What is ISO 20000?

IBM® Infrastructure as a Service (IaaS) and IBM Platform as a Service (PaaS) offerings have a service management process in place that is ISO 20000-1:2018 compliant.

IBM ISO 20000 certificates are published and generally available. The following services are ISO 20000 certified. Services below issue ISO certificates at least once each year.

ISO 20000-1 (ISO/IEC 20000-1:2018) is the primary standard, providing the methodology for developing, implementing, maintaining and continually improving their service management system. (ISO 20000 and ISO 20000-1 are sometimes used interchangeably.) ISO 20000-1 includes requirements and specifications applicable to the entire IT service lifecycle. Among other things, it provides guidance on:

• Gauging the SMS needs within the context of the organization
• Establishing a leadership structure for the development, maintenance and evolution of an SMS
• Planning and preparing for SMS development and improvement, including determining organizational objectives and risks and opportunities
• Supporting the SMS once it is built
• Operating, controlling and servicing the SMS
• Evaluating the performance of an SMS, including monitoring and internal audits
• Improving an SMS, including corrective actions and enhancements

Organizations that implement ISO 20000 for their SMS can decide to undergo a certification process to verify that their service management system requirements meet the international standard.

Various certification bodies can audit organizations seeking to conform with ISO 20000. The certification process usually requires organizations to keep detailed documentation of their service management system requirements and processes and how they adhere to the standard.

ISO 20000 certification might be required for other important certifications or credentials. For example, cloud service providers seeking empanelment with India’s Ministry of Electronics and Information Technology (MietY) must demonstrate and maintain compliance with ISO 20000 and other security standards.

A 2022 ISO survey showed that ISO 20000 certification is the eighth most popular ISO standard certification worldwide based on number of certified organizations. Many organizations pursue ISO 20000 certification to reassure customers of their ITSM best practices.

However, the ISO has been clear that third-party certification is not the only reason to conform to the standard, and that organizations can realize the benefits of ISO 20000’s framework and guidance for SMS implementation, evaluation and continuous improvement with or without certification.

Again, ITSM is the practice of delivering IT services that enable an organization to meet the needs of its users (both employees and customers) and achieve its business goals. Organizations have used the ISO 20000 to address various ITSM issues including, but not limited to:

• Business relationship management
• Change management
• Service level management
• Capacity management
• Availability management
• Problem management
• Incident management
• Demand management
• Supply chain management

ISO 20000 and ITIL are similar in that they are the leading sources of best practices for IT service management systems. Both the international standard and ITIL cover the lifecycle of an SMS. They are often used together in the planning, implementation, maintenance and continual improvement of such systems.

While ISO 20000 provides a generic methodology for ITSM best practices, ITIL details the specific practices that should be used to achieve the objectives outlined in the ISO 20000 methodology. And while ISO 20000 was developed with the ITIL framework in mind, it can also be used with other IT service management frameworks, such as COBIT framework or the Microsoft Operations Framework.

ISO 20000 is an international standard written to apply to organizations of all sizes in all geographies, regardless of the nature of the services being delivered. Because of that, organizations and businesses from across all industries have used ISO 20000 as their benchmark for developing SMS. Users and use cases include:

• Organizations that want to demonstrate their ability to design, maintain and improve their provision of services
• Organizations looking to audit and review the performance of their SMS
• Customers looking for quality assurance of an organization’s SMS
• Customers looking for a consistent approach to IT service management by all its providers, including as part of a supply chain
• SMS consultants and advisors
• Organizations performing conformity assessments against ISO 20000

ISO 20000 was designed with other international standards in mind because of the need for integration with quality and security management systems. Standards that relate to ISO 20000 include: