ISO/IEC 20000-1:2018 sets out what an organisation must do to run IT and other services as a managed system: planning, support, delivery processes, performance review and improvement. This list covers the main requirements across clauses 4 to 10.
Free account needed to download. You come straight back to the file.
Who it is for. IT service providers, managed service companies, shared-service centres and internal IT teams that want to be certified, or to show customers that their services are run to a recognised standard.
What this list covers. ISO/IEC 20000-1:2018 clauses 4 to 10, the main service management system requirements: 35 requirements. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it asks for |
|---|---|---|
| 4.1 | Understanding the organization and its context | Identify the internal and external issues that affect your ability to deliver services as agreed. |
| 4.2 | Understanding the needs and expectations of interested parties | Identify who has an interest in your services and what they require, including legal and contract requirements. |
| 4.3 | Determining the scope of the service management system | Define which services and parts of the organisation the system covers, and write the scope down. |
| 5.2 | Policy | Have top management set and communicate a service management policy that includes a commitment to meet requirements and improve. |
| 5.3 | Organizational roles, responsibilities and authorities | Assign and communicate who is responsible for the system and for each service. |
| Ref | Control | What it asks for |
|---|---|---|
| 6.1 | Actions to address risks and opportunities | Identify risks and opportunities to the system and plan how to handle them. |
| 6.2 | Service management objectives and planning to achieve them | Set measurable objectives and plan who does what, with which resources, by when. |
| 6.3 | Plan the SMS | Keep a documented plan for the system, covering its scope, responsibilities and how services are managed. |
| 7.4 | Communication | Decide what to communicate about services, to whom, when and how. |
| 7.5 | Documented information | Create, control and keep the documents and records the system needs, including for audit. |
| Ref | Control | What it asks for |
|---|---|---|
| 8.1 | Operational planning and control | Plan and control the processes that deliver services, and manage changes to that plan. |
| 8.2.4 | Service catalogue management | Keep a catalogue describing each live service, so customers and staff know what is offered. |
| 8.2.5 | Asset management | Keep track of the assets used to deliver services, including licences, and manage them through their life. |
| 8.2.6 | Configuration management | Record the configuration items that make up each service and how they relate, and keep the records accurate. |
| Ref | Control | What it asks for |
|---|---|---|
| 8.3.2 | Business relationship management | Maintain relationships with customers and interested parties, and handle feedback and complaints. |
| 8.3.3 | Service level management | Agree service levels with customers, monitor performance against them and report. |
| 8.3.4 | Supplier management | Manage suppliers and internal groups that contribute to your services, with agreed responsibilities. |
| Ref | Control | What it asks for |
|---|---|---|
| 8.4.1 | Budgeting and accounting for services | Budget and account for the cost of services so decisions rest on real figures. |
| 8.4.2 | Demand management | Understand and forecast demand for services and plan to meet it. |
| 8.4.3 | Capacity management | Plan and monitor capacity so services keep meeting their service levels. |
| Ref | Control | What it asks for |
|---|---|---|
| 8.5.1 | Change management | Control changes through assessment, approval and review, so they do not damage live services. |
| 8.5.2 | Service design and transition | Plan and carry out new or changed services, with agreed requirements and acceptance. |
| 8.5.3 | Release and deployment management | Plan, test and roll out releases into the live environment in a controlled way. |
| Ref | Control | What it asks for |
|---|---|---|
| 8.6.1 | Incident management | Log, classify, prioritise, resolve and close incidents, and escalate major ones. |
| 8.6.2 | Service request management | Handle requests for standard services through a defined, tracked process. |
| 8.6.3 | Problem management | Find and remove the underlying causes of incidents, and record known errors. |
| Ref | Control | What it asks for |
|---|---|---|
| 8.7.1 | Service availability management | Assess availability risks and requirements, then plan, monitor and improve availability. |
| 8.7.2 | Service continuity management | Plan, test and maintain how services continue or recover after a disruption. |
| 8.7.3 | Information security management | Run information security controls for services, including handling security incidents. |
| Ref | Control | What it asks for |
|---|---|---|
| 9.1 | Monitoring, measurement, analysis and evaluation | Decide what to measure, measure it and analyse the results to judge performance. |
| 9.2 | Internal audit | Audit the system at planned intervals and act on the findings. |
| 9.3 | Management review | Have top management review the system regularly and record decisions. |
| 9.4 | Service reporting | Produce reports on service performance for the people who need them. |
| Ref | Control | What it asks for |
|---|---|---|
| 10.1 | Nonconformity and corrective action | Correct nonconformities, find the cause and check the fix worked. |
| 10.2 | Continual improvement | Keep improving the suitability and effectiveness of the system and the services. |
ISO 20000 is about running services well: incidents, changes, releases, service levels. ISO 27001 is about information security. Many organisations hold both and share documents, because the clauses have the same structure.
ISO/IEC 20000-1:2018. It replaced the 2011 edition and follows the same high-level structure as other ISO management system standards.
No. It lists the main requirements by clause, in our own words. The standard has more detail, and you should buy it for the exact text.
No. ITIL is a body of good practice that many organisations use to meet the standard, but ISO 20000 does not require it.