ISO/IEC 20000-1 is the international standard for IT service management (ITSM). It defines a Service Management System (SMS) for planning, delivering, operating and continually improving services to agreed levels, the disciplines that keep technology dependable day to day.
What the standard expects
At its core, ISO 20000-1 asks organizations to manage services against documented service levels, with structured processes for incident, problem, change, configuration, capacity and continuity management, and to measure and improve them.
It shares the same management-system 'shape' as ISO 27001 (context, leadership, planning, support, operation, evaluation, improvement), which makes the two standards natural companions.
The security connection
Many security controls depend on solid service management. Change management prevents insecure changes; configuration management underpins secure baselines; incident and continuity processes are shared concerns with security incident handling and business continuity.
Running ITSM and information security together avoids two parallel bureaucracies and lets a single change record or incident ticket serve both programs.
Getting started
Begin with a clear service catalogue and agreed service levels, then formalise the processes that protect them. Evidence (tickets, change approvals, service reviews) accumulates naturally as the SMS operates.
Keep reading
Meet GRCLens at the G[P]RC Summit Africa 2026 in Johannesburg
We are growing: in the same week as Kuala Lumpur, GRCLens and Security Solution Consultants are exhibiting at the G[P]RC Summit Africa in Johannesburg on 10 and 11 November 2026.
Meet GRCLens at the PCI SSC 2026 Asia-Pacific Community Meeting in Kuala Lumpur
GRCLens and Security Solution Consultants are exhibiting at the PCI SSC 2026 Asia-Pacific Community Meeting Vendor Showcase in Kuala Lumpur on 11 and 12 November 2026.
From incident to crisis: how ISO/IEC 27035, ISO 22320 and ISO 22361 work together
Incident handling, incident command and crisis leadership are usually run by three teams with three plans. Read together, ISO/IEC 27035, ISO 22320 and ISO 22361 describe one escalation, and the hand-offs between them are where most crises go wrong.