ISO 20000 Certification in USA

Independent confirmation by a certification body that an organization’s service management system (SMS) meets ISO/IEC 20000-1 for the services and locations named in the certificate scope.

The international standard that sets requirements for a service management system to plan, design, transition, deliver and improve services.

ISO/IEC 20000-1:2018, including Amendment 1:2024. The 2011 edition is withdrawn.

No. ISO/IEC 20000-1:2018 with Amendment 1:2024 is the current version.

An amendment on climate action. Organizations consider whether climate change is a relevant issue and whether interested parties have climate-related requirements. It does not set emission targets.

The policies, processes, roles and records an organization uses to manage the services it delivers, from requirements to improvement.

Any organization that delivers services to internal or external customers and operates an SMS: MSPs, cloud and SaaS providers, data centers, telecom providers, internal IT departments and others.

Yes. The scope names the managed services covered and the locations that deliver them.

Yes, for the services in scope. The certificate covers service management, not the software’s functionality or security.

Yes. Internal customers and internal suppliers are covered by the standard.

No. It is voluntary, though some customers or contracts may ask for it.

Clauses 4 to 10: context, leadership, planning, support, operation of service management processes, performance evaluation and improvement.

The services you want certified and can show evidence for. Name the services and the locations delivering them.

Yes, where the organization governs the parties involved and controls the end-to-end service. Outsourced parts are not excluded automatically.

Yes. Each site’s role must be clear. Multi-site sampling is only possible where certification rules allow it, after technical review.

Information about the services you deliver: descriptions, owners, customers, dependencies and service levels. ISO 20000 uses the spelling “catalogue”.

Agreeing service requirements and targets with customers, monitoring results and reviewing them.

ISO 20000 requires service level agreements for services in scope, as part of service level management. Their content and targets are agreed with customers.

No. Support hours are whatever you agree with customers.

Restoring service as quickly as agreed after an unplanned interruption or degradation, and managing its impact.

An incident is something going wrong with a service. A service request is a planned request, such as access or information.

Finding and dealing with the underlying causes of incidents, to prevent recurrence or reduce impact.

Assessing, authorizing and reviewing changes to services and their components, with controls scaled to risk.

Planning, testing and deploying releases into the live environment, with acceptance and recovery arrangements.

Keeping accurate information about service components and how they relate. A specific CMDB product is not required.

Through agreements, defined responsibilities, performance monitoring and regular review, for both external and internal suppliers.

Agreeing availability requirements, monitoring them and planning improvements.

Planning how services will continue or be restored after a major disruption, and testing those plans.

Understanding demand for services and planning the resources needed to meet it.

No. ITIL qualifications are for individuals and are not a prerequisite for ISO 20000 certification.

ISO/IEC 20000-1 contains requirements an organization can be certified against. ITIL is guidance owned by PeopleCert, with qualifications for individuals.

ISO 20000 covers service management; ISO 27001 covers information security management. Each needs its own certificate.

Yes. Common elements such as internal audit and management review can be shared; each standard keeps its own requirements.

Yes. Service continuity work can support a business continuity system, but ISO 22301 is certified separately.

No. It certifies a service management system, not a product or tool.

No. It shows that a system for managing services is in place and working.

Certain documented information, such as scope, policy, objectives, the SMS plan, the catalogue, SLAs, supplier agreements and audit and review records, plus process records.

A readiness review of scope, catalogue, policy, documented information, processes, internal audit and management review.

An audit of how the SMS works in practice, using samples of tickets, changes, supplier reviews and reports.

Some activities may use remote techniques where accreditation rules allow. The audit plan sets this; it is not promised in advance.

It depends on audit time and travel, which depend on scope, people, sites and complexity. We quote after technical review.

It depends on how ready your SMS is and how much operating evidence you have. We do not promise a fixed timeline.

Usually three years, subject to successful surveillance audits.

An audit at least once a calendar year to check the SMS continues to work.

Tell the certification body about significant changes. Scope changes may need review or an extra audit.

Transfers depend on the current certificate’s status, accreditation and audit history, and are reviewed case by case.

Integrated Assessment Services under its UQAS accreditation, subject to confirmation that ISO/IEC 20000-1 is in the accredited scope. Your proposal names the issuer.

Use the IAS certificate search for IAS certificates and ask for the accreditation certificate and scope.

Yes. There is no minimum size, but all applicable requirements still apply.

Use the quotation form on this page. A certification coordinator and an ITSMS technical reviewer review your details first.