Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 20000 — Information Technology Service Management (ITSM) Series
Information technology — Service management (2011/2012 edition series)
🖥️ BS ISO/IEC 20000 is the British Standard series adopted by BSI from the ISO/IEC 20000 international standard, the world’s first international standard for information technology service management (ITSM) and one of the most important certification standards in the field. Developed by ISO/IEC JTC 1, with UK participation through Technical Committee IST/15 (Software and systems engineering) and its subcommittee, ISO/IEC 20000 defines the requirements for an organization to establish, implement, maintain, and continually improve a service management system (SMS). Complementing the ITIL practice framework, it is widely used for certifying IT service providers and for building internal service management capability.
💡 The relationship between ISO/IEC 20000 and ITIL is often confused: ITIL is a “best-practice guide” that tells you how to do things; ISO/IEC 20000 is a “certifiable requirement” that defines what you must have. Using both together is most effective.
1. Series Overview and Positioning 📌
This batch covers three parts of the BS ISO/IEC 20000 series: Part 1: Service management system requirements (2011 edition), Part 2: Guidance on the application of service management systems (2012 edition), and Part 3: Guidance on scope definition and applicability of ISO/IEC 20000-1 (2012 edition). Part 1 is the certifiable normative requirement; Part 2 provides application guidance; Part 3 provides methods for scope definition and applicability determination. Together they form a complete “requirements—guidance—scope” system.
The series supersedes the 2005 editions (BS ISO/IEC 20000-1:2005 and 20000-2:2005 are withdrawn), while Part 3 replaces the former PD ISO/IEC TR 20000-3:2009 technical report, upgrading it to a full international standard.
⚠️ Certification is based on Part 1 (certifiable requirements); Parts 2 and 3 are guidance documents. Organizations seeking certification should use Part 1 as the sole conformance baseline, with the guidance used only to aid understanding and implementation.
2. Series Structure and Part-Level Points 🔧
| Standard Number | Subject | Edition | Core Content |
|---|---|---|---|
| BS ISO/IEC 20000-1:2011 | Service management system requirements | 2nd ed., 2011-04-15 | Defines the normative requirements of the SMS; the basis for certification |
| BS ISO/IEC 20000-2:2012 | Guidance on the application of service management systems | 2nd ed., 2012-02-15 | Provides application guidance and examples for each clause of 20000-1 |
| BS ISO/IEC 20000-3:2012 | Guidance on scope definition and applicability | 1st ed., 2012-08-15 | Guides determining the SMS scope and applicability of ISO/IEC 20000-1 |
3. Part 1: Service Management System Requirements Core Content 🔍
Part 1 defines the normative requirements of the service management system (SMS), the basis on which an organization obtains ISO/IEC 20000 certification. Its core structure includes:
- Management system general requirements: management responsibility, service management policy, authority/responsibility/communication, management representative, documentation management, resource management, and so on.
- Service delivery processes: service portfolio management, service level management (SLM), service reporting, service continuity and availability management, capacity management, information security, and budgeting and accounting.
- Relationship processes: business relationship management and supplier management.
- Resolution processes: incident and service request management, problem management.
- Control processes: configuration management, change management, release and deployment management.
Part 1 combines the “Plan-Do-Check-Act (PDCA)” cycle with a process approach, emphasizing customer focus, continual improvement, and end-to-end process control.
💡 Certification implementation tip: integrate the SMS with existing management systems (such as ISO 9001 and ISO/IEC 27001) to reduce duplicate documents and processes, lower implementation cost, and improve synergy.
4. Part 2: Application Guidance 📘
Part 2 provides application guidance for each clause of 20000-1, explaining clause-by-clause the intent and implementation method of each requirement with examples. Content covers how to define the service management policy, how to establish a service management committee, how to conduct service level negotiation, and how to use service reports. The guidance also covers “governance of processes operated by other parties,” documentation management, and resource management, helping organizations convert requirements into implementable policies and processes.
5. Part 3: Scope Definition and Applicability Guidance 📐
Part 3 answers “who can use it, to what extent, and how to define scope”:
- Who can use ISO/IEC 20000-1: all organizations providing services, including internal IT departments, external service providers, and outsourcing service providers.
- Scope determination principles: how to define the services, locations, personnel, and processes covered by the SMS, and how to judge scope size and boundaries.
- Applicability assessment: how to evaluate the gap between an organization’s current state and 20000-1 requirements and determine implementation priorities and roadmap.
- Governance and outsourcing: how to govern and supervise processes operated by other parties.
Part 3 is especially valuable for organizations preparing for certification or at the early stage of system building, avoiding both the “scope too large to implement” and “scope too small to be meaningful” common problems.
6. Application Practice and Implementation 🛠️
- 📋 Gap analysis: conduct a gap analysis before certification, comprehensively assess the current state against 20000-1, and form a remediation plan.
- 🔗 Synergy with ITIL: use ITIL practice to implement process details and use 20000-1 to verify system completeness; the two complement each other.
- 🎓 Personnel capability: train service management professionals (SMP), establish service desk and process owner responsibilities, ensuring someone is responsible, someone executes, and someone supervises.
- 🔄 Continual improvement: include internal audit, management review, and corrective actions in annual plans to keep the SMS dynamically effective.
🚨 Certification is not a “one-off”: ISO/IEC 20000-1 requires the system to remain effective and subject to surveillance audits. If the system stalls after certification, the certificate may lapse and trust may be lost.
7. Frequently Asked Questions ❓
❓ Q: What is the difference between ISO/IEC 20000 and ITIL?
A: ITIL is a best-practice framework covering the practical guidance for incident, problem, change, and configuration processes; ISO/IEC 20000-1 is a certifiable management system requirement defining conditions an organization must satisfy. They reinforce each other and are commonly used together.
A: ITIL is a best-practice framework covering the practical guidance for incident, problem, change, and configuration processes; ISO/IEC 20000-1 is a certifiable management system requirement defining conditions an organization must satisfy. They reinforce each other and are commonly used together.
❓ Q: Only IT outsourcing companies need certification?
A: No. Internal IT departments, cloud service providers, and software and operations service providers can all seek certification; certification demonstrates service management capability, enhancing customer trust and market competitiveness.
A: No. Internal IT departments, cloud service providers, and software and operations service providers can all seek certification; certification demonstrates service management capability, enhancing customer trust and market competitiveness.
❓ Q: How does Part 3 differ from Parts 1 and 2?
A: Part 1 is the normative requirement (certification basis), Part 2 provides application guidance, and Part 3 specifically guides scope definition and applicability assessment, helping organizations determine “what to certify and what to cover.”
A: Part 1 is the normative requirement (certification basis), Part 2 provides application guidance, and Part 3 specifically guides scope definition and applicability assessment, helping organizations determine “what to certify and what to cover.”
❓ Q: How long does implementing ISO/IEC 20000 take?
A: Depends on organization size and maturity; typically 6–18 months from gap analysis to certification. Key factors are top management commitment, resource investment, and a continual improvement mechanism.
A: Depends on organization size and maturity; typically 6–18 months from gap analysis to certification. Key factors are top management commitment, resource investment, and a continual improvement mechanism.
🔍 Q: How does it align with ISO/IEC 27001?
A: 27001 focuses on information security, while 20000 focuses on service management; the two can be integrated into one management system, sharing policies, internal audits, and management review processes for compliance synergy.
A: 27001 focuses on information security, while 20000 focuses on service management; the two can be integrated into one management system, sharing policies, internal audits, and management review processes for compliance synergy.