ISO 20000 Lead Implementer cheat sheet

A service management system (SMS) is a set of interrelated or interacting elements of an organization to establish policies and objectives, and processes to achieve those objectives for service management.

ISO/IEC 20000-1 uses the High Level Structure (HLS) common to other ISO management system standards, enabling integrated management systems.

The standard applies to organizations of any size, type, or nature that provide IT services, whether internal or external.

The SMS must be integrated with the organization's business processes and align with its strategic direction.

Key concepts: service, service management, service provider, customer, user, interested party, and continual improvement.

The Plan-Do-Check-Act (PDCA) cycle underpins the SMS: Plan establishes objectives and processes; Do implements; Check monitors and measures; Act maintains and improves.

The standard emphasizes a process approach: understanding and managing interrelated processes as a system to achieve objectives effectively and efficiently.

Risk-based thinking is implicit: the organization must determine risks and opportunities that need to be addressed to ensure the SMS can achieve its intended outcomes.

Documented information must be controlled; the extent of documentation can vary depending on the organization's size, activities, and competence.

Clause 4 (Context of the organization) requires determining external and internal issues, interested parties, and the scope of the SMS.

Clause 5 (Leadership) requires top management to demonstrate leadership, establish a service management policy, and assign roles and responsibilities.

Clause 6 (Planning) requires actions to address risks and opportunities, service management objectives, and planning of changes.

Clause 7 (Support) covers resources, competence, awareness, communication, and documented information.

Clause 8 (Operation) includes operational planning and control, and the service management processes: service portfolio, service level, supplier, service continuity, capacity, availability, service configuration, change, release and deployment, incident, problem, and service desk.

Clause 9 (Performance evaluation) requires monitoring, measurement, analysis, evaluation, internal audit, and management review.

Clause 10 (Improvement) requires nonconformity and corrective action, and continual improvement.

The standard specifies requirements for the service provider to plan, establish, implement, operate, monitor, review, maintain, and improve an SMS.

A gap analysis compares current practices with ISO/IEC 20000-1 requirements to identify missing or inadequate processes.

The scope of the SMS must be defined and documented, considering external and internal issues, interested parties, and the services provided.

Top management must establish a service management policy and ensure objectives are compatible with strategic direction.

Service management objectives must be measurable, monitored, communicated, and updated as appropriate.

Planning must address risks and opportunities, and include actions to integrate them into SMS processes and evaluate their effectiveness.

A project plan for implementation should include phases, resources, responsibilities, timelines, and communication.

Roles and responsibilities for the SMS must be assigned and communicated, including the process owners.

Implementation planning should consider the organizational context, culture, and existing management systems.

Documented information needed for the SMS must be planned, including the scope, policy, objectives, and process descriptions.

Implement the service management processes required by Clause 8, ensuring they are planned, controlled, and monitored.

Service portfolio management: document services, their descriptions, and their relationships with customers.

Service level management: negotiate, agree, and document service level agreements (SLAs) and operational level agreements (OLAs) with relevant parties.

Supplier management: manage suppliers and their performance to ensure seamless service delivery.

Incident and problem management: restore service quickly and manage root causes to prevent recurrence.

Change management: control changes to services and configuration items, assessing risk and impact.

Service desk: provide a single point of contact for users and handle incidents and service requests.

Implement monitoring and measurement of processes and services to demonstrate performance and identify improvement opportunities.

Ensure competence and awareness of personnel through training and communication.

Maintain documented information as evidence of process operation and to support the SMS.

Determine what needs to be monitored and measured, the methods, when, and who shall analyze and evaluate results.

Monitoring and measurement must be planned and integrated into the SMS processes.

Key performance indicators (KPIs) should be defined for services and processes, aligned with service management objectives.

Internal audits must be conducted at planned intervals to verify the SMS conforms to ISO/IEC 20000-1 and is effectively implemented.

The audit program must consider the importance of processes, changes, and results of previous audits.

Management review must be conducted at planned intervals, covering inputs such as audit results, customer feedback, and process performance.

Outputs of management review include improvement opportunities and resource needs.

Performance evaluation includes analysis of data from monitoring, measurement, and audits to assess effectiveness.

Documented information must be retained as evidence of monitoring, measurement, analysis, and evaluation.

Continual improvement must be a permanent objective of the organization.

Identify improvement opportunities through analysis of data, audits, management review, and customer feedback.

Nonconformities must be reacted to, controlled, corrected, and evaluated for corrective action to eliminate causes.

Corrective actions must be proportionate to the effects of the nonconformities encountered.

The organization must retain documented information as evidence of the nature of nonconformities and results of corrective actions.

Improvement should be planned and managed, considering the organization's context and risks.

The PDCA cycle is applied to continually improve the SMS and its processes.

Performance against objectives and KPIs should drive improvement actions.

Improvement activities should be communicated and their effectiveness evaluated.

Certification audits are conducted by accredited certification bodies against ISO/IEC 20000-1.

The audit process typically includes a Stage 1 (documentation and readiness review) and Stage 2 (implementation effectiveness) audit.

The organization must provide documented information required by the standard and evidence of process operation.

Internal audit and management review must be completed before the Stage 2 audit.

The certification body will audit the scope of the SMS and the services included.

Nonconformities identified during the audit must be addressed within agreed timeframes.

Certification is valid for three years, subject to surveillance audits at planned intervals.

The organization should prepare by conducting a pre-assessment or gap analysis and ensuring all requirements are implemented.

Auditors will sample evidence, interview personnel, and observe processes to verify conformity.

The organization must demonstrate that the SMS is effective and meets its objectives.