ISO 20000 Foundation cheat sheet

ISO/IEC 20000-1 is the requirements standard for a service management system (SMS); ISO/IEC 20000-2 provides guidance on applying Part 1 and is not certifiable on its own.

The SMS is a management system: it covers policy, objectives, processes, resources, and continual improvement, not just a service desk or a set of IT tasks.

Mandatory documented information includes SMS scope, service management policy, service management objectives, and evidence of the processes and their interaction.

Scope statement must identify the services delivered, the organizational units covered, and any exclusions with justification; exclusions may not remove requirements that affect service conformity.

Top management must demonstrate leadership by establishing policy and objectives, ensuring integration with business processes, and ensuring resources are available.

Roles, responsibilities, and authorities for service management must be assigned and communicated, including a named owner of the SMS.

The organization must determine external and internal issues and interested parties relevant to the SMS, plus the services and their boundaries, before designing processes.

Services delivered by suppliers, internal groups, or customers remain within SMS scope; the organization retains accountability for the delivered service.

Requirements apply to all service lifecycle stages in scope: plan, design, transition, delivery, and improvement of services.

Planning follows a risk-based sequence: establish scope and context, set policy and objectives, identify processes and their interactions, allocate resources, then implement and operate.

Service management objectives must be measurable, consistent with policy, relevant to service conformity and customer satisfaction, and monitored at planned intervals.

Processes must be defined with purpose, inputs, outputs, sequence and interaction, criteria and methods, resources, responsibilities, and records of performance.

Risk identification and treatment applies to service planning and to the SMS itself; risks and opportunities are addressed before and during implementation.

Implementation must address organizational change, competence and awareness of personnel, communication, and the documented information needed to support operation.

Service level agreements, service catalogues, and service level targets are established during planning and are the basis for measuring service delivery.

New or changed services require a plan covering resources, budget, acceptance criteria, roles, and the impact on existing services before transition.

Implementation is not a one-off project: the SMS must be operated, monitored, and improved, so planning includes schedules for review and audit.

Budgeting and accounting for services is a planning activity that identifies the cost of delivering services and supports decisions on service provision.

Monitoring determines status; measurement assigns values using defined methods; analysis turns data into information used for evaluation and decisions.

The organization must determine what to monitor and measure, the methods, when monitoring and measurement occur, who performs them, and when results are analysed and evaluated.

Service level achievement is measured against agreed targets in SLAs; breaches are recorded, analysed, and reported to the customer and to management.

Internal audit must be conducted at planned intervals to verify the SMS conforms to the organization's own requirements and to ISO/IEC 20000-1, and that it is effectively implemented and maintained.

Management review is performed at planned intervals and covers status of actions, changes in issues and interested parties, performance against objectives, audit results, and improvement opportunities.

Review outputs must include decisions and actions relating to improvement opportunities and any need for changes to the SMS.

Service reporting must give customers and management accurate, timely, and agreed information on service performance and on the effectiveness of the SMS.

Nonconformities and incidents are inputs to review; the organization must evaluate whether corrective actions were effective, not merely whether they were completed.

Records from monitoring, measurement, audit, and review are retained as documented information to demonstrate conformity and support trend analysis.

Continual improvement applies to services, processes, and the SMS itself; the objective is suitability, adequacy, and effectiveness over time.

Improvement opportunities are identified from service performance data, SLA breaches, incidents and problems, audit findings, management review outputs, and customer feedback.

The organization must define how improvement opportunities are selected, prioritized, approved, and implemented, including ownership and timescales.

PDCA underlies improvement: Plan the change, Do the implementation, Check the results against expected outcomes, Act to standardize or adjust.

Corrective action addresses the cause of a nonconformity to prevent recurrence; correction addresses the immediate nonconformity itself.

Problem management feeds continual improvement by removing root causes of recurring incidents and by identifying known errors for resolution.

Improvement actions are tracked to completion and their effectiveness evaluated; results feed the next management review cycle.

Improvement must consider the impact on existing services and on the SMS, including risk, cost, and the need for changes to documented information.

Demonstrating continual improvement is a certification expectation: auditors look for evidence of measured trends and completed improvement actions, not just plans.