (Clause 1.1). Its scope excludes the specification of products or tools, although it can help develop or buy tools that support an SMS (Clause 1.2).
What are its objectives?
The standard sets out requirements for an organization to establish, implement, maintain and continually improve an SMS. The aims it states are:
To plan, design, transition, deliver and improve services that meet service requirements and deliver value (Clause 1.1).
To give customers assurance about the quality of services and a consistent approach to the service lifecycle across their providers, including those in a supply chain (Clause 1.1).
To let the organization monitor, measure and review its SMS and the services (Clause 1.1).
To keep the organization accountable and in control when other parties perform part of the work (Clause 1.2 and 8.2.3).
Framework in Context
The standard is intentionally independent of specific guidance: an organization can combine generally accepted frameworks and its own experience (Introduction). ISO/IEC 20000-2 gives guidance on applying an SMS, ISO/IEC 20000-3 covers scope definition and applicability, ISO/IEC 20000-10 holds concepts and vocabulary, and ISO/IEC 20000-6 sets requirements for certification bodies. ISO/IEC 20000-7 and ISO/IEC 27013 give guidance on integrating it with ISO 9001 and ISO/IEC 27001.
Common Framework Mappings
ISO/IEC 20000-1 is commonly mapped to the frameworks it shares structure or concepts with, so evidence for service management can be reused in quality, security, privacy and process-guidance programs.
Mapped frameworks include:
COBIT 2019
ISO 9001
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27017
ISO/IEC 27701
ITIL 4
NIST Cybersecurity Framework
How SmartSuite Supports ISO/IEC 20000-1
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use IT Service Management (ITSM), IT Asset Management (ITAM), Third Party Risk Management and Internal Audit Management to run the service processes in Clause 8, hold supplier and asset information, and keep the audit, review and reporting records that Clauses 9 and 10 call for.
Policy, Scope and Service Management Plan
Record the SMS scope, the service management policy, the objectives and the service management plan with owners and review dates (Clauses 4.3, 5.2, 6.2 and 6.3).
Requests, Incidents and Problems
Use IT Service Management (ITSM) to manage requests, incidents and changes, and keep problem records linked to the incidents they explain (Clauses 8.6.1 to 8.6.3).
Assets, Configuration and Change
Use IT Asset Management (ITAM) to track asset inventory, ownership, lifecycle and cost as the asset and configuration information in Clauses 8.2.5 and 8.2.6, and ITSM for change records (Clause 8.5.1).
Suppliers and Service Levels
Use Third Party Risk Management to assess and monitor external suppliers, and record internal suppliers, agreed service targets and review results (Clauses 8.2.3, 8.3.3 and 8.3.4).
Internal Audit and Management Review
Use Internal Audit Management to plan, run and report on SMS audits and remediation, and keep management review inputs and results (Clauses 9.2, 9.3 and 10.1).
Service Reporting and Improvement
Report on service performance with Enterprise Reporting and track improvement opportunities to completion with owners (Clauses 9.4 and 10.2).
Related frameworks
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27017:2026 gives cloud security control guidance for customers and providers, built on ISO/IEC 27002:2022, with four cloud-specific controls; it replaced the 2015 edition.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For ISO/IEC 20000 (IT Service Management System)
It requires an organization to establish, implement, maintain and continually improve a service management system covering the planning, design, transition, delivery and improvement of services (Clause 1.1). The requirements are in Clauses 4 to 10, with the service processes in Clause 8, and none of them can be excluded when claiming conformity (Clause 1.2).
It is voluntary, but an organization can be certified by a body that audits against it under ISO/IEC 20000-6:2017, or can show its own evidence of conformity (Clause 1.2). An organization cannot show conformity if other parties provide or operate all services, service components or processes within the SMS scope.
The third edition of September 14, 2018 is current; ISO confirmed it in 2023 and added Amendment 1 on climate action changes in 2024. Compared with the 2011 edition it adopted the Annex SL structure, replaced the term service provider with organization, removed the Plan-Do-Check-Act references, reduced required documents, and added requirements on knowledge and on planning the services.
No. The standard is intentionally independent of specific guidance, and the organization can combine generally accepted frameworks and its own experience (Introduction). ISO/IEC 20000-2 gives guidance on applying the requirements, but it is not a requirement.
Service portfolio items such as service catalog, asset and configuration management (8.2); business relationship, service level and supplier management (8.3); budgeting, demand and capacity management (8.4); change, service design and transition, and release management (8.5); incident, service request and problem management (8.6); and service availability, continuity and information security management (8.7).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.