ISO 20000-1 Certification: What it involves, What it costs and How long it takes

The current edition is ISO/IEC 20000-1:2018, with Amendment 1:2024 adding climate action requirements. The standard requires an organisation to establish, implement, maintain and continually improve its service management system. 

How does ISO 20000-1 relate to ITIL?

ITIL is guidance; ISO/IEC 20000-1 is a specification. ITIL describes how service management can be practised, while ISO/IEC 20000-1 states requirements an organisation must meet to be certified. 

The two work well together. Many providers use ITIL practices to implement the processes ISO/IEC 20000-1 requires. But ITIL adoption does not equal conformity.

Organisations with mature ITIL practice often have much of clause 8 already in place. They may still have little of clauses 4 to 10, which cover policy, objectives, planning, internal audit and management review. ITIL says relatively little about those management system elements. 

What does the standard ask of you?

ISO/IEC 20000-1 asks for a service management system: policy, objectives, planning, support, operation, evaluation and improvement, applied to service delivery. It also sets requirements for the service management processes themselves. 

The process groups are broad:

Service portfolio: service planning, control of parties involved in the service lifecycle, service catalogue management, asset management and configuration management

Relationship and agreement: business relationship management, service level management and supplier management

Supply and demand: budgeting and accounting, demand management and capacity management

Service design, build and transition: change management, service design and build, and release and deployment

Resolution and fulfilment: incident management, service request management and problem management

Service assurance: service availability management, service continuity management and information security management

That breadth is why certification takes longer than the standard’s page count suggests. The exact way a provider meets the requirements is not prescribed; the organisation decides how to implement them. 

Which clause catches providers out?

Control of parties involved in the service lifecycle sits in clause 8.2.3. Where another party operates a process or delivers part of a service, the provider remains responsible for meeting the requirements. 

This matters for providers that subcontract, use cloud platforms or rely on vendors for parts of delivery. The provider must show control over work it does not operate itself. A process cannot be excluded from scope simply because somebody else performs it.

Auditors examine this closely. It is a common reason a proposed scope gets challenged during the early stage of an ISO 20000-1 audit.

What are the stages of certification?

Certification follows a sequence, and each stage builds evidence for the next.

Scope: Define which services, customers and locations are covered. The scope must be defensible in terms of services delivered, not chosen for convenience.

Service catalogue: Document what the provider actually offers.

Service level agreements: Set defined targets and agree them with customers.

Process implementation: Implement the process groups across clause 8.

Configuration management. Maintain a configuration management database or equivalent, accurate enough to be useful.

Operation period: Let records accumulate, typically three to six months, because process maturity must be demonstrated over time.

Internal audit and management review: Check the system works before the external auditor arrives.

Stage 1 and Stage 2 audits: Complete the initial assessment, then certification.

Certification normally runs on a three-year cycle with surveillance audits, though the exact arrangement depends on the certification body. ISO/IEC 20000-6 sets requirements for bodies providing audit and certification of service management systems.

How long does certification take?

Timelines vary with scope, maturity and subcontracting. These are practitioner ranges, not fixed rules.

A small provider with a single service line and existing ITIL practice may take six to ten months.

A mid-sized provider with multiple services and customers may take ten to sixteen months.

A large or heavily subcontracted provider may take fifteen to twenty-four months.

Two items pace most projects. Configuration management is almost always worse than assumed. The operation period cannot be shortened, because auditors need to see processes running and producing records.

What does certification cost?

Certification body fees follow audit-day calculations based on headcount, services and sites. Consultancy fees concentrate on process design and the management system elements, particularly for organisations with ITIL practice but no formal management system.

Tooling is often the real cost. Service management platforms, configuration management tools and monitoring systems all add expense. Many organisations already own these tools and use only a fraction of their capability.

Internal effort is substantial and distributed. The processes span the whole service organisation, not just a quality function.

Where do systems fail?

Several weaknesses appear repeatedly in preparation work:

Configuration data that is wrong: A configuration management database populated once and never maintained undermines change, incident, problem and capacity management at the same time.

Service levels not agreed with anyone: Targets set internally and never confirmed with customers do not survive an audit.

Problem management absent: Incident management exists in every organisation because incidents force attention. Problem management, which finds and removes underlying causes, is often missing entirely.

Change management bypassed for urgent changes: An emergency route with no retrospective review becomes the normal route.

Capacity managed reactively: No capacity plan and no forecasting means the provider responds only after performance drops.

Scope drawn to exclude subcontracted work: This does not survive scrutiny under clause 8.2.3. 

Continuity untested: Service continuity plans that have never been exercised provide little assurance.

“We pushed this through as an emergency change,” said the operations lead at a Chennai SaaS firm. “It has become the normal route now,” replied the compliance manager.

Is ISO 20000-1 certification worth it?

If tenders in your market list it, the decision is commercial and the answer is usually yes. If not, the honest assessment is that the standard’s value lies in the processes most organisations skip: problem management, capacity management and configuration management.

Those three are where service organisations quietly lose money and credibility. They rarely get attention without an external forcing function. If a provider would implement them anyway, it may not need the certificate. Most organisations do not implement them without one.

How can MSCi help?

MSCi helps Indian IT service providers, managed-services firms, SaaS companies and data-centre operators prepare for ISO 20000-1 certification. We assess the current service management system, identify gaps across clauses 4 to 10 and help teams build practical evidence.

We also help providers define a defensible scope, strengthen supplier control, improve configuration and problem management, and prepare for Stage 1 and Stage 2 audits. For organisations needing wider support, experienced ISO certification consultants can coordinate this work with related management systems.

If you are considering certification, MSCi can review your readiness and help you plan the path.

Frequently Asked Questions

1. What is ISO 20000-1 certification?

It is third-party certification that a provider’s service management system meets ISO/IEC 20000-1:2018. The certification body audits the system and issues a certificate valid for a defined cycle. 

2. Is ITIL enough to get certified?

No, ITIL provides practice guidance, while ISO/IEC 20000-1 sets auditable requirements. A provider with strong ITIL practice still needs management system elements such as policy, objectives, internal audit and management review committee. 

3. What is clause 8.2.3?

It covers control of parties involved in the service lifecycle. If a supplier, subcontractor or cloud provider delivers part of a service, the provider must show how it controls that party’s contribution. 

4. How long does the operation period last?

Typically three to six months, though this is practitioner practice rather than a requirement in the standard itself. Auditors need to see processes running and producing records over time.

5. Does MSCi issue the certificate?

No, MSCi prepares organisations for audits and is not a certification body. It does not issue an ISO 20000-1 certificate.