Key Facts
- Regulator
- ISO/IEC JTC 1/SC 40 (IT service management and IT governance), published by ISO and IEC
- Latest version
- ISO/IEC 20000-1:2018 (Edition 3), with Amendment 1:2024 (Climate action changes); no revision under way is shown
- Effective
- 14 September 2018
- Official text
- www.iso.org ↗
What is ISO/IEC 20000?
ISO 20000 is the international standard family for IT service management. Its certifiable part, ISO/IEC 20000-1, sets requirements for a service management system (SMS) that an organisation sets up, runs, maintains and keeps improving. ISO and IEC publish it through JTC 1/SC 40, and it applies to any organisation that manages and delivers services to internal or external customers.
The current version is ISO/IEC 20000-1:2018, Edition 3, published on 14 September 2018, with Amendment 1:2024 covering climate action changes. ISO reviewed the 2018 edition and confirmed it on 4 December 2023. No revision is under way. Its full title is Information technology — Service management — Part 1: Service management system requirements.
ITIL, the framework people often compare with ISO 20000, is a separate framework and not part of the ISO/IEC 20000 series. An organisation can run ITIL practices inside its service management system, but certification is always to ISO/IEC 20000-1.
Why it matters
The tender asks whether your service desk runs to a recognised standard. Your team is capable and your tooling is sound, but you have nothing independent to show.
ISO 20000 certification is one answer. ISO describes who uses the standard:
- Customers seeking assurance about the quality of the services they buy, including across a supply chain.
- Organisations demonstrating their own capability.
- Conformity assessors and training or advice providers, who use it as the reference for their work.
A third-party audit against ISO/IEC 20000-1 can lead to certification. That certificate is evidence a buyer can check without taking your word for it.
A ticketing tool isn't a service management system.
The SMS is the management system around the tools: the policy, roles, processes and reviews that make good service repeatable, not dependent on whoever is on shift.
Who it applies to
ISO/IEC 20000-1 applies to organisations that plan, design, transition, deliver and improve services: managed service providers, SaaS firms, outsourcers and internal IT departments. The organisation in scope can be part of a larger organisation, such as a department of a large corporation. A firm that only buys services has little to certify, but it may ask its suppliers for the evidence.
Obligation. ISO/IEC 20000-1 is voluntary: it is a published international standard, not legislation. It becomes contractual when a customer, tender or contract asks for it.
ISO 27001 sets requirements for an information security management system; ISO/IEC 20000-1 sets them for a service management system. Both use the Harmonized Structure, so they can sit in one combined management system. ISO/IEC 27013 gives guidance on running the two together. For the security side, see the ISO 27001 vault.
The UK position
No UK law or regulator requires ISO/IEC 20000-1, and we found no EU regime that does. A UK firm meets it commercially: a customer or tender asks for evidence of service management capability, and a certificate from a third-party audit is the way to give it. Outside tenders and customer contracts, UK firms rarely meet it.
Key requirements
ISO/IEC 20000-1 is a Type A management system standard: it holds requirements an organisation can claim to meet. It follows the Harmonized Structure, so it shares its layout and many terms with other ISO management system standards. Its requirements cover the life of a service, so that the service meets what was agreed and delivers value:
- Planning. Deciding which services the SMS covers and what it must achieve.
- Design. Shaping a new or changed service before it goes live.
- Transition. Moving that service into the live environment under control.
- Delivery. Running the service day to day and meeting what was agreed with the customer.
- Improvement. Reviewing results and acting on them, continually.
In practice, a service management system puts incident, problem and change management under one set of rules, owners and reviews. Around them sit internal audits, customer satisfaction, and staff competence and awareness. The system has to be maintained, not built once.
Only Part 1 can be audited. The rest is guidance.
The rest of the ISO/IEC 20000 series
The other parts help you apply Part 1. ISO lists them as Type B (guidance) standards, which hold recommendations rather than requirements:
- Part 2 (ISO/IEC 20000-2:2019, amended 2020): guidance on applying a service management system.
- Part 5 (ISO/IEC TS 20000-5:2022): implementation guidance for ISO/IEC 20000-1, published as a Technical Specification.
- Part 16 (ISO/IEC TS 20000-16:2025): guidance on sustainability within a service management system.
Part 1 itself carries one amendment, Amendment 1:2024 (Climate action changes), published in February 2024.
Frequently asked questions
ISO 20000-1:2018 certification is a certificate issued after a third-party audit finds that an organisation's service management system meets the requirements of ISO/IEC 20000-1:2018. The certificate covers the services and the part of the organisation in the scope of the SMS, not necessarily the whole company. Internal audits are first-party and cannot lead to certification on their own.
ISO/IEC 20000-1 asks whether services are planned, delivered and improved to meet agreed requirements. ISO 27001 asks whether information security risks are managed. An ISO 27001 certificate says nothing about service levels, and an ISO/IEC 20000-1 certificate is not evidence of security risk management, so holding one doesn't mean you meet the other.
No. ISO has withdrawn ISO/IEC 20000-1:2011, and ISO/IEC 20000-1:2018 (Edition 3) replaced it. The 2018 edition is current, with Amendment 1:2024, and ISO confirmed it on 4 December 2023 after systematic review. Cite ISO/IEC 20000-1:2018 with its amendment in tenders and policies until ISO publishes a new edition.
No. ISO/IEC 20000-2:2019 is a Type B standard: it gives guidance on applying a service management system and holds no requirements. ISO states that certification can only take place against a document that contains requirements, so Type B standards cannot be certified against. Organisations use Part 2 to interpret ISO/IEC 20000-1, and the audit is always against Part 1.
No. ISO/IEC 20000-1 sets requirements for an organisation's service management system, so the certificate goes to the organisation, or the part of it in scope, after a third-party audit. ISO lists providers of training or advice in service management among the standard's users, but a course or personal qualification in ISO/IEC 20000 is not certification to the standard.