Service management system
Context, interested parties, scope, leadership, policy, risks, objectives and the service management plan. Since the 2024 amendment, also whether climate change is a relevant issue.
ISO/IEC 20000-1:2018 + Amd 1:2024 · SMS
IT service management with a method: from SLAs to continuity.
Audexa turns ISO/IEC 20000-1 into a guided self-assessment of 75 controls for MSPs, MSSPs and IT departments serving the rest of the business. You review the service management system and every clause 8 process, close findings with tasks and reuse what you already have in ISO 27001, ISO 9001 and ISO 22301.
- 75 controls in 15 sections
- Every clause 8 process
- 200 mappings to ISO 27001, ISO 9001 and ISO 22301
ISO 20000-1 self-assessmentIn progress
68%
SMS maturitySample data
- Catalogue, assets and configuration74%
- Business relationship and SLAs69%
- Change management57%
- Resolution and fulfilment72%
- Service assurance61%
75 controls, each with how to assess it and how to meet it
15 sections, from SMS context to service reporting
200 mappings: 72 to ISO 27001, 85 to ISO 9001 and 43 to ISO 22301
5 languages: English, Spanish, French, Italian and German
What ISO 20000-1 asks for
ISO 20000-1 asks you to show that you manage the service, not just deliver it.
It is the international requirements standard for a service management system (SMS). It is voluntary and certifiable, and it gives you a way to show clients how you run what you deliver to them.
Portfolio, catalogue and configuration
Which services you provide, to whom, with which assets and configuration items. The CMDB and its verification are part of the controls.
Business relationship and service levels
Agreed SLAs, monitoring, reporting and review, customer satisfaction and complaints. Plus external and internal suppliers aligned with what you promise.
Change, design and release
Change policy, assessment and approval, schedule and rollback. Planning and transition of new or changed services, testing and deployment.
Incidents, requests and problems
Logging, prioritisation, escalation and major incidents. Request fulfilment models, problem analysis and known errors.
Availability, continuity and security
Availability targets, service continuity plans and tests, and information security inside the SMS. This is where it leans most on ISO 27001 and ISO 22301.
Sources: ISO/IEC 20000-1:2018 (ISO) · Directive (EU) 2022/2555, NIS2 (EUR-Lex)
How Audexa helps
From an ISO 20000-1 self-assessment to a plan that gets closed.
Questions written by Audexa for the people who run the service desk, changes and SLAs. The text of the standard belongs to ISO; here you get the guidance to assess and meet it.
Assess
Know where your SMS stands against each requirement.
Guided questionnaire
Answer control by control with Yes, Partial, No or Not applicable. Each control explains how to assess it and what to ask for as proof.
Applicability with a reason
Mark what does not apply or is out of scope, with a justification that travels with the result.
What you already have
When you create the audit you see how much your ISO 27001, ISO 9001 or ISO 22301 audits already cover.
Remediate
Every finding with an owner and a closure criterion.
How to meet it
Concrete steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan with subtasks
Turn findings into tasks with owners and dates, without duplicates.
Assets and suppliers
Link the controls to your inventory of assets, suppliers and contracts.
Demonstrate
Have the proof ready for the certification audit.
IT Service Management Policy
Editable template with versions, approval and signature, part of a library of 67 templates, 5 of them linked to ISO 20000-1.
Evidence vault
SLAs, CAB minutes, service reports and continuity tests, with expiry dates and reviews.
Report and re-audit
Score, findings and a PDF and Excel report. Repeat the audit to measure progress.
Some features depend on your plan and active modules.
What the questionnaire covers
Every clause 8 process, none left out.
The 75 controls cover the SMS in clauses 4 to 10, with the 2024 climate amendment, and each clause 8 process. They are grouped into 15 sections so you can split the work between service desk, operations, change and management.
- Service portfolio and catalogue, assets and configuration
- Business relationship, service levels, suppliers, budgeting, demand and capacity
- Change, design and transition, release and deployment
- Incidents, requests, problems, availability, continuity, security and service reporting
Resolution and fulfilment7 controls
- Incident logging, classification and prioritisationYes
- Incident resolution, escalation and closurePartial
- Major incident procedureNo
- Fulfilment models and self-servicePartial
- Known errors and workaroundsYes
Mappings
Reuse your ISO 27001, ISO 9001 and ISO 22301 work.
Many MSPs already hold ISO 27001. Creating the ISO 20000-1 audit shows how much your existing work covers, and high-coverage answers arrive as proposals marked «Review it» for a person to confirm. They are not legal equivalences, just a starting point.
- 72 mappings to ISO 27001, mostly on security, change and incidents
- 85 to ISO 9001: management system, customer relationship, design and improvement
- 43 to ISO 22301: availability and service continuity
- Only high coverage proposes a «Yes»
How much does what I have cover?New audit
- ISO 27001 ↔ ISO 20000-172 pairs
- ISO 9001 ↔ ISO 20000-185 pairs
- ISO 22301 ↔ ISO 20000-143 pairs
- Management reviewReview it
Action plan
Close findings with tasks, evidence and an approved policy.
Every control you do not meet comes with the steps to get there, the expected evidence and who should own it. Turn it into tasks with subtasks and attach the proof when it is done. The IT Service Management Policy is ready to adapt and sign.
- Steps, expected evidence and suggested owner per control
- Closure criterion and when to review each control
- IT Service Management Policy with versions, approval and signature
- PDF and Excel report, plus re-audit to track progress
ISO 20000-1 action plan18 tasks
- Major incident procedureService desk · 30 days
- Quarterly SLA review with clientsAccounts · 4 subtasks
- Continuity plan testEvidence attached
- Approve the IT Service Management PolicyManagement · in review
How it works
Three steps to organise your service management with ISO 20000-1.
Create the audit
Pick ISO 20000-1 in «New audit» and see how much your ISO 27001, ISO 9001 or ISO 22301 audits already cover.
Assess with guidance
Set applicability, answer control by control and review the proposed answers.
Act and demonstrate
Assign tasks, collect evidence, approve the policy and repeat the audit to measure progress.
Plans
ISO 20000-1 is included from the Premium plan.
The Free and Core plans do not include ISO 20000-1. We give you a fixed proposal in the demo based on your team and services.
Premium
RecommendedFor teams that want the full cycle.
- All 22 frameworks in the catalogue, ISO 20000-1 included
- 10 audits per month and 3 users
- Policies, evidence, risks and tasks
- Aude assistant
- 200 assets per section
Diamond
For compliance operations without limits.
- Unlimited audits and users
- Everything in Premium
- Unlimited assets
Frequently asked questions
What people usually ask us about ISO 20000-1.
Does Audexa certify us for ISO 20000-1?
No. ISO/IEC 20000-1 certification is issued by a certification body after its own audit. Audexa helps you prepare for it: a guided self-assessment, an action plan, evidence and a PDF and Excel report so you reach the audit with the work in order.
Does ISO 20000-1 make sense for a small MSP?
Yes, if your clients expect SLAs, change management and continuity you can demonstrate. The standard works for service providers of any size. The self-assessment tells you which processes you already have and which are missing before you decide whether to certify.
We already have ISO 27001. Do we start from scratch?
No. There are 72 mappings to ISO 27001, 85 to ISO 9001 and 43 to ISO 22301. When you create the audit you see an estimate of how much your existing work covers, and high-coverage answers arrive as proposals for a person to confirm.
What exactly does the questionnaire assess?
75 controls in 15 sections: the service management system in clauses 4 to 10, with the 2024 climate amendment, every clause 8 process and service reporting. The questions and guidance are Audexa's own; the text of the standard belongs to ISO.
Is there an IT service management policy template?
Yes. The IT Service Management Policy is part of the library of 67 templates. You adapt it to your company, approve it, sign it and can keep it as evidence. For ISO 20000-1 you also have the “Service Catalogue, Service Level and Capacity Procedure”, the “Change Management Policy”, the “Incident Response Policy” and the “Business Continuity Plan”.
Which plan do I need for ISO 20000-1?
Premium or higher (Diamond). Free and Core do not include ISO 20000-1. We give you a fixed proposal in the demo.
Request a demo
See what your ISO 20000-1 self-assessment would look like.
In a 30-minute demo we walk through the questionnaire, the mappings to ISO 27001 and the action plan with MSP examples.
- We go over the clause 8 processes that matter most to you.
- We show how your ISO 27001 work is reused.
- We explain which plan fits your team.