ISO/IEC 20000-1 Certification for IT Service Management Systems

ISO/IEC 20000-1 is the international standard for IT service management systems, and itmad audits IT service management systems for organisations in all industries. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 20000-1 in brief

The standard specifies an IT service management system: defining which services an organisation delivers, agreeing the level of service it commits to, running the processes that sustain the service, and showing improvement over time. A certificate is independent confirmation that the service is managed and not merely provided.

Who the standard is for

ISO 20000-1 applies to any organisation that delivers IT services, including:

• Managed service providers and IT outsourcers
• Data centres and hosting providers
• Software and SaaS companies operating a support function
• Internal IT departments serving a large organisation
• Government technology entities and their suppliers
• Telecommunications and network service operators

Why organisations certify

For managed service providers and outsourcers, certification gives a client assurance that service management is systematic and does not depend on individuals. For internal IT functions, the standard is the framework that turns informal practice into something that survives staff turnover. ISO 20000-1 also pairs with ISO 27001 for technology providers: ISO 27001 covers whether the service is secure, and ISO 20000-1 covers whether it is reliably delivered.

What auditors examine

• Service portfolio and catalogueWhich services are delivered, to whom and on what terms, documented rather than assumed and kept current as services change.
• Service level managementAgreed, measurable service levels with defined reporting, with performance judged against the service levels and not against internal convenience.
• Incident and service request managementLogging, prioritisation, escalation and resolution, with evidence that the process is followed under pressure and not bypassed.
• Problem managementFinding the underlying causes of recurring incidents and removing them: a process often documented but less often practised.
• Change managementAssessment, authorisation and controlled release of changes, including emergency changes and the retrospective approval that governs them.
• Configuration managementA configuration database that reflects reality, since change and incident processes depend on knowing what is actually deployed.
• Capacity and availabilityPlanning to meet agreed demand and availability targets, with monitoring that warns before a threshold is breached.
• Service continuityContinuity requirements derived from service commitments, with plans that have been tested and not merely written.
• Supplier managementControl of suppliers and their contribution to the service, including cloud and subcontracted components that the organisation depends on but does not operate.
• Service reporting and improvementReporting against commitments, and a continual improvement process with evidence of changes actually made.

ISO 20000-1 and ITIL

The two are often confused. ITIL is a body of guidance on how service management can be done; ISO/IEC 20000-1 is a standard stating what a management system must contain, and it is the one an organisation can be certified against. Working to ITIL puts an organisation in a good position for certification but does not certify it, and the gap is usually in evidence and not in practice: the processes run, but the records showing that they run are incomplete.

Where ISO 20000-1 audits find gaps

Change management under pressure is the recurring gap: a documented process that is followed for planned work and bypassed for anything urgent, with emergency changes never authorised afterwards. Configuration data that has drifted from reality is the second. The third is service reporting produced for the audit and used by nobody, because a report that nobody reads is not evidence of service management.

Scope of the certificate

The certificate states which services and locations are covered, and a client checks that the service it buys is inside the scope. Scope also has to account for services delivered through suppliers: an organisation remains accountable for components it does not operate, and the standard requires it to show control over them.

How an itmad audit runs

Stage 1 reviews the documented system, confirms the scope and the services covered, and establishes readiness. Stage 2 tests the system in operation: incident and change records, service level performance against commitments, problem investigations and their outcomes, and whether people describe the process that the documentation claims.

The certificate cycle

An ISO 20000-1 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years and recertification before it expires.

Independence

ISO/IEC 17021-1 does not allow a certification body to design, implement or consult on the management system that it certifies, and itmad does not. itmad provides the audit and the certification decision and, if wanted, a pre-assessment that identifies gaps against ISO 20000-1 without telling the organisation how to close them.

What itmad delivers

• Readiness gaps reported after Stage 1, before the main audit begins
• A Stage 2 audit report with every finding backed by objective evidence
• Nonconformities graded by severity, each with a stated response time
• A certificate of registration naming the scope and locations certified
• Use of the certification mark under itmad's mark and seal policy
• Surveillance audits and reports in each year of the three-year cycle

Frequently asked questions

What is ISO/IEC 20000-1?

ISO/IEC 20000-1 specifies requirements for an IT service management system: defining the services delivered, agreeing the service level committed, running the supporting processes and showing improvement over time. A certificate confirms that the service is managed and not merely provided.

What is the difference between ISO 20000-1 and ITIL?

ITIL is a body of guidance describing how service management can be done, while ISO/IEC 20000-1 is a standard stating what a management system must contain. Only the standard is something an organisation can be certified against.

What are the most common ISO 20000-1 audit findings?

Change management under pressure comes first: a process followed for planned work and bypassed for anything urgent. Configuration data that has drifted from reality comes second, and service reporting produced for the audit but used by nobody comes third.

How does ISO 20000-1 relate to ISO 27001?

ISO 27001 covers whether an IT service is secure, and ISO 20000-1 covers whether the service is reliably delivered. The two pair naturally for technology providers.

How does an ISO 20000-1 audit work?

itmad audits in two stages. Stage 1 reviews the documented system and confirms the scope and the services covered. Stage 2 tests incident and change records, service level performance against commitments, and problem investigations and their outcomes.

Does the certificate cover services delivered by suppliers?

The scope has to account for them, because an organisation remains accountable for components it does not operate. The standard requires the organisation to show control over those components.