1. Introduction
The Organisation is [a short description: what it does, who it serves, how long it has operated, how many people it employs and in which locations]. It provides [the main service lines, for example managed infrastructure, application support, platform hosting, or customer support] to [the main customer groups, for example enterprise customers, public bodies or consumers]. Services are delivered from [locations] using [a mix of own and supplier-run infrastructure].
This statement records the situation in which the service management system (SMS) operates: the outside and inside matters that affect its results, the people and bodies whose requirements it must meet, and the boundary of the SMS. It is the starting point for the risk and opportunity register, the SMS Objectives and the SMS Scope and Service Management Plan, and it is read with the Internal and External Issues and Interested Parties statement of the information security library, which covers the same ground from an information security point of view.
- The statement is reviewed at least every [6 months], at each management review, and after a significant change in strategy, ownership, law, technology or customer base.
- Each issue and each interested party has a named owner who keeps the entry current.
- Changes are approved by the management representative and recorded in the document history.
1.1 Customers and services served
The table gives a profile of the customer groups and the services they use. The Organisation completes it from its customer and contract records and uses it to judge which requirements dominate the SMS.
| Customer group | Services used | Typical contract | Dominant requirements |
|---|---|---|---|
| [Large enterprise customers] | [Managed hosting, application support] | [Multi-year contract with SLA and credits] | [High availability, audit rights, named service manager] |
| [Public bodies] | [Platform hosting, service desk] | [Framework contract with reporting duties] | [Data location, formal reporting, security evidence] |
| [Small and medium customers] | [Standard support plans] | [Annual subscription with standard terms] | [Fast response, low cost, simple self-service] |
| [Internal business units] | [Shared platforms] | [Operational level agreement] | [Stable platform, clear charging] |
A customer group that represents more than [20 percent] of revenue or that holds contractual audit rights is given a named service owner and a review meeting at least [quarterly].
1.2 How this statement is maintained
| Step | Action | Who | When |
|---|---|---|---|
| Gather | Collect inputs: customer reviews, audit findings, incident trends, supplier notices, legal updates, market news, staff feedback | Management representative | [Quarterly] |
| Workshop | Top management, service owners and process owners test the issue lists for gaps and decide effect and response | Management representative | [Every 6 months] |
| Record | Update the tables in this statement; link risks to the risk register and opportunities to the improvement log | Management representative | [Within 10 working days of the workshop] |
| Approve | Top management approves at the management review | Top management | [Every 6 months] |
| Communicate | Process owners and service owners are told of changes that affect them | Management representative | [Within 5 working days of approval] |
2. Purpose of Service Management
Service management exists in the Organisation so that the people who rely on its services can rely on them without having to think about how they work. It gives the Organisation a common way to agree what a service must do, to build and change it safely, to run it at a known quality, to put right what goes wrong, to prove the results, and to get better. It turns the Organisation's capability, which is held in people, tools and suppliers, into service that customers can plan around.
- For customers: services that match agreed requirements, with known targets, honest reporting and a clear route to raise problems.
- For the Organisation: predictable costs, fewer repeat failures, evidence that contractual and legal obligations are met, and a record that supports tenders and customer audits.
- For staff: clear roles, usable procedures, tools that help, and a way to see that their work is valued and improves outcomes.
- For suppliers: clear expectations, a single point of contact and fair measurement.
| Question | Answer for the Organisation |
|---|---|
| Why does the Organisation provide services? | [To meet the commercial strategy: for example to deliver contracted managed services and recurring revenue] |
| What value must customers see? | [Reliability, speed of response, transparency, security, and value for cost] |
| What happens if service management fails? | [Loss of customers, contract penalties, reputational harm, regulatory attention, staff burnout] |
| Which standard is the SMS built on? | ISO/IEC 20000-1:2018, applied as a framework; this does not assert certification |
3. Intended Outcomes
The SMS is intended to achieve the outcomes below. They are the basis for the objectives in SMS Objectives and for the criteria top management uses at each management review.
| Ref | Intended outcome | Evidence that it is achieved | Linked objectives |
|---|---|---|---|
| IO1 | Services meet documented customer requirements and agreed service levels | SLA reports; customer survey | O1 to O6 |
| IO2 | Service interruptions are rare, short and handled consistently | Incident and availability reports | O3, O7 to O12 |
| IO3 | Changes to services are planned, approved, tested and reversible | Change and release records | O13 to O16 |
| IO4 | The Organisation knows what it runs and what it depends on | Configuration and supplier records | O17 to O22 |
| IO5 | Capacity, continuity and information security protect service delivery | Capacity plans; test reports; security records | O19 to O27 |
| IO6 | Legal, regulatory and contractual obligations are known and met | Obligations register; audit reports | O30, O31 |
| IO7 | People are competent, informed and able to improve how services work | Training records; improvement log | O28, O29, O32 |
| IO8 | Costs of services are known and managed | Cost reports by service | O23 |
Each outcome has a responsible service owner or process owner. Where an outcome is not being achieved, the cause is recorded in the management review and linked to a corrective or improvement action.
4. External Issues
External issues are matters outside the Organisation's control that affect its ability to achieve the intended outcomes. The register below shows each issue, the effect on services, the response, and the owner. Entries that name a statute must be confirmed with [the legal adviser] before the Organisation relies on them.
4.1 Legal, regulatory and contractual issues
| Ref | Issue | Effect on services | Response | Owner |
|---|---|---|---|---|
| E1 | The Digital Personal Data Protection Act, 2023 and its Rules govern personal data that services process on behalf of customers or for the Organisation's own purposes [confirm the current requirement]. | Service design, support access, logging and deletion must respect purpose, consent where relied on, and customer instructions | Data protection requirements built into service design, access control and support procedures; privacy review in transition | Data protection lead |
| E2 | The Information Technology Act, 2000 and rules made under it apply to the handling of electronic records and to security practices [confirm the current requirement]. | Security practices and incident reporting influence service operations and evidence | Security controls and records kept under the information security library | Information security lead |
| E3 | The CERT-In Directions of 28 April 2022 require cyber incidents to be reported within 6 hours of noticing, and ICT logs to be kept for 180 days within Indian jurisdiction [confirm the current requirement]. | Incident process must be able to recognise and report reportable incidents, and logging must meet the retention rule | Reporting step in the major and security incident process; log retention in monitoring settings | Incident manager |
| E4 | Applicable law in each jurisdiction where the Organisation operates (such as the EU General Data Protection Regulation) applies where services touch customers or data subjects there. | Contract terms, transfers and support location may be restricted | Legal review of contracts and support model before entering a market | Legal adviser |
| E5 | Customer contract terms and sector rules (for example requirements to report, to audit, to locate data, or to provide exit support). | SLA content, reporting, audit rights, and continuity plans | Obligations register; review at each contract renewal | Service owners |
| E6 | Tax, labour and commercial law in the places where staff and customers are located. | Staffing models, working hours, support coverage and charging | Reviewed by [the legal adviser and finance] annually | Finance lead |
The Organisation does not give legal advice in this statement. Entries are prompts to confirm the current requirement, not a summary of law.
4.2 Market, technology and environment issues
| Ref | Issue | Effect on services | Response | Owner |
|---|---|---|---|---|
| E7 | Customer expectations of near-continuous availability and fast response | Pressure on hours of service, targets and staffing | Targets set from agreed requirements; demand and capacity forecasts; clear hours in the catalogue | Service owners |
| E8 | Competition and pricing pressure in the market for [the Organisation's services] | Pressure to reduce cost; risk of cutting controls | Service costing; value reviews with customers; automation | Top management |
| E9 | Rapid change in technology (cloud platforms, automation, artificial intelligence tools) | New opportunities and new risks; skills gaps | Technology watch; design review; training; controlled adoption through change | Technology lead |
| E10 | Cyber threats such as ransomware, credential theft and supply chain compromise | Risk of service loss, data loss and customer harm | Security controls; incident readiness; continuity tests; threat intelligence | Information security lead |
| E11 | Concentration of the supplier market and dependence on a few cloud or tool providers | Single points of failure and price changes | Supplier tiers; exit plans; multi-region design | Supplier manager |
| E12 | Skills market and cost of staff in the locations where the Organisation hires | Hard to hire and retain; knowledge loss | Career paths; knowledge base; cross-training; retention measures | Human Resources lead |
| E13 | Natural events, power and connectivity failures, public health events and civil disruption | Loss of sites, staff or network | Continuity plans; alternate sites and remote working; tests | Continuity manager |
| E14 | Expectations of customers and certification bodies for evidence of good practice (audits, questionnaires, certifications) | Time demands; need for reliable records | Records design; audit calendar; one source of evidence | Management representative |
5. Internal Issues
Internal issues are matters inside the Organisation that help or hinder the SMS. They are assessed with the same columns as external issues. The entries below are examples; the Organisation replaces them with its own findings from the workshop in section 1.1.
5.1 Strategy, structure and governance
| Ref | Issue | Effect on services | Response | Owner |
|---|---|---|---|---|
| I1 | Business strategy and growth plan: [for example expanding into new markets or adding service lines] | Higher demand, new service types and new obligations | Demand forecasts; service design reviews; budget cycle | Top management |
| I2 | Organisation structure: [for example separate engineering, operations and customer teams with shared services] | Hand-off delays and unclear ownership | RACI in each procedure; operational level agreements between teams | Management representative |
| I3 | Governance and decision rights for services, change and exceptions | Slow or inconsistent decisions | Delegation of authority table; defined change authority | Top management |
| I4 | Culture and attitude to process: [for example strong customer commitment, preference for informal fixes] | Risk that records are incomplete and controls bypassed | Awareness; leadership example; sampling of tickets | Top management |
| I5 | Budget and funding of improvements | Limits how fast gaps are closed | Annual plan; improvement log prioritisation | Finance lead |
The management representative confirms each entry with the person named as owner at the workshop.
5.2 People, process and technology
| Ref | Issue | Effect on services | Response | Owner |
|---|---|---|---|---|
| I6 | Size, skills and availability of the service desk and resolver teams, and the volume of work they handle | Backlogs; slow response; burnout | Capacity plan for staff; training; rotation; automation of routine requests | Process managers |
| I7 | Staff turnover and knowledge held by individuals | Loss of know-how; slow handover | Knowledge base; deputies; cross-training | Human Resources lead |
| I8 | Maturity of processes such as change, problem, configuration and supplier management | Inconsistent practice; weak evidence | Process maturity review; internal audit; improvement plan | Process owners |
| I9 | Quality and coverage of the configuration records and the service catalogue | Poor impact assessment; missed dependencies | Verification sampling; catalogue review | Configuration manager |
| I10 | Age and complexity of platforms and tools, including legacy systems | Fragile services; hard to patch | Technical debt register; retirement plans; refresh budget | Technology lead |
| I11 | Tooling for ticketing, monitoring and automation, and the degree they are integrated | Manual work; data gaps | Tool roadmap; integration through change | Process owners |
| I12 | Remote and hybrid working and use of personal or shared devices | Support, security and continuity effects | Teleworking rules; device management; secure access | Information security lead |
| I13 | Dependencies on suppliers and internal shared services for parts of delivery | Targets that depend on others | Underpinning contracts; operational level agreements; supplier reviews | Supplier manager |
| I14 | Locations, facilities and infrastructure from which services are delivered | Physical and continuity risks | Facility controls; alternate site plan | Facilities lead |
| I15 | Existing management systems and frameworks (for example information security, quality) and obligations under them | Overlap, duplication or conflict between systems | One integrated document set; shared audit programme | Management representative |
6. From Issues to Risks and Opportunities
An issue matters only if it changes what the Organisation does. The management representative tests each issue with two questions: could it stop an intended outcome (a risk), and could it help one (an opportunity)? The answers are recorded in the risk register under the Risk Management Policy, or in the improvement log, with an owner and a date.
| Issue | Risk it creates | Opportunity it offers | Recorded in |
|---|---|---|---|
| E3 CERT-In reporting duty [confirm the current requirement] | A reportable incident is not recognised or not reported in time | A well-practised major incident process that also supports customers | Risk register; improvement log |
| E10 Cyber threats | Service loss or data loss from an attack on shared platforms | Customers value evidence of resilience; tested recovery becomes a selling point | Risk register; objectives O24 to O26 |
| E11 Supplier concentration | Failure or price rise at one provider stops several services | Negotiate better terms by consolidating, or design for portability | Risk register; supplier plan |
| I7 Staff turnover | Know-how leaves with people | Better documentation lowers training cost and speeds onboarding | Risk register; knowledge plan |
| I11 Tooling integration | Manual hand-offs cause errors and delay | Automation of routine requests lowers cost per ticket | Improvement log |
- RateThe owner rates likelihood and impact using the scale in the Risk Management Policy.
- DecideThe owner chooses a response: accept, reduce, transfer, avoid, or exploit an opportunity.
- PlanActions with owners and dates go into the risk register or the improvement log within [20 working days].
- ReviewThe management representative reports changes in the rating at each management review.
7. Interested Parties and Their Requirements
Interested parties are the people and bodies that can affect the SMS or are affected by it. The Organisation identifies their needs and expectations and decides which become requirements it must meet. The table gives the party, what it needs, how the Organisation responds, and the owner.
| Interested party | Needs and expectations | How the SMS responds | Owner |
|---|---|---|---|
| Customers | Services that meet agreed requirements; clear targets; prompt response; honest reporting; value for money; protection of their data; exit support | Catalogue; SLAs; service reviews; Service Operating Model; Information Security Management for Services | Service owners |
| Users of services | Easy ways to ask for help and to get access; quick fixes; plain updates | Service desk; self-service portal; Communication Procedure | Service desk lead |
| Top management and owners | Value from services; control of cost and risk; evidence of compliance; no surprises | Objectives; reports; management review | Management representative |
| Employees and contractors | Clear roles; usable procedures; training; fair workload; safe working | Procedures; competence plans; capacity planning; HR Security Policy | Human Resources lead |
| Suppliers and partners | Clear scope; fair terms; timely payment; one point of contact | Supplier Management Procedure; contract management | Supplier manager |
| Regulators and authorities | Compliance with applicable law and directions; timely reporting; co-operation | Obligations register; incident reporting steps [confirm the current requirement] | Legal adviser |
| Auditors and certification bodies | Documented, current, implemented processes; reliable records; competent staff | Internal Audit and Management Review Procedure; records | Management representative |
| Insurers and financiers | Evidence of controls; incident history; continuity arrangements | Risk register; continuity test reports | Finance lead |
| Customers of customers and data subjects | Respect for their personal data; reliable services; ways to complain | Data protection controls; complaints route through customers | Data protection lead |
| Industry bodies and the public | Responsible conduct; contribution to good practice | Participation as decided by top management | Top management |
| Internal shared services (finance, legal, facilities, IT) | Early notice of needs; clear requests; agreed targets | Operational level agreements; Business Relationship Management Procedure | Process owners |
7.1 Communication with interested parties
| Party | Channel | Frequency | Owner |
|---|---|---|---|
| Customers | Service review meeting, service report, status page | [Monthly or quarterly by tier] | Service owners |
| Users | Portal notices, email, service desk | [As events occur] | Service desk lead |
| Employees | Intranet, team briefings, all-hands | [Monthly] | Management representative |
| Suppliers | Supplier review, account contact | [By tier] | Supplier manager |
| Regulators | Formal notices and filings | [As required] | Legal adviser |
| Auditors | Audit meetings and records | [Per audit] | Management representative |
Detail of what, when and how is set in the Communication Procedure. Feedback from each party is logged and used at the next update of this statement.
7.2 Requirements that become obligations
A need or expectation becomes an obligation when it is set out in law, in a contract, in a customer's written requirement, or in a commitment top management has made. The Organisation records each obligation with its source, the service it affects, the owner, the evidence of compliance, and the date of next review.
| Source | Obligation | Affected service or process | Owner | Evidence | Next review |
|---|---|---|---|---|---|
| [Contract reference] | [For example, report availability monthly] | [Service name] | [Service owner] | [Report] | [dd-mm-yyyy] |
| [Law or direction, confirmed] | [For example, report a reportable incident within 6 hours of noticing] | Incident management | [Incident manager] | [Incident record with timestamps] | [dd-mm-yyyy] |
8. Scope of the Service Management System
The scope below states the boundary of the SMS. It is the summary; the controlled scope statement, the services in scope and the exclusions are held in the SMS Scope and Service Management Plan, which prevails if they differ.
| Element | Statement |
|---|---|
| Standard | ISO/IEC 20000-1:2018 clauses 4 to 10, applied as the Organisation's framework |
| Services in scope | [The services of the Organisation that are listed in the catalogue as live and offered to customers, for example managed hosting, application support and service desk] |
| Locations | [Registered office, delivery centres, data centres and cloud regions used to deliver in-scope services] |
| Organisational units | [Operations, engineering, service desk, customer success, finance, human resources and other units that carry out SMS processes] |
| Processes | All processes in the Service Management System Manual, including those partly carried out by [named suppliers] under contract |
| Exclusions | [Services, units or sites not covered, with the reason and date of the next review] |
| Interfaces | [Other parties that perform part of the service lifecycle, with the control applied; see the Service Management System Manual] |
| Statement date and approver | [dd-mm-yyyy]; [Top management] |
Exclusions must not affect the Organisation's ability to meet customer or legal requirements. If a service that is in the catalogue and offered to customers is excluded, the reason is approved by top management and shown to customers on request.
9. Records and Evidence
- Issue register and interested party register with owners and review dates [5 years after supersession].
- Workshop agendas and minutes [5 years].
- Obligations register [for the life of the obligation plus 3 years].
- Management review minutes recording decisions on context [5 years].
Records are controlled under the Documents and Records Management Procedure.
Annexure A: Issue assessment form
| Field | Entry |
|---|---|
| Issue reference | |
| Category (external or internal) | |
| Description | |
| Effect on services or on SMS outcomes | |
| Likelihood and impact rating | |
| Response (accept, treat, monitor, exploit) | |
| Owner | |
| Linked risk or opportunity reference | |
| Date identified and next review |
Annexure B: Interested party entry form
| Field | Entry |
|---|---|
| Party | |
| Type (customer, user, supplier, regulator, employee, other) | |
| Needs and expectations | |
| Becomes an obligation? (yes or no, with source) | |
| How the SMS responds | |
| Owner on the Organisation's side | |
| Communication method and frequency | |
| Next review |
Annexure C: Document history
| Version | Date | Author | Approved by | Summary of change |
|---|---|---|---|---|
| 1.0 | [dd-mm-yyyy] | [Management representative] | [Top management] | First issue |
10. Exception
Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.
11. Enforcement
Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.
12. Review
This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.
ISO/IEC 20000-1:2018 references
| Reference | Title |
|---|---|
| 4.1 | Understanding the organization and its context |
| 4.2 | Understanding the needs and expectations of interested parties |
| 4.3 | Determining the scope of the service management system |
| 6.1 | Actions to address risks and opportunities |