ISO/IEC 20000-1:2018

Information technology - Service management - Part 1: Service management system requirements

This document specifies requirements for an organization to establish, implement, maintain and continually improve a service management system (SMS). The requirements specified in this document include the planning, design, transition, delivery and improvement of services to meet the service requirements and deliver value. This document can be used by: a) a customer seeking services and requiring assurance regarding the quality of those services; b) a customer requiring a consistent approach to the service lifecycle by all its service providers, including those in a supply chain; c) an organization to demonstrate its capability for the planning, design, transition, delivery and improvement of services; d) an organization to monitor, measure and review its SMS and the services; e) an organization to improve the planning, design, transition, delivery and improvement of services through effective implementation and operation of an SMS; f) an organization or other party performing conformity assessments against the requirements specified in this document; g) a provider of training or advice in service management. The term "service" as used in this document refers to the service or services in the scope of the SMS. The term "organization" as used in this document refers to the organization in the scope of the SMS that manages and delivers services to customers. The organization in the scope of the SMS can be part of a larger organization, for example, a department of a large corporation. An organization or part of an organization that manages and delivers a service or services to internal or external customers can also be known as a service provider. Any use of the terms "service" or "organization" with a different intent is distinguished clearly in this document.

Technologies de l'information — Gestion des services — Partie 1: Exigences du système de management des services

Le présent document spécifie les exigences destinées à une organisation pour établir, implémenter, maintenir et améliorer continuellement un système de management des services (SMS). Les exigences spécifiées dans le présent document incluent la planification, la conception, la transition, la fourniture et l'amélioration des services afin de satisfaire aux exigences des services et créer de la valeur. Le présent document peut être utilisé par: a) un client attendant des services et exigeant une garantie de qualité pour ces services; b) un client exigeant une approche cohérente du cycle de vie des services de la part de tous ses fournisseurs de services, y compris ceux de la chaîne logistique; c) un organisme pour démontrer ses capacités en matière de planification, de conception, de transition, de fourniture et d'amélioration des services; d) un organisme pour surveiller, mesurer et passer en revue son SMS et les services; e) un organisme pour améliorer la planification, la conception, la transition, la fourniture et l'amélioration des services par la mise en œuvre et le fonctionnement efficaces d'un SMS; f) un organisme ou un tiers menant des évaluations de conformité par rapport aux exigences spécifiées dans le présent document; g) un fournisseur de formation ou de conseil en gestion des services. Le terme «service» tel qu'il est utilisé dans le présent document se réfère au service ou aux services compris dans le périmètre d'application du SMS. Le terme «organisme» tel qu'il est utilisé dans le présent document se réfère à l'organisme compris dans le périmètre d'application du SMS qui gère et fournit les services aux clients. Dans le périmètre d'application du SMS, l'organisme peut faire partie d'une organisation plus étendue comme peut l'être, par exemple, un département au sein d'une grande entreprise. Un organisme ou partie d'un organisme qui gère et fournit un ou plusieurs services à des clients internes ou externes peut être aussi dénommé fournisseur de service. Tout usage des termes «service» ou «organisme» n'ayant pas les significations susmentionnées sera clairement indiqué dans le présent document.

General Information

• Status: Published
• Publication Date: 13-Sep-2018
• ICS: 03.080.99 - Other services
• ICS: 35.020 - Information technology (IT) in general
• Technical Committee: ISO/IEC JTC 1/SC 40 - IT service management and IT governance
• Drafting Committee: ISO/IEC JTC 1/SC 40/WG 2 - Service management – Information technology
• Current Stage: 9093 - International Standard confirmed
• Start Date: 04-Dec-2023
• Completion Date: 30-Oct-2025

Relations

• Amended By: ISO/IEC 20000-1:2018/Amd 1:2024 - Information technology - Service management - Part 1: Service management system requirements - Amendment 1: Climate action changes
• Effective Date: 18-Nov-2023
• Revises: ISO/IEC 20000-1:2011 - Information technology - Service management - Part 1: Service management system requirements
• Effective Date: 23-Jan-2016

Overview

ISO/IEC 20000-1:2018 defines requirements for a Service Management System (SMS) to plan, design, transition, deliver and continually improve IT and business services. The standard specifies the management-system approach an organization or service provider must implement to ensure services meet customer requirements and deliver value across the full service lifecycle - from planning through operation and continual improvement. ISO/IEC 20000-1:2018 supports consistent service quality, governance of supply chains and provides a basis for conformity assessment and certification.

Key topics and technical requirements

ISO/IEC 20000-1:2018 structures SMS requirements around management-system principles and service-management processes. Important technical topics include:

• Context & leadership
  • Understanding organization context, interested parties and defining the scope of the SMS
  • Leadership commitment, service management policy, roles and authorities
• Planning and risk management
  • Objectives, planning to achieve objectives and actions to address risks and opportunities
• Documentation and records
  • Documented information requirements, control of documents and records for the SMS
• Design & transition of services
  • Planning, design, development and controlled transition of new or changed services
• Service delivery processes
  • Service level management, reporting, continuity & availability, budgeting/accounting, capacity management and information security controls
• Relationship & supplier management
  • Business relationship management and governance of parties in the service lifecycle (including supply-chain requirements)
• Resolution processes
  • Incident, service request, and problem management to restore and maintain service
• Control and operational processes
  • Operational planning and control, configuration, service catalogue, asset management, change, release and deployment
• Monitoring, measurement & continual improvement
  • Performance monitoring, audits, management review and continual improvement activities

Practical applications - who uses ISO/IEC 20000-1:2018

ISO/IEC 20000-1:2018 is practical for:

• IT departments and internal service providers seeking to improve service quality and governance
• Managed Service Providers (MSPs), cloud and outsourced service providers aiming for consistent lifecycle control and customer assurance
• Customers requiring assurance of provider capability or consistent service delivery across suppliers
• Organizations preparing for certification or conformity assessment against SMS requirements
• Consultants, trainers and auditors delivering service-management guidance and assessments

Related standards

• Other parts of the ISO/IEC 20000 series (service management family)
• Complementary standards such as ISO/IEC 27001 for information security management

ISO/IEC 20000-1:2018 is a practical, process-oriented standard for organizations that want a systematic, auditable approach to managing and improving IT and business services.

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 20000-1
Third edition
2018-09
Information technology — Service
management —
Part 1:
Service management system
requirements
Technologies de l'information — Gestion des services —
Partie 1: Exigences du système de management des services
Reference number
©
ISO/IEC 2018
© ISO/IEC 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2018 – All rights reserved

Contents Page
Foreword .v
Introduction .vii
1 Scope . 1
1.1 General . 1
1.2 Application . 1
2 Normative references . 2
3 Terms and definitions . 2
3.1 Terms specific to management system standards . 2
3.2 Terms specific to service management . 6
4 Context of the organization .10
4.1 Understanding the organization and its context .10
4.2 Understanding the needs and expectations of interested parties .10
4.3 Determining the scope of the service management system .10
4.4 Service management system.10
5 Leadership .10
5.1 Leadership and commitment .10
5.2 Policy .11
5.2.1 Establishing the service management policy .11
5.2.2 Communicating the service management policy .11
5.3 Organizational roles, responsibilities and authorities.11
6 Planning .12
6.1 Actions to address risks and opportunities .12
6.2 Service management objectives and planning to achieve them .12
6.2.1 Establish objectives .12
6.2.2 Plan to achieve objectives .13
6.3 Plan the service management system .13
7 Support of the service management system .13
7.1 Resources .13
7.2 Competence .14
7.3 Awareness .14
7.4 Communication .14
7.5 Documented information .14
7.5.1 General.14
7.5.2 Creating and updating documented information .15
7.5.3 Control of documented information .15
7.5.4 Service management system documented information .15
7.6 Knowledge .16
8 Operation of the service management system .16
8.1 Operational planning and control .16
8.2 Service portfolio .16
8.2.1 Service delivery .16
8.2.2 Plan the services .16
8.2.3 Control of parties involved in the service lifecycle .17
8.2.4 Service catalogue management .17
8.2.5 Asset management .17
8.2.6 Configuration management .18
8.3 Relationship and agreement .18
8.3.1 General.18
8.3.2 Business relationship management .19
8.3.3 Service level management .19
8.3.4 Supplier management .20
© ISO/IEC 2018 – All rights reserved iii

8.4 Supply and demand .21
8.4.1 Budgeting and accounting for services .21
8.4.2 Demand management .21
8.4.3 Capacity management .21
8.5 Service design, build and transition .21
8.5.1 Change management .21
8.5.2 Service design and transition .23
8.5.3 Release and deployment management .24
8.6 Resolution and fulfilment .24
8.6.1 Incident management . .24
8.6.2 Service request management . .25
8.6.3 Problem management .25
8.7 Service assurance .25
8.7.1 Service availability management .25
8.7.2 Service continuity management .26
8.7.3 Information security management .26
9 Performance evaluation .27
9.1 Monitoring, measurement, analysis and evaluation .27
9.2 Internal audit .27
9.3 Management review .28
9.4 Service reporting .29
10 Improvement .29
10.1 Nonconformity and corrective action .29
10.2 Continual improvement .29
Bibliography .31
iv © ISO/IEC 2018 – All rights reserved

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/iso/foreword .html.
This document was prepared by ISO/IEC JTC 1, Information technology, SC 40, IT Service Management
and IT Governance.
This third edition cancels and replaces the second edition (ISO/IEC 20000-1:2011) which has been
technically revised.
The main changes compared to the previous edition are as follows.
a) Restructured into the high level structure used for all management system standards (from Annex
SL of the Consolidated ISO Supplement to the ISO/IEC Directives Part 1). This has introduced new
common requirements for context of the organization, planning to achieve objectives and actions to
address risks and opportunities. There are some common requirements that have updated previous
requirements, for example, documented information, resources, competence and awareness.
b) Taken into account the growing trends in service management including topics such as the
commoditisation of services, the management of multiple suppliers by an internal or external
service integrator and the need to determine value of services for customers.
c) Removed some of the detail to concentrate on what to do and allow organizations the freedom of
how to meet the requirements.
d) Included new features such as the addition of requirements about knowledge and planning the
services.
e) Separated out clauses that were previously combined for incident management, service request
management, service continuity management, service availability management, service level
management, service catalogue management, capacity management, demand management.
f) Renamed “Governance of processes operated by other parties” to “Control of parties involved in the
service lifecycle” and updated the requirements to include services and service components as well
as processes. Clarified that the organization cannot demonstrate conformity to the requirements
© ISO/IEC 2018 – All rights reserved v

specified in this document if other parties are used to provide or operate all services, service
components or processes within the scope of the service management system (SMS).
g) Separated Clause 3 (Terms and definitions) into sub-clauses for management system terms and
service management terms. There are many changes to definitions. The key changes include:
1) some new terms have been added for Annex SL, e.g. “objective”, “policy”, and some have been
added specifically for service management, e.g. “asset”, “user”;
2) the term “service provider” has been replaced by “organization” to fit with the Annex SL
common text;
3) the term “internal group” has been replaced by “internal supplier” and the term “supplier” has
been replaced by “external supplier”;
4) the definition of “information security” has been aligned with ISO/IEC 27000. Subsequently
the term “availability” has been replaced by “service availability” to differentiate from the
term “availability” which is now used in the revised definition of “information security”.
h) Minimised the required documented information leaving only key documents such as the service
management plan. Other documented information changes include:
1) removed requirement for documented capacity plan and replaced with requirement to plan
capacity;
2) removed requirement for documented availability plan and replaced with requirement to
document service availability requirements and targets;
3) removed requirement for a configuration management database and replaced with
requirements for configuration information;
4) removed requirement for a release policy and replaced with a requirement to define release
types and frequency;
5) removed requirement for a continual improvement policy and replaced with a requirement to
determine evaluation criteria for opportunities for improvement.
i) Updated and renumbered Figures 2 and 3 to Figures 1 and 2. Removed Figure 1 and references to
Plan-Do-Check-Act as this is not specifically used in Annex SL because many improvement methods
can be used with management system standards.
j) Moved detailed reporting requirements from the service reporting clause into the clauses where
the reports are likely to be produced.
A list of all parts in the ISO/IEC 20000 series can be found on the ISO website.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/members .html.
vi © ISO/IEC 2018 – All rights reserved

Introduction
This document has been prepared to specify requirements for establishing, implementing, maintaining
and continually improving a service management system (SMS). An SMS supports the management of
the service lifecycle, including the planning, design, transition, delivery and improvement of services,
which meet agreed requirements and deliver value for customers, users and the organization delivering
the services.
The adoption of an SMS is a strategic decision for an organization and is influenced by the organization’s
objectives, the governing body, other parties involved in the service lifecycle and the need for effective
and resilient services.
Implementation and operation of an SMS provides ongoing visibility, control of services and continual
improvement, leading to greater effectiveness and efficiency. Improvement for service management
applies to the SMS and the services.
This document is intentionally independent of specific guidance. The organization can use a combination
of generally accepted frameworks and its own experience. The requirements specified in this document
align with commonly used improvement methodologies. Appropriate tools for service management can
be used to support the SMS.
ISO/IEC 20000-2 provides guidance on the application of service management systems including
examples of how to meet the requirements specified in this document. ISO/IEC 20000-10 provides
information on all of the parts of the ISO/IEC 20000 series, benefits, misperceptions and other related
standards. ISO/IEC 20000-10 lists the terms and definitions included in this document in addition to
terms not used in this document but used in other parts of the ISO/IEC 20000 series.
The clause structure (i.e. clause sequence), terms in 3.1 and many of the requirements are taken from
Annex SL of the Consolidated ISO Supplement to the ISO/IEC Directives Part 1, known as the common
high level structure (HLS) for management system standards. The adoption of the HLS enables an
organization to align or integrate multiple management system standards. For example, an SMS
can be integrated with a quality management system based on ISO 9001 or an information security
management system based on ISO/IEC 27001.
Figure 1 illustrates an SMS showing the clause content of this document. It does not represent a
structural hierarchy, sequence or authority levels. There is no requirement in this document for its
structure to be applied to an organization’s SMS. There is no requirement for the terms used by an
organization to be replaced by the terms used in this document. Organizations can choose to use terms
that suit their operations.
The structure of clauses is intended to provide a coherent presentation of requirements, rather than
a model for documenting an organization’s policies, objectives and processes. Each organization can
choose how to combine the requirements into processes. The relationship between each organization
and its customers, users and other interested parties influences how the processes are implemented.
However, an SMS as designed by an organization, cannot exclude any of the requirements specified in
this document.
© ISO/IEC 2018 – All rights reserved vii

Figure 1 — Service management system
viii © ISO/IEC 2018 – All rights reserved

INTERNATIONAL STANDARD ISO/IEC 20000-1:2018(E)
Information technology — Service management —
Part 1:
Service management system requirements
1 Scope
1.1 General
This document specifies requirements for an organization to establish, implement, maintain and
continually improve a service management system (SMS). The requirements specified in this document
include the planning, design, transition, delivery and improvement of services to meet the service
requirements and deliver value. This document can be used by:
a) a customer seeking services and requiring assurance regarding the quality of those services;
b) a customer requiring a consistent approach to the service lifecycle by all its service providers,
including those in a supply chain;
c) an organization to demonstrate its capability for the planning, design, transition, delivery and
improvement of services;
d) an organization to monitor, measure and review its SMS and the services;
e) an organization to improve the planning, design, transition, delivery and improvement of services
through effective implementation and operation of an SMS;
f) an organization or other party performing conformity assessments against the requirements
specified in this document;
g) a provider of training or advice in service management.
The term “service” as used in this document refers to the service or services in the scope of the SMS.
The term “organization” as used in this document refers to the organization in the scope of the SMS that
manages and delivers services to customers. The organization in the scope of the SMS can be part of
a larger organization, for example, a department of a large corporation. An organization or part of an
organization that manages and delivers a service or services to internal or external customers can also
be known as a service provider. Any use of the terms “service” or “organization” with a different intent
is distinguished clearly in this document.
1.2 Application
All requirements specified in this document are generic and are intended to be applicable to all
organizations, regardless of the organization’s type or size, or the nature of the services delivered.
Exclusion of any of the requirements in Clauses 4 to 10 is not acceptable when the organization claims
conformity to this document, irrespective of the nature of the organization.
Conformity to the requirements specified in this document can be demonstrated by the organization
itself showing evidence of meeting those requirements.
The organization itself demonstrates conformity to Clauses 4 and 5. However, the organization can be
supported by other parties. For example, another party can conduct internal audits on behalf of the
organization or support the preparation of the SMS.
© ISO/IEC 2018 – All rights reserved 1

Alternatively, the organization can show evidence of retaining accountability for the requirements
specified in this document and demonstrating control when other parties are involved in meeting the
requirements in Clauses 6 to 10 (see 8.2.3). For example, the organization can demonstrate evidence of
controls for another party who is providing infrastructure service components or operating the service
desk including the incident management process.
The organization cannot demonstrate conformity to the requirements specified in this document if
other parties are used to provide or operate all services, service components or processes within the
scope of the SMS.
The scope of this document excludes the specification for products or tools. However, this document can
be used to help the development or acquisition of products or tools that support the operation of an SMS.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http: //www .electropedia .org/
— ISO Online browsing platform: available at https: //www .iso .org/obp
3.1 Terms specific to management system standards
3.1.1
audit
systematic, independent and documented process (3.1.18) for obtaining audit evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled
Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),
and it can be a combined audit (combining two or more disciplines).
Note 2 to entry: An internal audit is conducted by the organization (3.1.14) itself, or by an external party on
its behalf.
Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.
3.1.2
competence
ability to apply knowledge and skills to achieve intended results
3.1.3
conformity
fulfilment of a requirement (3.1.19)
Note 1 to entry: Conformity relates to requirements in this document as well as the organization’s SMS
requirements.
Note 2 to entry: The original Annex SL definition has been modified by adding Note 1 to entry.
3.1.4
continual improvement
recurring activity to enhance performance (3.1.16)
2 © ISO/IEC 2018 – All rights reserved

3.1.5
corrective action
action to eliminate the cause or reduce the likelihood of recurrence of a detected nonconformity (3.1.12)
or other undesirable situation
Note 1 to entry: The original Annex SL definition has been changed by adding text to the original “action to
eliminate the cause of a nonconformity and to prevent recurrence”.
3.1.6
documented information
information required to be controlled and maintained by an organization (3.1.14) and the medium on
which it is contained
EXAMPLE Policies (3.1.17), plans, process descriptions, procedures (3.2.11), service level agreements (3.2.20)
or contracts.
Note 1 to entry: Documented information can be in any format and media and from any source.
Note 2 to entry: Documented information can refer to:
— the management system (3.1.9), including related processes (3.1.18);
— information created in order for the organization to operate (documentation);
— evidence of results achieved (records (3.2.12)).
Note 3 to entry: The original Annex SL definition has been modified by adding examples.
3.1.7
effectiveness
extent to which planned activities are realized and planned results achieved
3.1.8
interested party
person or organization (3.1.14) that can affect, be affected by, or perceive itself to be affected by a
decision or activity related to the SMS (3.2.23) or the services (3.2.15)
Note 1 to entry: An interested party can be internal or external to the organization.
Note 2 to entry: Interested parties can include parts of the organization outside the scope of the SMS, customers
(3.2.3), users (3.2.28), community, external suppliers (3.2.4), regulators, public sector bodies, nongovernment
organizations, investors or employees.
Note 3 to entry: Where interested parties are specified in the requirements (3.1.19) of this document, the
interested parties can differ depending on the context of the requirement.
Note 4 to entry: The original Annex SL definition has been modified by deleting the admitted term “stakeholder”,
adding “related to the SMS or the services” to the definition and by adding Notes 1, 2 and 3 to entry.
3.1.9
management system
set of interrelated or interacting elements of an organization (3.1.14) to establish policies (3.1.17) and
objectives (3.1.13) and processes (3.1.18) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines.
Note 2 to entry: The management system elements include the organization’s structure, roles and responsibilities,
planning, operation, policies, objectives, plans, processes and procedures (3.2.11).
Note 3 to entry: The scope of a management system may include the whole of the organization, specific and
identified functions of the organization, specific and identified sections of the organization, or one or more
functions across a group of organizations.
© ISO/IEC 2018 – All rights reserved 3

Note 4 to entry: The original Annex SL definition has been modified by clarifying that the system is a management
system and listing further elements in Note 2 to entry.
3.1.10
measurement
process (3.1.18) to determine a value
3.1.11
monitoring
determining the status of a system, a process (3.1.18) or an activity
Note 1 to entry: To determine the status there may be a need to check, supervise or critically observe.
3.1.12
nonconformity
non-fulfilment of a requirement (3.1.19)
Note 1 to entry: Nonconformity relates to requirements in this document as well as the organization’s SMS
requirements.
3.1.13
objective
result to be achieved
Note 1 to entry: An objective can be strategic, tactical, or operational.
Note 2 to entry: Objectives can relate to different disciplines [such as financial, health and safety, service
management (3.2.22) and environmental goals] and can apply at different levels [such as strategic, organization-
wide, service (3.2.15), project, product and process (3.1.18)].
Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended outcome, a purpose, an
operational criterion, as a service management objective or by the use of other words with similar meaning (e.g.
aim, goal, or target).
Note 4 to entry: In the context of an SMS (3.2.23), service management objectives are set by the organization,
consistent with the service management policy (3.1.17), to achieve specific results.
Note 5 to entry: The original Annex SL definition has been modified by adding “service management” and
“service” to Note 2 to entry.
3.1.14
organization
person or group of people that has its own functions with responsibilities, authorities and relationships
to achieve its objectives (3.1.13)
Note 1 to entry: The concept of organization includes, but is not limited to sole-trader, company, corporation, firm,
enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated
or not, public or private.
Note 2 to entry: An organization or part of an organization that manages and delivers a service (3.2.15) or
services to internal or external customers (3.2.3) can be known as a service provider (3.2.24).
Note 3 to entry: If the scope of the SMS (3.2.23) covers only part of an organization, then organization, when used
in this document, refers to the part of the organization that is within the scope of the SMS. Any use of the term
organization with a different intent is distinguished clearly.
Note 4 to entry: The original Annex SL definition has been modified by adding Notes 2 and 3 to entry.
4 © ISO/IEC 2018 – All rights reserved

3.1.15
outsource, verb
make an arrangement where an external organization (3.1.14) performs part of an organization’s
function or process (3.1.18)
Note 1 to entry: An external organization is outside the scope of the SMS (3.2.23), although the outsourced
function or process, is within the scope.
3.1.16
performance
measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.1.18), products, services
(3.2.15), systems or organizations (3.1.14).
Note 3 to entry: The original Annex SL definition has been modified by adding “services” to Note 2 to entry.
3.1.17
policy
intentions and direction of an organization (3.1.14) as formally expressed by its top management (3.1.21)
3.1.18
process
set of interrelated or interacting activities that use inputs to deliver an intended result
Note 1 to entry: Whether the “intended result” of a process is called output, product or service (3.2.15) depends
on the context of the reference.
Note 2 to entry: Inputs to a process are generally the outputs of other processes and outputs of a process are
generally the inputs to other processes.
Note 3 to entry: Two or more interrelated and interacting processes in series can also be referred to as a process.
Note 4 to entry: Processes in an organization (3.1.14) are generally planned and carried out under controlled
conditions to add value.
Note 5 to entry: The original Annex SL definition has been changed from “set of interrelated or interacting activities
which transforms inputs into outputs”. The original Annex SL definition has also been modified by adding Notes 1
to 4 to entry. The revised definition and Notes 1 to 4 to entry are sourced from ISO 9000:2015, 3.4.1.
3.1.19
requirement
need or expectation that is stated, generally implied or obligatory
Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization (3.1.14) and
interested parties (3.1.8) that the need or expectation under consideration is implied.
Note 2 to entry: A specified requirement is one that is stated, for example, in documented information (3.1.6).
Note 3 to entry: In the context of an SMS (3.2.23), service requirements (3.2.26) are documented and agreed rather
than generally implied. There can also be other requirements such as legal and regulatory requirements.
Note 4 to entry: The original Annex SL definition has been modified by adding Note 3 to entry.
3.1.20
risk
effect of uncertainty
Note 1 to entry: An effect is a deviation from the expected — positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to understanding or
knowledge of, an event, its consequence, or likelihood.
© ISO/IEC 2018 – All rights reserved 5

Note 3 to entry: Risk is often characterized by reference to potential events (as defined in ISO Guide 73:2009,
3.5.1.3) and consequences (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including
changes in circumstances) and the associated likelihood (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence.
3.1.21
top management
person or group of people who directs and controls an organization (3.1.14) at the highest level
Note 1 to entry: Top management has the power to delegate authority and provide resources within the
organization.
Note 2 to entry: If the scope of the management system (3.1.9) covers only part of an organization then top
management refers to those who direct and control that part of the organization.
3.2 Terms specific to service management
3.2.1
asset
item, thing or entity that has potential or actual value to an organization (3.1.14)
Note 1 to entry: Value can be tangible or intangible, financial or non-financial, and includes consideration of risks
(3.1.20) and liabilities. It can be positive or negative at different stages of the asset life.
Note 2 to entry: Physical assets usually refer to equipment, inventory and properties owned by the organization.
Physical assets are the opposite of intangible assets, which are non-physical assets such as leases, brands, digital
assets, use rights, licences, intellectual property rights, reputation or agreements.
Note 3 to entry: A grouping of assets referred to as an asset system could also be considered as an asset.
Note 4 to entry: An asset can also be a configuration item (3.2.2). Some configuration items are not assets.
[SOURCE: ISO/IEC 19770-5:2015, 3.2, modified — Note 4 to entry contains new content.]
3.2.2
configuration item
CI
element that needs to be controlled in order to deliver a service (3.2.15) or services
3.2.3
customer
organization (3.1.14) or part of an organization that receives a service (3.2.15) or services
EXAMPLE Consumer, client, beneficiary, sponsor, purchaser.
Note 1 to entry: A customer can be internal or external to the organization delivering the service or services.
Note 2 to entry: A customer can also be a user (3.2.28). A customer can also act as a supplier.
3.2.4
external supplier
another party that is external to the organization that enters into a contract to contribute to the
planning, design, transition (3.2.27), delivery or improvement of a service (3.2.15), service component
(3.2.18) or process (3.1.18)
Note 1 to entry: External suppliers include designated lead suppliers but not their sub-contracted suppliers.
Note 2 to entry: If the organization in the scope of the SMS is part of a larger organization, the other party is
external to the larger organization.
6 © ISO/IEC 2018 – All rights reserved

3.2.5
incident
unplanned interruption to a service (3.2.15), a reduction in the quality of a service or an event that has
not yet impacted the service to the customer (3.2.3) or user (3.2.28)
3.2.6
information security
preservation of confidentiality, integrity and availability of information
Note 1 to entry: In addition, other properties such as authenticity, accountability, non-repudiation and reliability
can also be involved.
[SOURCE: ISO/IEC 27000:2018, 3.28]
3.2.7
information security incident
single or a series of unwanted or unexpected information security (3.2.6) events that have a significant
probability of compromising business operations and threatening information security
[SOURCE: ISO/IEC 27000:2018, 3.31]
3.2.8
internal supplier
part of a larger organization (3.1.14) that is outside the scope of the SMS (3.2.23) that enters into a
documented agreement to contribute to the planning, design, transition (3.2.27), delivery or
improvement of a service (3.2.15), service component (3.2.18) or process (3.1.18)
EXAMPLE Procurement, infrastructure, finance, human resources, facilities.
Note 1 to entry: The internal supplier and the organization in the scope of the SMS are both part of the same
larger organization.
3.2.9
known error
problem (3.2.10) that has an identified root cause or a method of reducing or eliminating its impact on a
service (3.2.15)
3.2.10
problem
cause of one or more actual or potential incidents (3.2.5)
3.2.11
procedure
specified way to carry out an activity or a process (3.1.18)
Note 1 to entry: Procedures can be documented or not.
[SOURCE: ISO 9000:2015, 3.4.5]
3.2.12
record, noun
document stating results achieved or providing evidence of activities performed
EXAMPLE Audit (3.1.1) reports, incident (3.2.5) details, list of training delegates, minutes of meetings.
Note 1 to entry: Records can be used, for example, to formalize traceability and to provide evidence of verification,
preventive action and corrective action (3.1.5).
Note 2 to entry: Generally, records need not be under revision control.
[SOURCE: ISO 9000:2015, 3.8.10, modified — EXAMPLE has been added.]
© ISO/IEC 2018 – All rights reserved 7

3.2.13
release, noun
collection of one or more new or changed services (3.2.15) or service components (3.2.18) deployed into
the live environment as a result of one or more changes
3.2.14
request for change
proposal for a change to be made to a service (3.2.15), service component (3.2.18) or the SMS (3.2.23)
Note 1 to entry: A change to a service includes the provision of a new service, transfer of a service or the removal
of a service that is no longer required.
3.2.15
service
means of delivering value for the customer (3.2.3) by facilitating outcomes the customer wa
...

INTERNATIONAL ISO/IEC
STANDARD 20000-1
Redline version
compares Third edition to
Second edition
Information technology — Service
management —
Part 1:
Service management system
requirements
Technologies de l'information — Gestion des services —
Partie 1: Exigences du système de management des services
Reference number
ISO/IEC 20000-1:redline:2018(E)
©
ISO/IEC 2018
ISO/IEC 20000-1:redline:2018(E)

IMPORTANT — PLEASE NOTE
This is a mark-up copy and uses the following colour coding:
Text example 1 — indicates added text (in green)
Text example 2 — indicates removed text (in red)
— indicates added graphic figure
— indicates removed graphic figure
1.x . — Heading numbers containg modifications are highlighted in yellow in
the Table of Contents
DISCLAIMER
This Redline version provides you with a quick and easy way to compare the main changes
between this edition of the standard and its previous edition. It doesn’t capture all single
changes such as punctuation but highlights the modifications providing customers with
the most valuable information. Therefore it is important to note that this Redline version is
not the official ISO standard and that the users must consult with the clean version of the
standard, which is the official standard, for implementation purposes.
© ISO/IEC 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

Contents Page
Foreword .vi
Introduction .ix
1 Scope . 1
1.1 General . 1
1.2 Application . 2
2 Normative references . 3
3 Terms and definitions . 3
3.1 Terms specific to management system standards . 8
3.2 Terms specific to service management .12
4 Context of the organization .15
4.1 Understanding the organization and its context .15
4.2 Understanding the needs and expectations of interested parties .16
4.3 Determining the scope of the service management system .16
4.4 Service management system.16
5 Leadership .16
5.1 Leadership and commitment .16
5.2 Policy .17
5.2.1 Establishing the service management policy .17
5.2.2 Communicating the service management policy .17
5.3 Organizational roles, responsibilities and authorities.17
4 6 Service management system general requirements Planning .17
4.1 6.1 Management responsibility Actions to address risks and opportunities.17
4.1.1 Management commitment .17
4.1.2 Service management policy .18
4.1.3 Authority, responsibility and communication .18
4.1.4 Management representative .18
4.2 6.2 Governance of processes operated by other parties Service management objectives
and planning to achieve them .19
6.2.1 Establish objectives .19
6.2.2 Plan to achieve objectives .20
4.3 Documentation management .20
4.3.1 Establish and maintain documents .20
4.3.2 Control of documents .20
4.3.3 Control of records .21
4.4 Resource management .21
4.4.1 Provision of resources . .21
4.4.2 Human resources.21
4.5 6.3 Establish and improve the SMS Plan the service management system .21
4.5.1 Define scope .21
4.5.2 Plan the SMS (Plan) .22
4.5.3 Implement and operate the SMS (Do) .22
4.5.4 Monitor and review the SMS (Check) .22
4.5.5 Maintain and improve the SMS (Act) .24
5 7 Design and transition of new or changed services Support of the service
management system .25
5.1 General .25
5.2 7.1 Plan new or changed services Resources .25
5.3 7.2 Design and development of new or changed services Competence .26
7.3 Awareness .27
7.4 Communication .27
© ISO/IEC 2018 – All rights reserved iii

ISO/IEC 20000-1:redline:2018(E)

7.5 Documented information .27
7.5.1 General.27
7.5.2 Creating and updating documented information .27
7.5.3 Control of documented information .28
7.5.4 Service management system documented information .28
5.4 7.6 Transition of new or changed services Knowledge .28
6 Service delivery processes .29
6.1 Service level management.29
6.2 Service reporting .29
6.3 Service continuity and availability management .30
6.3.1 Service continuity and availability requirements .30
6.3.2 Service continuity and availability plans .30
6.3.3 Service continuity and availability monitoring and testing .30
6.4 Budgeting and accounting for services .31
6.5 Capacity management .31
6.6 Information security management .32
6.6.1 Information security policy .32
6.6.2 Information security controls.32
6.6.3 Information security changes and incidents .32
7 Relationship processes .33
7.1 Business relationship management .33
7.2 Supplier management .33
8 Resolution processes .34
8.1 Incident and service request management .34
8.2 Problem management.35
9 8 Control processes Operation of the service management system .36
8.1 Operational planning and control .36
9.1 8.2 Configuration management Service portfolio .36
8.2.1 Service delivery .37
8.2.2 Plan the services .37
8.2.3 Control of parties involved in the service lifecycle .37
8.2.4 Service catalogue management .38
8.2.5 Asset management .38
8.2.6 Configuration management .38
8.3 Relationship and agreement .38
8.3.1 General.38
8.3.2 Business relationship management .39
8.3.3 Service level management .40
8.3.4 Supplier management .40
8.4 Supply and demand .41
8.4.1 Budgeting and accounting for services .41
8.4.2 Demand management .41
8.4.3 Capacity management .41
9.2 8.5 Change management Service design, build and transition .41
8.5.1 Change management .42
8.5.2 Service design and transition .43
8.5.3 Release and deployment management .44
9.3 8.6 Release and deployment management Resolution and fulfilment .45
8.6.1 Incident management . .45
8.6.2 Service request management . .46
8.6.3 Problem management .46
8.7 Service assurance .47
8.7.1 Service availability management .47
8.7.2 Service continuity management .47
8.7.3 Information security management .47
iv © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

9 Performance evaluation .48
9.1 Monitoring, measurement, analysis and evaluation .48
9.2 Internal audit .49
9.3 Management review .49
9.4 Service reporting .50
10 Improvement .50
10.1 Nonconformity and corrective action .50
10.2 Continual improvement .51
Bibliography .52
© ISO/IEC 2018 – All rights reserved v

ISO/IEC 20000-1:redline:2018(E)

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
International Standards areThe procedures used to develop this document and those intended for
its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different
approval criteria needed for the different types of document should be noted. This document was
drafted in accordance with the rules given ineditorial rules of the ISO/IEC Directives, Part 2 (see www
.iso .org/directives).
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies
casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/iso/foreword .html.
This document was prepared by ISO/IEC JTC 1, Information technology, SC 40, IT Service Management
and IT Governance.
ISO/IEC 20000-1 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 7, Software and systems engineering. This secondthird edition cancels and replaces
the firstsecond edition (ISO/IEC 20000-1:20052011) which has been technically revised. The main
differences are as follows:
The main changes compared to the previous edition are as follows.
— closer alignment to ISO 9001;
— a) closer alignment to ISO/IEC 27001;Restructured into the high level structure used for all
management system standards (from Annex SL of the Consolidated ISO Supplement to the
ISO/IEC Directives Part 1). This has introduced new common requirements for context of the
organization, planning to achieve objectives and actions to address risks and opportunities.
There are some common requirements that have updated previous requirements, for example,
documented information, resources, competence and awareness.
— b) change of terminology to reflect international usage;Taken into account the growing trends in
service management including topics such as the commoditisation of services, the management of
multiple suppliers by an internal or external service integrator and the need to determine value of
services for customers.
vi © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

c) Removed some of the detail to concentrate on what to do and allow organizations the freedom of
how to meet the requirements.
— d) addition of many more definitions, updates to some definitions and removal of two
definitions;Included new features such as the addition of requirements about knowledge and
planning the services.
— e) introduction of the term “service management system”;Separated out clauses that were
previously combined for incident management, service request management, service continuity
management, service availability management, service level management, service catalogue
management, capacity management, demand management.
— combining Clauses 3 and 4 of ISO/IEC 20000-1:2005 to put all management system requirements
into one clause;
— clarification of the requirements for the governance of processes operated by other parties;
— f) clarification of the requirements for defining theRenamed “Governance of processes operated by
other parties” to “Control of parties involved in the service lifecycle” and updated the requirements
to include services and service components as well as processes. Clarified that the organization
cannot demonstrate conformity to the requirements specified in this document if other parties are
used to provide or operate all services, service components or processes within the scope of the
SMS;service management system (SMS).
g) Separated Clause 3 (Terms and definitions) into sub-clauses for management system terms and
service management terms. There are many changes to definitions. The key changes include:
1) some new terms have been added for Annex SL, e.g. “objective”, “policy”, and some have been
added specifically for service management, e.g. “asset”, “user”;
2) the term “service provider” has been replaced by “organization” to fit with the Annex SL
common text;
3) the term “internal group” has been replaced by “internal supplier” and the term “supplier” has
been replaced by “external supplier”;
4) the definition of “information security” has been aligned with ISO/IEC 27000. Subsequently
the term “availability” has been replaced by “service availability” to differentiate from the
term “availability” which is now used in the revised definition of “information security”.
— h) clarification that the PDCA methodology applies to the SMS, includingMinimised the required
documented information leaving only key documents such as the service management processes,
and the services;plan. Other documented information changes include:
1) removed requirement for documented capacity plan and replaced with requirement to plan
capacity;
2) removed requirement for documented availability plan and replaced with requirement to
document service availability requirements and targets;
3) removed requirement for a configuration management database and replaced with
requirements for configuration information;
4) removed requirement for a release policy and replaced with a requirement to define release
types and frequency;
5) removed requirement for a continual improvement policy and replaced with a requirement to
determine evaluation criteria for opportunities for improvement.
i) Updated and renumbered Figures 2 and 3 to Figures 1 and 2. Removed Figure 1 and references to
Plan-Do-Check-Act as this is not specifically used in Annex SL because many improvement methods
can be used with management system standards.
© ISO/IEC 2018 – All rights reserved vii

ISO/IEC 20000-1:redline:2018(E)

— j) introduction of new requirements for the design and transition of new or changed servicesMoved
detailed reporting requirements from the service reporting clause into the clauses where the
reports are likely to be produced.
A list of all parts in the ISO/IEC 20000 series consists of the following parts, under the general titlecan
be found on the Information technology — Service management:I SO website.
— Part 1: Service management system requirements
1)
— Part 2: Guidance on the application of service management systems
— Part 3: Guidance on scope definition and applicability of ISO/IEC 20000-1 [Technical Report]
— Part 4: Process reference model [Technical Report]
— Part 5: Exemplar implementation plan for ISO/IEC 20000-1 [Technical Report]
A process assessment model for service management will form the subject of a future Part 8Any
feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/members .html.
1) To be published. (Technical revision of ISO/IEC 20000-2:2005.)
viii © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

Introduction
The requirements in this part of ISO/IEC 20000 include the design, transition, delivery and improvement
of services that fulfil service requirements and provide value for both the customer and the service
provider. This partThis document has been prepared to specify requirements for establishing,
implementing, maintaining and continually improving a service management system (SMS). An SMS
supports the management of the service lifecycle, including the planning, design, transition, delivery
and improvement of ISO/IEC 20000 requires an integrated process approach when the service
provider plans, establishes, implements, operates, monitors, reviews, maintains and improves a service
management system (SMS)services, which meet agreed requirements and deliver value for customers,
users and the organization delivering the services.
The adoption of an SMS is a strategic decision for an organization and is influenced by the organization’s
objectives, the governing body, other parties involved in the service lifecycle and the need for effective
and resilient services.
Co-ordinated integration and implementationImplementation and operation of an SMS provides
ongoing control and opportunities forvisibility, control of services and continual improvement, leading
to greater effectiveness and efficiency. The operation of processes as specified in this part of ISO/
IEC 20000 requires personnel to be well organized and co-ordinated. Appropriate tools can be used to
enable the processes to be effective and efficientImprovement for service management applies to the
SMS and the services.
The most effective service providers consider the impact on the SMS through all stages of the service
lifecycle, from strategy through design, transition and operation, including continual improvement.
This part of ISO/IEC 20000 requires the application of the methodology known as “Plan-Do-Check-Act”
(PDCA) to all parts of the SMS and the services. The PDCA methodology, as applied in this part of ISO/
IEC 20000, can be briefly described as follows.
Plan: establishing, documenting and agreeing the SMS. The SMS includes the policies, objectives, plans
and processes to fulfil the service requirements.
Do: implementing and operating the SMS for the design, transition, delivery and improvement of the
services.
Check: monitoring, measuring and reviewing the SMS and the services against the policies, objectives,
plans and service requirements and reporting the results.
Act: taking actions to continually improve performance of the SMS and the services.
When used within an SMS, the following are the most important aspects of an integrated process
approach and the PDCA methodology:T his document is intentionally independent of specific guidance.
The organization can use a combination of generally accepted frameworks and its own experience.
The requirements specified in this document align with commonly used improvement methodologies.
Appropriate tools for service management can be used to support the SMS.
a) understanding and fulfilling the service requirements to achieve customer satisfaction;
b) establishing the policy and objectives for service management;
c) designing and delivering services based on the SMS that add value for the customer;
d) monitoring, measuring and reviewing performance of the SMS and the services;
e) continually improving the SMS and the services based on objective measurements.
Figure 1 illustrates how ISO/IEC 20000-2the PDCA methodology can be applied to the SMS, including the
service management processes provides guidance on the application of service management systems
including examples of how to meet the requirements specified in Clauses 5 to 9, and the services.
Each elementthis document. ISO/IEC 20000-10of the PDCA methodology is a vital part of a successful
© ISO/IEC 2018 – All rights reserved ix

ISO/IEC 20000-1:redline:2018(E)

implementation of an SMS provides information on all of the parts of the ISO/IEC 20000 series. The
improvement process used in this part of, benefits, misperceptions and other related standards.
ISO/IEC 20000 is based on the PDCA methodologyISO/IEC 20000-10 lists the terms and definitions
included in this document in addition to terms not used in this document but used in other parts of the
ISO/IEC 20000 series.
Figure 1 — PDCA methodology applied to service management
This partThe clause structure (i.e. clause sequence), terms in 3.1 and many of ISO/IEC 20000 enables
a service provider to integrate its SMS with other management systems in the service provider's
organizationthe requirements are taken from Annex SL of the Consolidated ISO Supplement to the
ISO/IEC Directives Part 1, known as the common high level structure (HLS) for management system
standards. The adoption of an integrated process approach and the PDCA methodology enables the
service providerthe HLS enables an organization to align or fully integrate multiple management
system standards. For example, an SMS can be integrated with a quality management system based on
ISO 9001 or an information security management system based on ISO/IEC 27001.
ISO/IEC 20000 is intentionally independent of specific guidance. The service provider can use a
combination of generally accepted guidance and its own experience.
Users ofFigure 1 an International Standard are responsible for its correct application. An International
Standard does not purport to include all necessary statutory and regulatory requirements and
contractual obligations of the service provider. Conformity to an International Standard does not of
itself confer immunity from statutory and regulatory requirementsillustrates an SMS showing the
clause content of this document. It does not represent a structural hierarchy, sequence or authority
levels. There is no requirement in this document for its structure to be applied to an organization’s SMS.
There is no requirement for the terms used by an organization to be replaced by the terms used in this
document. Organizations can choose to use terms that suit their operations.
For the purposes of research on service management standards, users are encouraged to share their
views onThe structure of clauses is intended to provide a coherent presentation of requirements, ISO/
IEC 20000-1 and their priorities for changes to the rest ofrather than a model for documenting an
organization’s policies, objectives and processes. Each organization can choose how to combine the ISO/
IEC 20000 series. Click on the link below to take part in the online surveyrequirements into processes.
The relationship between each organization and its customers, users and other interested parties
influences how the processes are implemented. However, an SMS as designed by an organization,
cannot exclude any of the requirements specified in this document.
ISO/IEC 20000-1 online survey
x © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

Figure 1 — Service management system
© ISO/IEC 2018 – All rights reserved xi

INTERNATIONAL STANDARD ISO/IEC 20000-1:redline:2018(E)
Information technology — Service management —
Part 1:
Service management system requirements
1 Scope
1.1 General
This part of ISO/IEC 20000 isdocument specifies requirements for an organization to establish,
implement, maintain and continually improve a service management system (SMS) standard. It
specifies requirements for the service provider to plan, establish, implement, operate, monitor, review,
maintain and improve an SMS. The requirements include the. The requirements specified in this
document include the planning, design, transition, delivery and improvement of services to fulfilmeet
the service requirements and deliver value. This part of ISO/IEC 20000document can be used by:
a) an organizationa customer seeking services from service providers and requiring assurance that
their service requirements will be fulfilledregarding the quality of those services;
b) an organization that requiresa customer requiring a consistent approach to the service lifecycle by
all its service providers, including those in a supply chain;
c) a service provider that intendsan organization to demonstrate its capability for the planning,
design, transition, delivery and improvement of services that fulfil service requirements;
d) a service provideran organization to monitor, measure and review its service management
processes andSMS and the services;
e) a service provideran organization to improve the planning, design, transition and delivery, delivery
and improvement of services through effective implementation and operation of an SMS;
f) an assessor or auditor as the criteria for a conformity assessment of a service provider's SMS to
the requirements in this part oforganization or other party performing conformity assessments
against the requirements specified in this ISO/IEC 20000.document;
g) a provider of training or advice in service management.
Figure 2 illustrates an SMS, including the service management processes. The service management
processes and the relationships between the processes can be implemented in different ways by
different service providers. The nature of the relationship between a service provider and the customer
will influence how the service management processes are implementedThe term “service” as used in
this document refers to the service or services in the scope of the SMS. The term “organization” as used
in this document refers to the organization in the scope of the SMS that manages and delivers services
to customers. The organization in the scope of the SMS can be part of a larger organization, for example,
a department of a large corporation. An organization or part of an organization that manages and
delivers a service or services to internal or external customers can also be known as a service provider.
Any use of the terms “service” or “organization” with a different intent is distinguished clearly in this
document.
© ISO/IEC 2018 – All rights reserved 1

ISO/IEC 20000-1:redline:2018(E)

Figure 2 — Service management system
1.2 Application
All requirements specified in this part of ISO/IEC 20000document are generic and are intended to be
applicable to all service providersorganizations, regardless of type, size andthe organization’s type
or size, or the nature of the services delivered. Exclusion of any of the requirements in Clauses 4 to
910 is not acceptable when a service providerthe organization claims conformity to this part of ISO/
IEC 20000document, irrespective of the nature of the service provider's organization.
Conformity to the requirements specified in Clause 4this document can only be demonstrated by a
service providerthe organization itself showing evidence of fulfilling all of the requirements in meeting
those requirementsClause 4. A service provider cannot rely on evidence of the governance of processes
operated by other parties for the requirements in Clause 4.
The organization itself demonstrates conformity to Clauses 4 and 5. However, the organization can be
supported by other parties. For example, another party can conduct internal audits on behalf of the
organization or support the preparation of the SMS.
Conformity to the requirements in Clauses 5 to 9 can be demonstrated by the service provider showing
evidence of fulfilling all requirements. Alternatively, the service providerorganization can show
evidence of fulfilling the majority of the requirements themselves andretaining accountability for the
requirements specified in this document and demonstrating control when other parties are involved in
meeting the requirements in Clauses 6 to 10 (see 8.2.3evidence of the governance of processes operated
by other parties for those processes, or parts of processes, that the service provider does not operate
directly). For example, the organization can demonstrate evidence of controls for another party who
is providing infrastructure service components or operating the service desk including the incident
management process.
The organization cannot demonstrate conformity to the requirements specified in this document if
other parties are used to provide or operate all services, service components or processes within the
scope of the SMS.
The scope of this part of ISO/IEC 20000document excludes the specification for a product or
toolproducts or tools. However, organizations can use this part ofthis ISO/IEC 20000 to help them
developdocument can be used to help the development or acquisition of products or tools that support
the operation of an SMS.
NOTE ISO/IEC TR 20000-3 provides guidance on scope definition and applicability of this part of ISO/
IEC 20000. This includes further explanation about the governance of processes operated by other parties.
2 © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
No normative references are cited. This clause is included in order to ensure clause numbering is
identical withThere are no normative references in ISO/IEC 20000-2:—, Information technology —
2)
Service management — Part 2: Guidance on the application of service management systems this
document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
3.1
availability
ability of a service or service component to perform its required function at an agreed instant or over
an agreed period of time
Note 1 to entry: Availability is normally expressed as a ratio or percentage of the time that the service or service
component is actually available for use by the customer to the agreed time
...

INTERNATIONAL ISO/IEC
STANDARD 20000-1
Redline version
compares Third edition to
Second edition
Information technology — Service
management —
Part 1:
Service management system
requirements
Technologies de l'information — Gestion des services —
Partie 1: Exigences du système de management des services
Reference number
ISO/IEC 20000-1:redline:2018(E)
©
ISO/IEC 2018
ISO/IEC 20000-1:redline:2018(E)

IMPORTANT — PLEASE NOTE
This is a mark-up copy and uses the following colour coding:
Text example 1 — indicates added text (in green)
Text example 2 — indicates removed text (in red)
— indicates added graphic figure
— indicates removed graphic figure
1.x . — Heading numbers containg modifications are highlighted in yellow in
the Table of Contents
DISCLAIMER
This Redline version provides you with a quick and easy way to compare the main changes
between this edition of the standard and its previous edition. It doesn’t capture all single
changes such as punctuation but highlights the modifications providing customers with
the most valuable information. Therefore it is important to note that this Redline version is
not the official ISO standard and that the users must consult with the clean version of the
standard, which is the official standard, for implementation purposes.
© ISO/IEC 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Fax: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

Contents Page
Foreword .vi
Introduction .ix
1 Scope . 1
1.1 General . 1
1.2 Application . 2
2 Normative references . 3
3 Terms and definitions . 3
3.1 Terms specific to management system standards . 8
3.2 Terms specific to service management .12
4 Context of the organization .15
4.1 Understanding the organization and its context .15
4.2 Understanding the needs and expectations of interested parties .16
4.3 Determining the scope of the service management system .16
4.4 Service management system.16
5 Leadership .16
5.1 Leadership and commitment .16
5.2 Policy .17
5.2.1 Establishing the service management policy .17
5.2.2 Communicating the service management policy .17
5.3 Organizational roles, responsibilities and authorities.17
4 6 Service management system general requirements Planning .17
4.1 6.1 Management responsibility Actions to address risks and opportunities.17
4.1.1 Management commitment .17
4.1.2 Service management policy .18
4.1.3 Authority, responsibility and communication .18
4.1.4 Management representative .18
4.2 6.2 Governance of processes operated by other parties Service management objectives
and planning to achieve them .19
6.2.1 Establish objectives .19
6.2.2 Plan to achieve objectives .20
4.3 Documentation management .20
4.3.1 Establish and maintain documents .20
4.3.2 Control of documents .20
4.3.3 Control of records .21
4.4 Resource management .21
4.4.1 Provision of resources . .21
4.4.2 Human resources.21
4.5 6.3 Establish and improve the SMS Plan the service management system .21
4.5.1 Define scope .21
4.5.2 Plan the SMS (Plan) .22
4.5.3 Implement and operate the SMS (Do) .22
4.5.4 Monitor and review the SMS (Check) .22
4.5.5 Maintain and improve the SMS (Act) .24
5 7 Design and transition of new or changed services Support of the service
management system .25
5.1 General .25
5.2 7.1 Plan new or changed services Resources .25
5.3 7.2 Design and development of new or changed services Competence .26
7.3 Awareness .27
7.4 Communication .27
© ISO/IEC 2018 – All rights reserved iii

ISO/IEC 20000-1:redline:2018(E)

7.5 Documented information .27
7.5.1 General.27
7.5.2 Creating and updating documented information .27
7.5.3 Control of documented information .28
7.5.4 Service management system documented information .28
5.4 7.6 Transition of new or changed services Knowledge .28
6 Service delivery processes .29
6.1 Service level management.29
6.2 Service reporting .29
6.3 Service continuity and availability management .30
6.3.1 Service continuity and availability requirements .30
6.3.2 Service continuity and availability plans .30
6.3.3 Service continuity and availability monitoring and testing .30
6.4 Budgeting and accounting for services .31
6.5 Capacity management .31
6.6 Information security management .32
6.6.1 Information security policy .32
6.6.2 Information security controls.32
6.6.3 Information security changes and incidents .32
7 Relationship processes .33
7.1 Business relationship management .33
7.2 Supplier management .33
8 Resolution processes .34
8.1 Incident and service request management .34
8.2 Problem management.35
9 8 Control processes Operation of the service management system .36
8.1 Operational planning and control .36
9.1 8.2 Configuration management Service portfolio .36
8.2.1 Service delivery .37
8.2.2 Plan the services .37
8.2.3 Control of parties involved in the service lifecycle .37
8.2.4 Service catalogue management .38
8.2.5 Asset management .38
8.2.6 Configuration management .38
8.3 Relationship and agreement .38
8.3.1 General.38
8.3.2 Business relationship management .39
8.3.3 Service level management .40
8.3.4 Supplier management .40
8.4 Supply and demand .41
8.4.1 Budgeting and accounting for services .41
8.4.2 Demand management .41
8.4.3 Capacity management .41
9.2 8.5 Change management Service design, build and transition .41
8.5.1 Change management .42
8.5.2 Service design and transition .43
8.5.3 Release and deployment management .44
9.3 8.6 Release and deployment management Resolution and fulfilment .45
8.6.1 Incident management . .45
8.6.2 Service request management . .46
8.6.3 Problem management .46
8.7 Service assurance .47
8.7.1 Service availability management .47
8.7.2 Service continuity management .47
8.7.3 Information security management .47
iv © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

9 Performance evaluation .48
9.1 Monitoring, measurement, analysis and evaluation .48
9.2 Internal audit .49
9.3 Management review .49
9.4 Service reporting .50
10 Improvement .50
10.1 Nonconformity and corrective action .50
10.2 Continual improvement .51
Bibliography .52
© ISO/IEC 2018 – All rights reserved v

ISO/IEC 20000-1:redline:2018(E)

Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
International Standards areThe procedures used to develop this document and those intended for
its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different
approval criteria needed for the different types of document should be noted. This document was
drafted in accordance with the rules given ineditorial rules of the ISO/IEC Directives, Part 2 (see www
.iso .org/directives).
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies
casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/iso/foreword .html.
This document was prepared by ISO/IEC JTC 1, Information technology, SC 40, IT Service Management
and IT Governance.
ISO/IEC 20000-1 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 7, Software and systems engineering. This secondthird edition cancels and replaces
the firstsecond edition (ISO/IEC 20000-1:20052011) which has been technically revised. The main
differences are as follows:
The main changes compared to the previous edition are as follows.
— closer alignment to ISO 9001;
— a) closer alignment to ISO/IEC 27001;Restructured into the high level structure used for all
management system standards (from Annex SL of the Consolidated ISO Supplement to the
ISO/IEC Directives Part 1). This has introduced new common requirements for context of the
organization, planning to achieve objectives and actions to address risks and opportunities.
There are some common requirements that have updated previous requirements, for example,
documented information, resources, competence and awareness.
— b) change of terminology to reflect international usage;Taken into account the growing trends in
service management including topics such as the commoditisation of services, the management of
multiple suppliers by an internal or external service integrator and the need to determine value of
services for customers.
vi © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

c) Removed some of the detail to concentrate on what to do and allow organizations the freedom of
how to meet the requirements.
— d) addition of many more definitions, updates to some definitions and removal of two
definitions;Included new features such as the addition of requirements about knowledge and
planning the services.
— e) introduction of the term “service management system”;Separated out clauses that were
previously combined for incident management, service request management, service continuity
management, service availability management, service level management, service catalogue
management, capacity management, demand management.
— combining Clauses 3 and 4 of ISO/IEC 20000-1:2005 to put all management system requirements
into one clause;
— clarification of the requirements for the governance of processes operated by other parties;
— f) clarification of the requirements for defining theRenamed “Governance of processes operated by
other parties” to “Control of parties involved in the service lifecycle” and updated the requirements
to include services and service components as well as processes. Clarified that the organization
cannot demonstrate conformity to the requirements specified in this document if other parties are
used to provide or operate all services, service components or processes within the scope of the
SMS;service management system (SMS).
g) Separated Clause 3 (Terms and definitions) into sub-clauses for management system terms and
service management terms. There are many changes to definitions. The key changes include:
1) some new terms have been added for Annex SL, e.g. “objective”, “policy”, and some have been
added specifically for service management, e.g. “asset”, “user”;
2) the term “service provider” has been replaced by “organization” to fit with the Annex SL
common text;
3) the term “internal group” has been replaced by “internal supplier” and the term “supplier” has
been replaced by “external supplier”;
4) the definition of “information security” has been aligned with ISO/IEC 27000. Subsequently
the term “availability” has been replaced by “service availability” to differentiate from the
term “availability” which is now used in the revised definition of “information security”.
— h) clarification that the PDCA methodology applies to the SMS, includingMinimised the required
documented information leaving only key documents such as the service management processes,
and the services;plan. Other documented information changes include:
1) removed requirement for documented capacity plan and replaced with requirement to plan
capacity;
2) removed requirement for documented availability plan and replaced with requirement to
document service availability requirements and targets;
3) removed requirement for a configuration management database and replaced with
requirements for configuration information;
4) removed requirement for a release policy and replaced with a requirement to define release
types and frequency;
5) removed requirement for a continual improvement policy and replaced with a requirement to
determine evaluation criteria for opportunities for improvement.
i) Updated and renumbered Figures 2 and 3 to Figures 1 and 2. Removed Figure 1 and references to
Plan-Do-Check-Act as this is not specifically used in Annex SL because many improvement methods
can be used with management system standards.
© ISO/IEC 2018 – All rights reserved vii

ISO/IEC 20000-1:redline:2018(E)

— j) introduction of new requirements for the design and transition of new or changed servicesMoved
detailed reporting requirements from the service reporting clause into the clauses where the
reports are likely to be produced.
A list of all parts in the ISO/IEC 20000 series consists of the following parts, under the general titlecan
be found on the Information technology — Service management:I SO website.
— Part 1: Service management system requirements
1)
— Part 2: Guidance on the application of service management systems
— Part 3: Guidance on scope definition and applicability of ISO/IEC 20000-1 [Technical Report]
— Part 4: Process reference model [Technical Report]
— Part 5: Exemplar implementation plan for ISO/IEC 20000-1 [Technical Report]
A process assessment model for service management will form the subject of a future Part 8Any
feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/members .html.
1) To be published. (Technical revision of ISO/IEC 20000-2:2005.)
viii © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

Introduction
The requirements in this part of ISO/IEC 20000 include the design, transition, delivery and improvement
of services that fulfil service requirements and provide value for both the customer and the service
provider. This partThis document has been prepared to specify requirements for establishing,
implementing, maintaining and continually improving a service management system (SMS). An SMS
supports the management of the service lifecycle, including the planning, design, transition, delivery
and improvement of ISO/IEC 20000 requires an integrated process approach when the service
provider plans, establishes, implements, operates, monitors, reviews, maintains and improves a service
management system (SMS)services, which meet agreed requirements and deliver value for customers,
users and the organization delivering the services.
The adoption of an SMS is a strategic decision for an organization and is influenced by the organization’s
objectives, the governing body, other parties involved in the service lifecycle and the need for effective
and resilient services.
Co-ordinated integration and implementationImplementation and operation of an SMS provides
ongoing control and opportunities forvisibility, control of services and continual improvement, leading
to greater effectiveness and efficiency. The operation of processes as specified in this part of ISO/
IEC 20000 requires personnel to be well organized and co-ordinated. Appropriate tools can be used to
enable the processes to be effective and efficientImprovement for service management applies to the
SMS and the services.
The most effective service providers consider the impact on the SMS through all stages of the service
lifecycle, from strategy through design, transition and operation, including continual improvement.
This part of ISO/IEC 20000 requires the application of the methodology known as “Plan-Do-Check-Act”
(PDCA) to all parts of the SMS and the services. The PDCA methodology, as applied in this part of ISO/
IEC 20000, can be briefly described as follows.
Plan: establishing, documenting and agreeing the SMS. The SMS includes the policies, objectives, plans
and processes to fulfil the service requirements.
Do: implementing and operating the SMS for the design, transition, delivery and improvement of the
services.
Check: monitoring, measuring and reviewing the SMS and the services against the policies, objectives,
plans and service requirements and reporting the results.
Act: taking actions to continually improve performance of the SMS and the services.
When used within an SMS, the following are the most important aspects of an integrated process
approach and the PDCA methodology:T his document is intentionally independent of specific guidance.
The organization can use a combination of generally accepted frameworks and its own experience.
The requirements specified in this document align with commonly used improvement methodologies.
Appropriate tools for service management can be used to support the SMS.
a) understanding and fulfilling the service requirements to achieve customer satisfaction;
b) establishing the policy and objectives for service management;
c) designing and delivering services based on the SMS that add value for the customer;
d) monitoring, measuring and reviewing performance of the SMS and the services;
e) continually improving the SMS and the services based on objective measurements.
Figure 1 illustrates how ISO/IEC 20000-2the PDCA methodology can be applied to the SMS, including the
service management processes provides guidance on the application of service management systems
including examples of how to meet the requirements specified in Clauses 5 to 9, and the services.
Each elementthis document. ISO/IEC 20000-10of the PDCA methodology is a vital part of a successful
© ISO/IEC 2018 – All rights reserved ix

ISO/IEC 20000-1:redline:2018(E)

implementation of an SMS provides information on all of the parts of the ISO/IEC 20000 series. The
improvement process used in this part of, benefits, misperceptions and other related standards.
ISO/IEC 20000 is based on the PDCA methodologyISO/IEC 20000-10 lists the terms and definitions
included in this document in addition to terms not used in this document but used in other parts of the
ISO/IEC 20000 series.
Figure 1 — PDCA methodology applied to service management
This partThe clause structure (i.e. clause sequence), terms in 3.1 and many of ISO/IEC 20000 enables
a service provider to integrate its SMS with other management systems in the service provider's
organizationthe requirements are taken from Annex SL of the Consolidated ISO Supplement to the
ISO/IEC Directives Part 1, known as the common high level structure (HLS) for management system
standards. The adoption of an integrated process approach and the PDCA methodology enables the
service providerthe HLS enables an organization to align or fully integrate multiple management
system standards. For example, an SMS can be integrated with a quality management system based on
ISO 9001 or an information security management system based on ISO/IEC 27001.
ISO/IEC 20000 is intentionally independent of specific guidance. The service provider can use a
combination of generally accepted guidance and its own experience.
Users ofFigure 1 an International Standard are responsible for its correct application. An International
Standard does not purport to include all necessary statutory and regulatory requirements and
contractual obligations of the service provider. Conformity to an International Standard does not of
itself confer immunity from statutory and regulatory requirementsillustrates an SMS showing the
clause content of this document. It does not represent a structural hierarchy, sequence or authority
levels. There is no requirement in this document for its structure to be applied to an organization’s SMS.
There is no requirement for the terms used by an organization to be replaced by the terms used in this
document. Organizations can choose to use terms that suit their operations.
For the purposes of research on service management standards, users are encouraged to share their
views onThe structure of clauses is intended to provide a coherent presentation of requirements, ISO/
IEC 20000-1 and their priorities for changes to the rest ofrather than a model for documenting an
organization’s policies, objectives and processes. Each organization can choose how to combine the ISO/
IEC 20000 series. Click on the link below to take part in the online surveyrequirements into processes.
The relationship between each organization and its customers, users and other interested parties
influences how the processes are implemented. However, an SMS as designed by an organization,
cannot exclude any of the requirements specified in this document.
ISO/IEC 20000-1 online survey
x © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

Figure 1 — Service management system
© ISO/IEC 2018 – All rights reserved xi

INTERNATIONAL STANDARD ISO/IEC 20000-1:redline:2018(E)
Information technology — Service management —
Part 1:
Service management system requirements
1 Scope
1.1 General
This part of ISO/IEC 20000 isdocument specifies requirements for an organization to establish,
implement, maintain and continually improve a service management system (SMS) standard. It
specifies requirements for the service provider to plan, establish, implement, operate, monitor, review,
maintain and improve an SMS. The requirements include the. The requirements specified in this
document include the planning, design, transition, delivery and improvement of services to fulfilmeet
the service requirements and deliver value. This part of ISO/IEC 20000document can be used by:
a) an organizationa customer seeking services from service providers and requiring assurance that
their service requirements will be fulfilledregarding the quality of those services;
b) an organization that requiresa customer requiring a consistent approach to the service lifecycle by
all its service providers, including those in a supply chain;
c) a service provider that intendsan organization to demonstrate its capability for the planning,
design, transition, delivery and improvement of services that fulfil service requirements;
d) a service provideran organization to monitor, measure and review its service management
processes andSMS and the services;
e) a service provideran organization to improve the planning, design, transition and delivery, delivery
and improvement of services through effective implementation and operation of an SMS;
f) an assessor or auditor as the criteria for a conformity assessment of a service provider's SMS to
the requirements in this part oforganization or other party performing conformity assessments
against the requirements specified in this ISO/IEC 20000.document;
g) a provider of training or advice in service management.
Figure 2 illustrates an SMS, including the service management processes. The service management
processes and the relationships between the processes can be implemented in different ways by
different service providers. The nature of the relationship between a service provider and the customer
will influence how the service management processes are implementedThe term “service” as used in
this document refers to the service or services in the scope of the SMS. The term “organization” as used
in this document refers to the organization in the scope of the SMS that manages and delivers services
to customers. The organization in the scope of the SMS can be part of a larger organization, for example,
a department of a large corporation. An organization or part of an organization that manages and
delivers a service or services to internal or external customers can also be known as a service provider.
Any use of the terms “service” or “organization” with a different intent is distinguished clearly in this
document.
© ISO/IEC 2018 – All rights reserved 1

ISO/IEC 20000-1:redline:2018(E)

Figure 2 — Service management system
1.2 Application
All requirements specified in this part of ISO/IEC 20000document are generic and are intended to be
applicable to all service providersorganizations, regardless of type, size andthe organization’s type
or size, or the nature of the services delivered. Exclusion of any of the requirements in Clauses 4 to
910 is not acceptable when a service providerthe organization claims conformity to this part of ISO/
IEC 20000document, irrespective of the nature of the service provider's organization.
Conformity to the requirements specified in Clause 4this document can only be demonstrated by a
service providerthe organization itself showing evidence of fulfilling all of the requirements in meeting
those requirementsClause 4. A service provider cannot rely on evidence of the governance of processes
operated by other parties for the requirements in Clause 4.
The organization itself demonstrates conformity to Clauses 4 and 5. However, the organization can be
supported by other parties. For example, another party can conduct internal audits on behalf of the
organization or support the preparation of the SMS.
Conformity to the requirements in Clauses 5 to 9 can be demonstrated by the service provider showing
evidence of fulfilling all requirements. Alternatively, the service providerorganization can show
evidence of fulfilling the majority of the requirements themselves andretaining accountability for the
requirements specified in this document and demonstrating control when other parties are involved in
meeting the requirements in Clauses 6 to 10 (see 8.2.3evidence of the governance of processes operated
by other parties for those processes, or parts of processes, that the service provider does not operate
directly). For example, the organization can demonstrate evidence of controls for another party who
is providing infrastructure service components or operating the service desk including the incident
management process.
The organization cannot demonstrate conformity to the requirements specified in this document if
other parties are used to provide or operate all services, service components or processes within the
scope of the SMS.
The scope of this part of ISO/IEC 20000document excludes the specification for a product or
toolproducts or tools. However, organizations can use this part ofthis ISO/IEC 20000 to help them
developdocument can be used to help the development or acquisition of products or tools that support
the operation of an SMS.
NOTE ISO/IEC TR 20000-3 provides guidance on scope definition and applicability of this part of ISO/
IEC 20000. This includes further explanation about the governance of processes operated by other parties.
2 © ISO/IEC 2018 – All rights reserved

ISO/IEC 20000-1:redline:2018(E)

2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
No normative references are cited. This clause is included in order to ensure clause numbering is
identical withThere are no normative references in ISO/IEC 20000-2:—, Information technology —
2)
Service management — Part 2: Guidance on the application of service management systems this
document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
3.1
availability
ability of a service or service component to perform its required function at an agreed instant or over
an agreed period of time
Note 1 to entry: Availability is normally expressed as a ratio or percentage of the time that the service or service
component is actually available for use by the customer to the agreed time
...

NORME ISO/IEC
INTERNATIONALE 20000-1
Troisième édition
2018-09
Technologies de l'information —
Gestion des services —
Partie 1:
Exigences du système de management
des services
Information technology — Service management —
Part 1: Service management system requirements
Numéro de référence
©
ISO/IEC 2018
DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO/IEC 2018
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: [phone]
Fax: [phone]
E-mail: [e-mail]
Web: www.iso.org
Publié en Suisse
ii © ISO/IEC 2018 – Tous droits réservés

Sommaire Page
Avant-propos .v
Introduction .viii
1 Domaine d'application . 1
1.1 Généralités . 1
1.2 Application . 1
2 Références normatives . 2
3 Termes et définitions . 2
3.1 Termes spécifiques aux normes de systèmes de management . 2
3.2 Termes spécifiques à la gestion des services . 6
4 Contexte de l’organisme .10
4.1 Compréhension de l’organisme et de son contexte .10
4.2 Compréhension des besoins et attentes des parties intéressées .10
4.3 Détermination du périmètre d’application du système de management des services .11
4.4 Système de management des services.11
5 Leadership .11
5.1 Leadership et engagement.11
5.2 Politique .12
5.2.1 Établissement de la politique de gestion des services .12
5.2.2 Communication relative à la politique de gestion des services . .12
5.3 Rôles, responsabilités et autorités au sein de l’organisme .12
6 Planification .12
6.1 Actions à mettre en œuvre face aux risques et opportunités .12
6.2 Objectifs de la gestion des services et planification des actions pour les atteindre .13
6.2.1 Établissement des objectifs .13
6.2.2 Planification pour atteindre les objectifs .13
6.3 Planification du système de management des services .14
7 Support du système de management des services.14
7.1 Ressources .14
7.2 Compétences .14
7.3 Sensibilisation .15
7.4 Communication .15
7.5 Informations documentées .15
7.5.1 Généralités .15
7.5.2 Création et mise à jour des informations documentées .15
7.5.3 Maîtrise des informations documentées .16
7.5.4 Informations documentées du système de management des services .16
7.6 Connaissances.17
8 Fonctionnement du système de management des services .17
8.1 Planification et maîtrise opérationnelles .17
8.2 Portefeuille des services .17
8.2.1 Fourniture des services .17
8.2.2 Planification des services .17
8.2.3 Maîtrise des parties impliquées dans le cycle de vie du service.18
8.2.4 Gestion du catalogue de services .18
8.2.5 Gestion des actifs .18
8.2.6 Gestion des configurations .19
8.3 Relations et accords .19
8.3.1 Généralités .19
8.3.2 Gestion des relations commerciales .20
8.3.3 Gestion des niveaux de services .20
8.3.4 Gestion des fournisseurs.21
© ISO/IEC 2018 – Tous droits réservés iii

8.4 Offre et demande .22
8.4.1 Budgétisation et comptabilisation des services .22
8.4.2 Gestion de la demande . .22
8.4.3 Gestion de la capacité .22
8.5 Conception, construction et transition du service .22
8.5.1 Gestion des changements .22
8.5.2 Conception et transition du service .24
8.5.3 Gestion des mises en production et de leur déploiement .25
8.6 Résolution et satisfaction .25
8.6.1 Gestion des incidents .25
8.6.2 Gestion de la demande de services .26
8.6.3 Gestion des problèmes .26
8.7 Garantie de services .27
8.7.1 Gestion de la disponibilité des services .27
8.7.2 Gestion de la continuité des services .27
8.7.3 Management de la sécurité de l'information .27
9 Évaluation des performances .28
9.1 Surveillance, mesures, analyse et évaluation .28
9.2 Audit interne .29
9.3 Revue de direction .29
9.4 Fourniture des rapports de service .30
10 Amélioration .30
10.1 Non-conformité et actions correctives .30
10.2 Amélioration continue .31
Bibliographie .32
iv © ISO/IEC 2018 – Tous droits réservés

Avant-propos
L'ISO (Organisation internationale de normalisation) et l’IEC (Commission électrotechnique
internationale) forment le système spécialisé de la normalisation mondiale. Les organismes
nationaux membres de l'ISO ou de l’IEC participent au développement de Normes internationales
par l'intermédiaire des comités techniques créés par l'organisation concernée afin de s'occuper des
domaines particuliers de l'activité technique. Les comités techniques de l'ISO et de l’IEC collaborent
dans des domaines d'intérêt commun. D'autres organisations internationales, gouvernementales et non
gouvernementales, en liaison avec l'ISO et l’IEC, participent également aux travaux. Dans le domaine
des technologies de l'information, l'ISO et l’IEC ont créé un comité technique mixte, l'ISO/IEC JTC 1.
Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont
décrites dans les Directives ISO/IEC, Partie 1. Il convient, en particulier de prendre note des différents
critères d'approbation requis pour les différents types de documents ISO. Le présent document a été
rédigé conformément aux règles de rédaction données dans les Directives ISO/IEC, Partie 2 (voir www
.iso .org/directives).
L'attention est appelée sur le fait que certains des éléments du présent document peuvent faire l'objet
de droits de propriété intellectuelle ou de droits analogues. L'ISO et l’IEC ne sauraient être tenues pour
responsables de ne pas avoir identifié de tels droits de propriété et averti de leur existence. Les détails
concernant les références aux droits de propriété intellectuelle ou autres droits analogues identifiés
lors de l'élaboration du document sont indiqués dans l'Introduction et/ou dans la liste des déclarations
de brevets reçues par l'ISO (voir www .iso .org/brevets).
Les appellations commerciales éventuellement mentionnées dans le présent document sont données
pour information, par souci de commodité, à l’intention des utilisateurs et ne sauraient constituer un
engagement.
Pour une explication de la nature volontaire des normes, la signification des termes et expressions
spécifiques de l'ISO liés à l'évaluation de la conformité, ou pour toute information au sujet de l'adhésion
de l'ISO aux principes de l’Organisation mondiale du commerce (OMC) concernant les obstacles
techniques au commerce (OTC), voir le lien suivant: www .iso .org/iso/fr/avant -propos .html.
Le comité chargé de l’élaboration du présent document est l’ISO/IEC JTC 1, Technologies de l'information,
sous-comité SC 40, IT Service Management et IT Governance (Gestion des services issus des technologies
de l’information et gouvernance des technologies de l’information).
Cette troisième édition annule et remplace la deuxième édition (ISO/IEC 20000-1:2011) qui a fait l'objet
d'une révision technique.
Les principales modifications par rapport à l’édition précédente sont les suivantes:
a) Contenu restructuré dans la structure de niveau supérieur utilisée pour toutes les normes de
systèmes de management (dans l’Annexe SL du Supplément ISO Consolidé aux Directives ISO/
IEC, Partie 1). Cela a entraîné de nouvelles exigences communes pour le contexte de l’organisme,
la planification pour atteindre les objectifs et les actions à mettre en œuvre face aux risques et
opportunités. Certaines exigences communes ont mis à jour des exigences existantes. Par exemple,
informations documentées, ressources, compétences et sensibilisation.
b) prise en compte des nouvelles tendances de la gestion des services qui abordent des thèmes comme
la banalisation des services, la gestion de plusieurs fournisseurs par un intégrateur de services
interne ou externe et la nécessité de déterminer la valeur des services pour les clients.
c) retrait d’un certain nombre de détails pour se concentrer sur ce qui doit être fait et laisser aux
organismes toute liberté pour décider comment répondre aux exigences.
d) nouveaux points ajoutés tels que les exigences relatives à la connaissance et à la planification des
services.
© ISO/IEC 2018 – Tous droits réservés v

e) articles séparés qui étaient au préalable associés à la gestion des incidents, de la demande de
services, de la continuité des services, de la disponibilité des services, des niveaux de services, du
catalogue des services, de la demande et de la capacité.
f) «gouvernance de processus opérés par d'autres parties» renommée et remplacée par «maîtrise des
parties impliquées dans le cycle de vie du service» et mises à jour des exigences pour inclure les
services et les composants de services ainsi que les processus. Précision sur le fait que l’organisation
ne peut pas démontrer sa conformité aux exigences spécifiées dans le présent document si d’autres
parties sont utilisées pour fournir ou opérer tous les services, les composants de services ou les
processus dans le périmètre du système de management des services (SMS).
g) Division de l’Article 3 (Termes et définitions) en paragraphes pour les termes relatifs au système de
management et ceux relatifs à la gestion des services. Les définitions ont été largement modifiées.
Les principaux changements sont les suivants:
1) de nouveaux termes ont été ajoutés à l’Annexe SL, par exemple «objectif», «politique», et
d'autres ont été ajoutés spécifiquement pour la gestion des services, par exemple «actif»,
«utilisateur»;
2) le terme «fournisseur de services» a été remplacé par le terme «organisme» pour une question
de cohérence avec le texte commun de l’Annexe SL;
3) le terme «groupe interne» a été remplacé par «fournisseur interne» et le terme «fournisseur» a
été remplacé par «fournisseur externe»;
4) la définition de «sécurité de l'information» a été alignée sur la norme ISO/IEC 27000. En
conséquence, le terme «disponibilité» a été remplacé par «disponibilité des services» pour le
différencier du terme «disponibilité» qui est dorénavant utilisé dans la définition révisée de
«sécurité de l'information».
h) les informations documentées requises ont été reduites, seuls les documents clés tels que le plan de
management des services ont été conservés. Les autres changements concernant les informations
documentées sont les suivants:
1) l’exigence concernant le plan documenté de capacité est retiré et remplacé par l’exigence de
planification de la capacité;
2) l’exigence concernant le plan documenté de disponibilité est retiré et remplacé par l’exigence
de documentation des exigences et des objectifs de disponibilité des services;
3) l'exigence concernant la base de données de gestion des configurations est retirée et remplacée
par une exigence d’information de configuration;
4) l'exigence portant sur une politique de mises en production est retirée et remplacée par une
exigence de définition des types de mises en production et de leur fréquence;
5) l'exigence portant sur une politique d’amélioration continue est retirée et remplacée par une
exigence visant à déterminer les critères d’évaluation pour les opportunités d’amélioration.
i) les Figures 2 et 3 sont mises à jour et renumérotées en tant que Figures 1 et 2. La Figure 1 et
les références à la roue de Deming sont retirées du fait que celles-ci ne sont pas spécifiquement
utilisées dans l’Annexe SL car de nombreuses méthodes d'amélioration peuvent être utilisées avec
les normes de systèmes de management.
j) les exigences détaillées relatives aux rapports, contenus dans l'article sur les rapports de services,
sont déplacées vers les articles normalement concernés par lesdits rapports.
Une liste de toutes les parties de la série de normes ISO/IEC 20000 peut être consultée sur le site web
de l’ISO.
vi © ISO/IEC 2018 – Tous droits réservés

Il convient que l’utilisateur adresse tout retour d’information ou toute question concernant le présent
document à l’organisme national de normalisation de son pays. Une liste exhaustive desdits organismes
se trouve à l’adresse www .iso .org/fr/members .html.
© ISO/IEC 2018 – Tous droits réservés vii

Introduction
Le présent document a été élaboré pour préciser des exigences en vue de l'établissement, de la mise en
œuvre, de la tenue à jour et de l'amélioration continue d'un système de management des services (SMS).
Un SMS est une aide à la gestion du cycle de vie des services, comprenant la planification, la conception,
la transition, la fourniture et l’amélioration des services, pour satisfaire aux exigences convenues et
créer de la valeur pour les clients, les utilisateurs et l’organisme fournisseur des services.
L’adoption d’un SMS constitue une décision stratégique pour un organisme et est généralement
influencée par les objectifs de l’organisme, l’organe de gouvernance, les autres parties impliquées dans
le cycle de vie du service et la nécessité d’obtenir des services efficaces et faisant preuve de résilience.
La mise en œuvre et le fonctionnement d’un SMS apportent une visibilité des opérations, un maîtrise
des services et une amélioration continue conduisant à une meilleure efficience et à une plus grande
efficacité. L’amélioration du management des services s’applique aux SMS et aux services.
Le présent document est volontairement indépendant de tout guide ou référentiel spécifique.
L’organisme peut utiliser une combinaison de référentiels généralement admis et sa propre expérience.
Les exigences spécifiées dans le présent document sont alignées sur les méthodologies d’amélioration
généralement utilisées. Des outils appropriés de management des services peuvent être utilisés pour
accompagner le SMS.
L’ISO/IEC 20000-2 fournit des recommandations relatives à l’application des systèmes de management
des services comprenant des exemples permettant de répondre au mieux aux exigences spécifiées dans
le présent document. L’ISO/IEC 20000-10 fournit des informations sur toutes les parties de la série de
normes ISO/IEC 20000, avantages, mésinterprétation et autres normes connexes. L’ISO/IEC 20000-
10 fournit une liste des termes et définitions inclus dans le présent document qui viennent s'ajouter
aux termes non utilisés dans le présent document mais utilisés dans d’autres parties de la série de
normes ISO/IEC 20000.
La structure (c'est-à-dire l'organisation des articles et des paragraphes), la terminologie en 3.1 et une
grande partie des exigences sont issues de l’Annexe SL du Supplément ISO Consolidé aux Directives ISO/
IEC, Partie 1, également dénommée structure de niveau supérieur (HLS) utilisée pour toutes les normes
de systèmes de management. L'adoption de la HLS permet à un organisme de s’aligner sur plusieurs
normes de système de management, ou de les intégrer. Par exemple, un SMS peut être intégré dans un
système de management de la qualité basé sur l'ISO 9001 ou dans un système de management de la
sécurité de l'information basé sur l’ISO/IEC 27001.
La Figure 1 représente un SMS montrant le contenu du présent document. Elle ne figure pas une
hiérarchie structurelle, une séquence ou des niveaux d’autorité. Le présent document n'exige pas
l'application de sa structure à un SMS de l’organisme. Il n'est pas exigé que les termes utilisés par un
organisme soient remplacés par les termes utilisés dans le présent document. Les organismes peuvent
choisir librement les termes correspondant le mieux aux opérations liées à leur activité.
La structure est destinée à fournir une présentation cohérente des exigences plutôt qu'un modèle pour
la documentation des politiques, des objectifs et des processus d'un organisme. Chaque organisme peut
choisir comment combiner les exigences au sein des processus. Les relations entre chaque organisme et
ses clients, utilisateurs et autres parties intéressées ont une influence sur le mode de mise en œuvre des
processus. Un SMS tel qu’il est désigné par un organisme ne peut toutefois exclure aucune des exigences
spécifiées dans le présent document.
viii © ISO/IEC 2018 – Tous droits réservés

Figure 1 — Système de management des services
© ISO/IEC 2018 – Tous droits réservés ix

NORME INTERNATIONALE ISO/IEC 20000-1:2018(F)
Technologies de l'information — Gestion des services —
Partie 1:
Exigences du système de management des services
1 Domaine d'application
1.1 Généralités
Le présent document spécifie les exigences destinées à une organisation pour établir, implémenter,
maintenir et améliorer continuellement un système de management des services (SMS). Les exigences
spécifiées dans le présent document incluent la planification, la conception, la transition, la fourniture
et l'amélioration des services afin de satisfaire aux exigences des services et créer de la valeur. Le
présent document peut être utilisé par:
a) un client attendant des services et exigeant une garantie de qualité pour ces services;
b) un client exigeant une approche cohérente du cycle de vie des services de la part de tous ses
fournisseurs de services, y compris ceux de la chaîne logistique;
c) un organisme pour démontrer ses capacités en matière de planification, de conception, de
transition, de fourniture et d’amélioration des services;
d) un organisme pour surveiller, mesurer et passer en revue son SMS et les services;
e) un organisme pour améliorer la planification, la conception, la transition, la fourniture et
l'amélioration des services par la mise en œuvre et le fonctionnement efficaces d'un SMS;
f) un organisme ou un tiers menant des évaluations de conformité par rapport aux exigences
spécifiées dans le présent document;
g) un fournisseur de formation ou de conseil en gestion des services.
Le terme «service» tel qu’il est utilisé dans le présent document se réfère au service ou aux services
compris dans le périmètre d'application du SMS. Le terme «organisme» tel qu’il est utilisé dans le
présent document se réfère à l’organisme compris dans le périmètre d'application du SMS qui gère et
fournit les services aux clients. Dans le périmètre d'application du SMS, l’organisme peut faire partie
d’une organisation plus étendue comme peut l’être, par exemple, un département au sein d’une grande
entreprise. Un organisme ou partie d'un organisme qui gère et fournit un ou plusieurs services à des
clients internes ou externes peut être aussi dénommé fournisseur de service. Tout usage des termes
«service» ou «organisme» n'ayant pas les significations susmentionnées sera clairement indiqué dans
le présent document.
1.2 Application
Toutes les exigences spécifiées dans le présent document sont génériques et prévues pour s'appliquer à
tout organisme, quels que soient son type ou sa taille, ou la nature des services fournis. L'exclusion d’une
des exigences spécifiées dans les Articles 4 à 10 n'est pas acceptable lorsque l’organisme revendique la
conformité au présent document, indépendamment de sa nature.
L’organisme peut lui-même démontrer la conformité aux exigences spécifiées dans le présent document
en apportant la preuve qu'il satisfait à toutes ces exigences.
L’organisme lui-même démontre sa conformité aux Articles 4 et 5. Il peut cependant être accompagné
par d’autres parties. À tire d'exemple, une autre partie peut mener à bien des audits internes pour le
compte de l’organisme ou accompagner la préparation du plan du SMS.
Toutefois, l’organisme peut aussi apporter la preuve qu’il conserve la responsabilité des exigences
spécifiées dans le présent document et démontre leur maîtrise lorsque d’autres parties contribuent
également à satisfaire aux exigences prévues aux Articles 6 à 10 (voir 8.2.3). À titre d’exemple,
l’organisme peut apporter la preuve des contrôles sur une autre partie qui fournit les composants de
services d’infrastructure ou qui opère le centre de services comprenant le processus de gestion des
incidents.
L’organisme ne peut pas démontrer sa conformité aux exigences spécifiées dans le présent document si
d’autres parties sont utilisées pour fournir ou opérer tous les services, les composants de services ou
les processus dans le périmètre du SMS.
Le domaine d'application du présent document ne couvre pas la spécification pour les produits ou les
outils. Le présent document peut toutefois être utilisé pour permettre l’élaboration ou l’acquisition de
produits ou d’outils participant au fonctionnement d’un SMS.
2 Références normatives
Le présent document ne contient aucune référence normative.
3 Termes et définitions
Pour les besoins du présent document, les termes et définitions suivants s’appliquent.
L'ISO et l'IEC tiennent à jour des bases de données terminologiques destinées à être utilisées en
normalisation, consultables aux adresses suivantes:
— IEC Electropedia: disponible à l'adresse http: //www .electropedia .org/
— ISO Online browsing platform: disponible à l’adresse https: //www .iso .org/obp
3.1 Termes spécifiques aux normes de systèmes de management
3.1.1
audit
processus méthodique, indépendant et documenté (3.1.18) permettant d'obtenir des preuves d'audit
et de les évaluer de manière objective pour déterminer dans quelle mesure les critères d'audit sont
satisfaits
Note 1 à l'article: Un audit peut être interne (de première partie) ou externe (de seconde ou tierce partie), et il
peut être combiné (s’il associe deux domaines ou plus).
Note 2 à l'article: Un audit interne est réalisé par l'organisme lui-même (3.1.14) ou par une partie externe pour le
compte de celui-ci.
Note 3 à l'article: Les termes «preuves d’audit» et «critères d’audit» sont définis dans l’ISO 19011.
3.1.2
compétence
aptitude à mettre en œuvre des connaissances et savoir-faire en vue d'obtenir des résultats prévus
3.1.3
conformité
satisfaction d’une exigence (3.1.19)
Note 1 à l'article: La conformité concerne les exigences du présent document ainsi que les exigences du SMS de
l’organisme.
2 © ISO/IEC 2018 – Tous droits réservés

Note 2 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant la note 1 à l'article.
3.1.4
amélioration continue
activité régulière destinée à améliorer les performances (3.1.16)
3.1.5
action corrective
action visant à éliminer la cause ou à réduire la probabilité de récurrence d'une non-conformité (3.1.12)
ou d'une autre situation indésirable détectée
Note 1 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant un texte à «l’action visant à
éliminer la cause d'une non-conformité et à éviter qu'elle ne réapparaisse» initiale.
3.1.6
informations documentées
informations devant être maîtrisées et mises à jour par un organisme (3.1.14) et le support sur lequel
elles sont contenues
EXEMPLE Politiques (3.1.17), plans, description des processus, procédures (3.2.11), accords sur les niveaux de
services (3.2.20) ou contrats.
Note 1 à l'article: Les informations documentées peuvent être dans n'importe quel format, sur n'importe quel
support, et provenir de n'importe quelle source.
Note 2 à l'article: Les informations documentées peuvent se rapporter:
— au système de management (3.1.9), y compris les processus (3.1.18) connexes;
— aux informations créées en vue du fonctionnement de l’organisme (documentation);
— aux preuves des résultats obtenus (enregistrements (3.2.12)).
Note 3 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant des exemples.
3.1.7
efficacité
niveau de réalisation des activités planifiées et d'obtention des résultats escomptés
3.1.8
partie intéressée
personne ou organisme (3.1.14) qui peut soit influer sur une décision ou une activité, soit être influencée
ou s'estimer influencée par une décision ou une activité liée au SMS (3.2.23) ou aux services (3.2.15)
Note 1 à l'article: Une partie intéressée peut être interne ou externe à l’organisme.
Note 2 à l'article: Les parties intéressées peuvent comprendre des parties de l’organisme en dehors du périmètre
du SMS, des clients (3.2.3), des utilisateurs (3.2.28), une communauté, des fournisseurs externes (3.2.4), des
régulateurs, des organismes sectoriels publics, des organisations non-gouvernementales, des investisseurs ou
des employés.
Note 3 à l'article: Lorsque des parties intéressées sont spécifiées dans les exigences (3.1.19) du présent document,
elles peuvent différées en fonction du contexte de l'exigence.
Note 4 à l'article: La définition initiale de l’Annexe SL a été modifiée en supprimant le terme admis «partie
prenante», en ajoutant «liée au SMS ou aux services» à la définition et en ajoutant les notes 1, 2 et 3 à l'article.
3.1.9
système de management
ensemble d’éléments corrélés ou en interaction d’un organisme (3.1.14), utilisés pour établir des
politiques (3.1.17) et des objectifs (3.1.13 et des processus 3.1.18 de façon à atteindre lesdits objectifs
Note 1 à l'article: Un système de management peut traiter d'un seul ou de plusieurs domaines.
© ISO/IEC 2018 – Tous droits réservés 3

Note 2 à l'article: Les éléments du système de management comprennent la structure, les rôles et responsabilités,
la planification, le fonctionnement, les politiques, les objectifs, les plans, les processus et les procédures de
l'organisme (3.2.11).
Note 3 à l'article: Le périmètre d’un système de management peut comprendre l’ensemble de l’organisme, des
fonctions ou des sections spécifiques et identifiées de l’organisme, ou une ou plusieurs fonctions dans un groupe
d’organismes.
Note 4 à l'article: La définition initiale de l’Annexe SL a été modifiée en indiquant clairement que le système est
un système de management et en établissant la liste d’autres éléments dans la note 2 à l'article.
3.1.10
mesurage
processus (3.1.18) visant à déterminer une valeur
3.1.11
surveillance
détermination du statut d'un système, d'un processus (3.1.18) ou d'une activité
Note 1 à l'article: Pour déterminer le statut, il peut s'avérer nécessaire de vérifier, de superviser ou d'observer de
manière critique.
3.1.12
non-conformité
non-satisfaction d'une exigence (3.1.19)
Note 1 à l'article: La non-conformité concerne les exigences du présent document ainsi que les exigences du SMS
de l’organisme.
3.1.13
objectif
résultat à atteindre
Note 1 à l'article: Un objectif peut être stratégique, tactique ou opérationnel.
Note 2 à l'article: Les objectifs peuvent se rapporter à différents domaines [tels que finance, santé, sécurité,
gestion des services (3.2.22) et environnement] et peuvent s’appliquer à divers niveaux [au niveau stratégique,
à un niveau concernant l'organisme dans son ensemble, au niveau du service (3.2.15) ou afférant à un projet, un
produit ou un processus (3.1.18)].
Note 3 à l'article: Un objectif peut être exprimé de différentes manières, par exemple par un résultat escompté,
un besoin, un critère opérationnel, en tant qu’objectif de gestion des services ou par l'utilisation d'autres termes
ayant la même signification (par exemple finalité, but ou cible).
Note 4 à l'article: Dans le contexte d’un SMS (3.2.23), les objectifs de gestion des services sont fixés par l’organisme,
en cohérence avec la politique de management des services (3.1.17), en vue d’obtenir des résultats spécifiques.
Note 5 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant « gestion des services » et
« service » dans la note 2 à l'article.
3.1.14
organisme
personne ou groupe de personnes qui a ses propres fonctions, avec les responsabilités, les pouvoirs et
les relations nécessaires pour atteindre ses objectifs (3.1.13)
Note 1 à l'article: Le concept d’organisme englobe sans s'y limiter, les travailleurs indépendants, les compagnies,
les sociétés, les firmes, les entreprises, les administrations, les partenariats, les organisations caritatives ou les
institutions, ou bien une partie ou une combinaison des entités précédentes, à responsabilité limitée ou ayant un
autre statut, de droit public ou privé.
Note 2 à l'article: Un organisme ou partie d'un organisme qui gère et fournit un service (3.2.15) ou plusieurs
services à des clients internes ou externes (3.2.3) peut être dénommé fournisseur de service (3.2.24).
4 © ISO/IEC 2018 – Tous droits réservés

Note 3 à l'article: Si le périmètre du SMS (3.2.23) ne couvre qu'une partie de l’organisme, alors l’organisme,
lorsqu’il est utilisé dans le présent document, s'adresse à la partie de l’organisme qui entre dans le périmètre du
SMS. Tout usage du terme organisme n'ayant pas la signification susmentionnée sera clairement indiqué dans le
présent document.
Note 4 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant les notes 2 et 3 à l'article.
3.1.15
externaliser, verbe
prendre des dispositions pour qu'un organisme externe (3.1.14) assure une partie des fonctions ou
des processus d'un organisme (3.1.18)
Note 1 à l'article: L’organisme externe n’est pas inclus dans le périmètre du SMS (3.2.23), contrairement à la
fonction ou au processus externalisé qui en font partie intégrante.
3.1.16
performance
résultat mesurable
Note 1 à l'article: Les performances peuvent être liées à des résultats quantitatifs ou qualitatifs.
Note 2 à l'article: Les performances peuvent concerner le management d’activités, de processus (3.1.18), de
produits, de services (3.2.15), de systèmes ou d’organismes (3.1.14).
Note 3 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant « service » dans la note 2 à
l'article.
3.1.17
politique
intentions et orientations d’un organisme (3.1.14), telles qu’elles sont officiellement formulées par sa
direction (3.1.21)
3.1.18
processus
ensemble d’activités corrélées ou en interaction qui utilise des éléments d’entrée pour fournir un
résultat attendu
Note 1 à l'article: Si le «résultat attendu» pour un processus est désigné par élément de sortie, le produit ou le
service (3.2.15) dépend du contexte de la référence.
Note 2 à l'article: Les éléments d’entrée d’un processus correspondent généralement aux éléments de sortie
d’autres processus et les éléments de sortie d’un processus correspondent généralement aux éléments d’entrée
d'autres processus.
Note 3 à l'article: On peut également parler de processus lorsque deux, ou davantage, processus sont corrélés et
en interaction en série.
Note 4 à l'article: Les processus au sein d’un organisme (3.1.14) sont souvent planifiés et réalisés dans des
conditions maîtrisées de manière à apporter une valeur ajoutée.
Note 5 à l'article: La définition initiale de l’Annexe SL a été modifiée «ensemble d’activités corrélées ou en
interaction qui transforme des éléments d’entrée en éléments de sortie». La définition initiale de l’Annexe SL a
également été modifiée en ajoutant les notes 1 à 4 à l'article. La définition révisée et les notes 1 à 4 à l'article
proviennent de l’ISO 9000:2015, 3.4.1.
3.1.19
exigence
besoin ou attente formulé(e), habituellement implicite, ou imposé(e)
Note 1 à l'article: «Généralement implicite» signifie qu’il est habituel ou courant, pour l’organisme (3.1.14) et les
parties intéressées (3.1.8), que le besoin ou l’attente en question soit implicite.
Note 2 à l'article: Une exigence spécifiée est une exigence formulée, par exemple une information documentée
(3.1.6).
© ISO/IEC 2018 – Tous droits réservés 5

Note 3 à l'article: Dans le contexte d’un SMS (3.2.23), les exigences de services (3.2.26) sont documentées et ont
fait l’objet d’un accord et ne sont généralement pas implicites. Il peut également exister d'autres exigences comme
des exigences légales et réglementaires.
Note 4 à l'article: La définition initiale de l’Annexe SL a été modifiée en ajoutant la note 3 à l'article.
3.1.20
risque
effet de l’incertitude
Note 1 à l'article: Un effet est un écart, positif ou négatif, par rapport à une attente.
Note 2 à l'article: L’incertitude est l’état, même partiel, de manque d’information qui entrave la compréhension ou
la connaissance d’un événement, de ses conséquences ou de sa vraisemblance.
Note 3 à l'article: Un risque est souvent caractérisé par référence à des événements potentiels (tels que définis
dans le Guide ISO 73:2009, 3.5.1.3) et à des conséquences également potentielles (telles que définies dans le
Guide ISO 73:2009, 3.6.1.3), ou par référence à une combinaison des deux.
Note 4 à l'article: Un risque est souvent exprimé en termes de combinaison des conséquences d’un événement (y
compris des changements de circonstances) et de la vraisemblance de son occurrence (telle que définie dans le
Guide ISO 73:2009, 3.6.1.1).
3.1.21
direction
personne ou groupe de personnes qui oriente et contrôle un organisme (3.1.14) au plus haut niveau
Note 1 à l'article: La direction a le pouvoir de déléguer son autorité et de fournir des ressources au sein de
l’organisme.
Note 2 à l'article: Si le périmètre du système de management (3.1.9) ne couvre qu'une partie de l’organisme, alors
la direction s'adresse à ceux qui orientent et dirigent cette partie de l’organisme.
3.2 Termes spécifiques à la gestion des services
3.2.1
actif
élément, chose ou entité qui a une valeur potentielle ou réelle pour un organisme (3.1.14)
Note 1 à l'article: Une valeur peut être tangible ou intangible, financière ou non financière, et comprendre la prise
en compte de risques (3.1.20) et de responsabilités. Elle peut être positive ou négative en fonction des différentes
étapes de la vie de l'actif.
Note 2 à l'article: Les actifs physiques renvoient généralement aux équipements, au stock et aux biens possédés
par l’organisme. Les actifs physiques sont opposés aux actifs intangibles qui sont des actifs non physiques comme
des baux, des marques, des actifs numériques, des droits d’utilisation
...