ISO/IEC 20000-1 is the international standard for IT service management (ITSM). It defines a Service Management System (SMS) for planning, delivering, operating and continually improving services to agreed levels, the disciplines that keep technology dependable day to day.
What the standard expects
At its core, ISO 20000-1 asks organizations to manage services against documented service levels, with structured processes for incident, problem, change, configuration, capacity and continuity management, and to measure and improve them.
It shares the same management-system 'shape' as ISO 27001 (context, leadership, planning, support, operation, evaluation, improvement), which makes the two standards natural companions.
The security connection
Many security controls depend on solid service management. Change management prevents insecure changes; configuration management underpins secure baselines; incident and continuity processes are shared concerns with security incident handling and business continuity.
Running ITSM and information security together avoids two parallel bureaucracies and lets a single change record or incident ticket serve both programs.
Getting started
Begin with a clear service catalogue and agreed service levels, then formalise the processes that protect them. Evidence (tickets, change approvals, service reviews) accumulates naturally as the SMS operates.
Keep reading
ISO 22000 certification in 2026: what a food safety management system has to show, site by site
ISO 22000:2018 certification is won or lost at the plant, not at head office. What the standard requires, how the HACCP plan and prerequisite programmes fit, which food laws apply in Australia, New Zealand, the Pacific, Southeast Asia, the Gulf and South Asia, and how to run one FSMS across many sites without a major nonconformity.
GRC Platform Requirements for Regulated Entities: A Buyer's Checklist
A GRC platform holds your risk register, control weaknesses and incident records, and your regulator may treat its vendor as material. What to require from the product, the contract and the hosting before you sign.
Post-Quantum TLS in 2026: How to Test, Evidence and Govern Hybrid Key Exchange
Most browsers already offer post-quantum key exchange. Whether your connections actually use it depends on servers, load balancers and suppliers you control. How to test it, fix it and prove it to an auditor.