ISO 20000

DE - ES - ISO 20000 - ISO/IEC 20000 - ISO 20000 Requirements

ITIL provides guidance on what should be done in order to offer users adequate IT Services to support their business processes. ITIL qualifications are available for individuals but until recently there was no way for an IT organization to prove that it is working along the ITIL recommendations.

The ISO/IEC 20000:2011 standard (abbreviated to ISO 20000 in this wiki) was conceived to fill this gap. Initiated by the two organizations itSMF and BSI (British Standards Institution), it is modeled upon the principles of ITIL and allows IT organizations to have their IT Service Management certified.

In contrast to the ITIL books, ISO 20000 does not offer specific advice on how to design your processes. It is rather a set of requirements which must be met in order to qualify for ISO 20000 certification.

 

Key ISO 20000 Requirements

ISO 20000 promotes the "adoption of an integrated process approach to effectively deliver managed services to meet the business and customer requirements".

ISO 20000 does not prescribe that its requirements must be met by following the ITIL recommendations, so there are many possible ways to achieve compliance. Introducing ITIL, however, is the most widely used approach for obtaining an ISO 20000 certificate.

It is also important to prove that IT processes are documented, actively managed, and continually improved.

 

The new Edition ISO/IEC 20000:2011

A new version of ISO/IEC 20000 Part 1: Service management system requirements (abbreviated to ISO/IEC 20000-1:2011) was published in April 2011 - these are the mandatory requirements which must be fulfilled by organizations in order to be compliant with the ISO 20000 standard.

The authors of the new version describe the main differences to the earlier edition (ISO/IEC 20000-1:2005) as follows:

• Closer alignment to both ISO 9001 and ISO/IEC 27001
• Clarification of existing definitions and addition of new definitions
• Introduction of the term "Service Management System" (SMS) and aligning the standard with the concept of a SMS
• Clarification of the requirements for the governance of processes operated by other parties
• Addition of requirements for the design and transition of new or changed services

 

How ITIL and ISO 20000 are related

Figure 1: ISO 20000

The basic principles behind ITIL and ISO 20000 are very much in line (see also: "Alignment White Paper: ITIL V3 and ISO/IEC 20000", Jenny Dugmore & Sharon Taylor, March 2008). The key differences are:

• ITIL certifications are available for individuals only, whereas ISO 20000 is a certification scheme for organizations.
• ITIL is a rather detailed collection of best practices, while ISO 20000 is an international standard that sets out Service Management requirements for IT organizations.
• When organizations say they are compliant to ITIL, very often this statement is not verifiable; a certification according to the ISO 20000 standard means there has been an objective assessment.

Frequently, an ISO 20000 certification is sought after introducing ITIL, because it allows an IT organization to actually prove that it is a customer-oriented, efficient and effective supplier of IT services. A certification can thus be used for marketing purposes, or to gain access to customers and markets which require their service suppliers to be ISO 20000 certified.

 

ISO 20000 Sections and related ITIL Processes

ITIL was explicitly written to be aligned with ISO 20000, as the following table exemplifies: for every section in ISO/IEC 20000:2011, Part 1 (Mandatory Requirements) there are one or several related ITIL processes.

The following table summarizes in broad terms how the main ISO 20000 processes correspond to ITIL processes (ITIL 2011 main processes).

 

ISO 20000 Sections (ISO/IEC 20000:2011)		Related ITIL Processes (ITIL 2011)
Ch.	Title	Remark
4	Service management system general requirements	See note [1]
4.1	Management responsibility	Strategy Management for IT Services and various processes from Continual Service Improvement
4.2	Governance of processes operated by other parties	Supplier Management and Service Level Management
4.3	Documentation management	Various Service Strategy, Service Design and Service Transition processes
4.4	Resource management	Strategy Management for IT Services and various processes from Service Design, Service Operation and Continual Service Improvement
4.5	Establish and improve the SMS 4.5.1 Define scope 4.5.2 Plan the SMS (Plan) 4.5.3 Implement and operate the SMS (Do) 4.5.4 Monitor and review the SMS (Check) 4.5.5 Maintain and improve the SMS (Act)	Various processes from Service Strategy, Service Design and Continual Service Improvement
5	Design and transition of new or changed services	See note [1]
5.1	General	Design Coordination and various Service Transition processes
5.2	Plan new or changed services	Various Service Strategy, Service Design and Service Transition processes
5.3	Design and development of new or changed services	Various Service Design and Service Transition processes
5.4	Transition of new or changed Services	Various Service Transition processes
6	Service delivery processes
6.1	Service level management	Service Level Management
6.2	Service reporting	Service Level Management
6.3	Service continuity and availability management 6.3.1 Service continuity and availability requirements 6.3.2 Service continuity and availability plans 6.3.3 Service continuity and availability monitoring and testing	IT Service Continuity Management and Availability Management
6.4	Budgeting and accounting for IT Services	Financial Management for IT Services
6.5	Capacity management	Capacity Management
6.6	Information security management 6.6.1 Information security policy 6.6.2 Information security controls 6.6.3 Information security changes and incidents	Information Security Management
7	Relationship processes
7.1	Business relationship management	Business Relationship Management
7.2	Supplier Management	Supplier Management
8	Resolution processes
8.1	Incident and service request management	Incident Management and Request Fulfilment
8.2	Problem management	Problem Management
9	Control processes
9.1	Configuration management	Service Asset and Configuration Management
9.2	Change management	Change Management
9.3	Release and deployment management	Release and Deployment Management

 

Note:

ITIL focuses on the life cycle of services, but offers less guidance on establishing and operating the Service Management System (SMS) itself. As a consequence, it is at times not straightforward to map the ITIL guidance and (especially) Section 4 and Section 5 of ISO 20000, but various ITIL processes together can typically be used to fulfill the requirements.

 

Practical Example on how to link ISO 20000 with ITIL 2011

Introduction to the ITIL - ISO 20000 Bridge

ISO 20000 states requirements for service management processes but does not provide guidance for implementing them. However, since ISO 20000 and ITIL are aligned, many ISO 20000 requirements can be fulfilled by implementing one or several ITIL processes. ITIL is thus a valuable source when designing ISO 20000 compliant processes.

The demo on the ITIL - ISO 20000 Bridge highlights how this can be done in practice.

The ITIL - ISO 20000 Bridge is the ISO 20000 add-on to our ITIL process model which links the standard's requirements to the corresponding ITIL 2011 reference processes.

 

ISO 20000: Components

The following parts of ISO 20000 have been published so far:

 

Parts of ISO 20000
Part	Acronym	Title	Contents
1	ISO/IEC 20000-1:2011	Service Management System Requirements	Mandatory requirements (see Chapter "ISO 20000 Requirements). These requirements must be fulfilled by organizations in order to be compliant with the standard.
2	ISO/IEC 20000-2:2012	Guidance on the application of service management systems (SMS)	Examples and suggestions for the design of IT Service Management processes, based on the requirements in ISO/IEC 20000-1. Generic guidelines on the implementation of a SMS. In ISO/IEC 20000-2:2005 referred to as "Code of Practice".
3	ISO/IEC TR 20000-3:2009	Guidance on scope definition and applicability of ISO/IEC 20000-1	Technical Report (TR) providing guidance on scope definition, applicability and demonstration of conformity.
4	ISO/IEC TR 20000-4:2010	Process reference model	Technical Report (TR) providing recommendations on the underlying process model.
5	ISO/IEC TR 20000-5:2010	Exemplar implementation plan for ISO/IEC 20000-1	Technical Report (TR): Advice on planning and implementing ISO 20000.

 

The original ISO 20000 documents can be ordered from the publisher's web site: ISO International Organization for Standardization