ISO/IEC 20000-1 Certification

ISO/IEC 20000-1 is the international standard for IT service management systems, helping organisations plan, deliver and improve IT services that meet their customers' real business needs.

What is ISO/IEC 20000-1?

ISO/IEC 20000 (formerly the British standard BS 15000) is the international family of standards for IT service management. Part 1 – ISO/IEC 20000-1:2018 (with Amendment 1:2024 on climate action) – specifies requirements for a Service Management System (SMS) and is the part used for certification.

The standard is compatible with good-practice frameworks such as ITIL, but whereas ITIL is guidance, ISO 20000-1 sets requirements that can be independently audited. It promotes a service culture and provides a controlled method of delivering services that meet genuine business needs and priorities.

Main process groups

The operational clause of ISO/IEC 20000-1:2018 covers the entire service lifecycle through the following process groups:

Service portfolio: service planning, control of parties in the service lifecycle, service catalogue, asset and configuration management
Relationship and agreement: business relationship, service level management (SLAs), supplier management
Supply and demand: budgeting and accounting for services, demand and capacity management
Service design, build and transition: change management, release and deployment
Resolution and fulfilment: incident, service request and problem management
Service assurance: service availability, continuity and information security

In addition, the standard requires the organisation to plan the SMS, set service management objectives, monitor service performance against committed targets and continually improve both the services and the management system itself.

Who is it for?

ISO/IEC 20000-1 suits both external IT service providers and internal IT departments, for example managed service providers, data centres, cloud providers, helpdesk operators, software development and maintenance companies, and banks or groups whose IT department serves many business units.

Because it shares ISO's high-level structure (Annex SL), it can be audited together with ISO/IEC 27001 for information security and ISO 22301 for business continuity. TÜV NORD Vietnam's auditors work objectively and independently, and findings are clearly presented in the audit report.

Benefits for your organisation

More stable services

Standardised incident, change and problem processes can help reduce disruption and speed up service recovery.

Aligned with business needs

IT services are designed, committed and measured against service level agreements with customers.

Cost control

Capacity, budget and supplier management help you use IT resources efficiently.

Credibility in tenders

An international certificate is evidence of service management capability for projects and outsourcing contracts.

How it works

Enquiry, service scope definition and quotation
Contract signing and audit planning
Stage 1 audit: review of SMS documentation and readiness
Stage 2 audit: effectiveness of service management processes
Independent review and certification decision
Issue of the ISO/IEC 20000-1 certificate and regular surveillance audits

Frequently asked questions

How does ISO 20000-1 differ from ITIL?

ITIL is a good-practice framework for IT service management with no certification for organisations. ISO/IEC 20000-1 is an international standard with specific requirements that a third party can audit and certify. Organisations already using ITIL often already have many processes relevant to ISO 20000-1 requirements.

Can an internal IT department be certified to ISO 20000-1?

Yes. The standard applies to any organisation that provides services, including where the customers are departments or subsidiaries within the same group. What matters is clearly defining the scope of services, the customers and the service level agreements that the SMS covers.

Should ISO 20000-1 be combined with ISO 27001?

The two complement each other: ISO 20000-1 focuses on service quality and efficiency, ISO 27001 on information security. Many processes such as asset, change, incident and supplier management can be shared, so a combined audit saves resources and reduces disruption to day-to-day operations.

What must be in place before an ISO 20000-1 certification audit?

Your SMS scope should be defined, a service catalogue and service level agreements established, the operational processes required by the standard implemented, and you should have real operating records, internal audit results and a management review in place before the certification audit. This evidence shows the SMS is working in practice.

Related services

ISO/IEC 27001 CertificationISO 27001:2022 certification for your information security management system (ISMS) to protect the confidentiality, integrity and availability of data.ISO/IEC 27701 CertificationISO 27701:2025 certification for your privacy information management system (PIMS), helping controllers and processors evidence personal data protection.ISO 22301 CertificationISO 22301:2019 certification for your business continuity management system (BCMS), confirming that your ability to continue and recover is managed.TISAX® AssessmentTISAX assessment against the VDA ISA catalogue for automotive suppliers: results are TISAX labels exchanged via the ENX platform at carmakers' request.

Talk to our experts

Contact TÜV NORD Vietnam in Hanoi, Ho Chi Minh City or Vung Tau for detailed information on ISO 20000 and a quotation for your organisation.