ISO/IEC 20000-1 / ITSM maturity · ISO/IEC 20000-1:2018
Is your service management system ready for ISO/IEC 20000-1 certification?
67 requirements paraphrasing ISO/IEC 20000-1:2018: the management-system clauses 4-7, 9 and 10 (context, leadership, planning, support, performance evaluation, improvement) and the service management processes of clause 8 (portfolio, relationships and agreements, supply and demand, design and transition, resolution and fulfilment, service assurance). Each requirement indicates the audit stage where it is typically checked, the evidence an auditor expects, the matching ITIL practice and what low versus high process maturity looks like. You get a gap percentage by clause and area, prioritised gaps, a certification roadmap and a PDF report.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: compliance % by area, by source and by control group; P1/P2 gaps.
- PDF report: results, prioritised action plan with guidance, control map, roadmap.
67 requirements · 14 assessment areas · clauses and controls of ISO 20000-1 · 60-120 minutes
ISO/IEC 20000-1:2018 requirementsThe only certifiable standard of the series: clauses 4-10 define the SMS and the processes that must be in place, with ISO/IEC 20000-2 (guidance), 20000-3 (scope and applicability) and 20000-10 (vocabulary) as supporting parts. The coverage map shows every clause and sub-clause and how your answers cover it.
ITSM process maturity and ITILCertification proves conformity, not excellence. Each requirement is cross-referenced to the ITIL practice that implements it and the guidance describes what level 1-2 versus level 3-4 practice looks like, so the same assessment serves as a maturity baseline for incident, change, SLM, configuration, capacity, continuity and the other processes.
Prepare your teamAuditors interview the people who run the processes. GoToCertify offers ITIL (v5) Foundation exam preparation and an ISO/IEC 20000 Foundation sample test to give service desk staff, process owners and internal auditors a shared vocabulary before the Stage 1 and Stage 2 audits.
Assessment areas
- CTX – Context, scope and the SMS
Clause 4 asks the organisation to understand the issues and interested parties that shape its services and to define the SMS scope precisely: the services, the locations, the customers and the technology in scope, plus the other parties (suppliers, internal groups, customers acting as suppliers) that run parts of the service lifecycle. ISO/IEC 20000-3 gives guidance on scope definition and on when the organisation can still claim conformity when others operate processes on its behalf. A weak or ambiguous scope statement is the most frequent Stage 1 finding. - LDR – Leadership, policy and roles
Clause 5 requires visible top management commitment: a service management policy, accountability for the SMS, resources, integration with business processes, and clearly assigned roles, responsibilities and authorities, including the authority to govern processes operated by other parties. Auditors interview top management directly and check that the policy and objectives are actually used to steer decisions. - PLN – Planning: risks, objectives and the service management plan
Clause 6 covers the determination of risks and opportunities for the SMS and the services, risk acceptance criteria, measurable service management objectives and the service management plan that describes how the SMS and the services are delivered, with authorities, resources, interfaces and the processes operated by other parties. The plan is a mandatory document reviewed at Stage 1. - SUP – Support of the SMS: resources, competence, documented information, knowledge
Clause 7 covers the resources, competence and awareness of people, internal and external communication, the control of documented information (policies, plans, procedures, records) and, specific to ISO/IEC 20000-1, the management of knowledge needed to support the SMS and the services (7.6). Expect auditors to sample training records, document control and the knowledge base used by the service desk. - OPC – Operational planning and control, service delivery and planning
Clauses 8.1 to 8.2.3 require the processes to be planned, operated and controlled with defined criteria, services to be delivered as agreed and coordinated across processes, new or changed service proposals to be planned and prioritised, and parties involved in the service lifecycle to be identified, controlled and monitored. This is where the SMS meets day-to-day operations. - CAT – Service catalogue, asset and configuration management
Clauses 8.2.4 to 8.2.6 require a service catalogue with dependencies between services and components, management of the assets used to deliver services (including licences and contractual obligations) and configuration information that is defined, recorded, controlled through change management and verified. Maturity grows from spreadsheets maintained by hand to a CMDB integrated with discovery, change and incident tools. - REL – Business relationship and service level management
Clauses 8.3.2 and 8.3.3 require identified customers, users and interested parties with a named relationship owner, periodic performance reviews, complaint handling and satisfaction measurement, and documented service level agreements with targets, workload limits and exceptions, monitored and reported. Maturity shows in whether SLAs are living documents reviewed with customers or static annexes nobody reads. - SPM – Supplier management
Clause 8.3.4 covers external suppliers, internal suppliers and customers acting as suppliers: documented contracts or agreements with scope, dependencies, service levels and exit arrangements, a designated manager, performance monitoring at planned intervals and management of disputes. Where a supplier operates a whole process, clause 8.2.3 also applies. - FIN – Budgeting, demand and capacity
Clause 8.4 covers budgeting and accounting for services at the level of granularity the organisation chooses, monitoring of costs against budget, determination and monitoring of current and forecast demand, and capacity planning and monitoring across human, technical, information and financial capacity. These are the processes most often found at low maturity in first certifications. - CHG – Change, service design and transition, release and deployment
Clause 8.5 requires a change management policy and process (classification, assessment, approval, scheduling, emergency changes, review), a design and transition approach for new, changed or removed services with acceptance criteria and testing, and controlled release and deployment into the live environment with verification and fallback. Auditors trace sample changes from request to post-implementation review. - RES – Resolution and fulfilment: incidents, service requests and problems
Clause 8.6 requires incidents and service requests to be recorded, classified, prioritised, escalated, fulfilled or resolved and closed with the user informed, a major incident procedure with top management involvement, and problem management with root cause analysis, known errors and proactive trend analysis. These are usually the most mature processes, so the audit focuses on consistency and on the links to SLAs and problem management. - ASR – Availability, continuity and information security
Clause 8.7 covers availability requirements and targets, monitoring and investigation of unplanned unavailability, service continuity requirements, plans and testing, and an information security policy with risk assessment, controls and handling of security incidents. Organisations already certified to ISO/IEC 27001 can reuse their ISMS for 8.7.3 if the scope is aligned. - PRF – Performance evaluation and service reporting
Clause 9 requires monitoring and measurement of the SMS and the services, an internal audit programme with objective auditors, management review with the inputs listed in the standard and, specific to ISO/IEC 20000-1, service reporting (9.4): defined reports with purpose, audience and frequency, used to take decisions. Internal audit and management review must have been completed before Stage 2. - IMV – Nonconformity and continual improvement
Clause 10 requires nonconformities to be corrected with root cause evaluated and recurrence prevented, and continual improvement with evaluation criteria, an improvement record, prioritisation, approval, implementation and measurement of results. At higher maturity an improvement register with measured benefits replaces an ad hoc list of good intentions.
Certification path and key dates
| Date | Source | Status | |
|---|---|---|---|
| Month 0 | Certification cycle | Gap analysis against ISO/IEC 20000-1:2018 (this self-assessment), scope decision, sponsor and SMS manager appointed, certification body shortlisted | Typical |
| Months 1-6 | Certification cycle | Implementation: service management plan, policy and objectives, process documentation and tooling, SLAs and catalogue, supplier agreements, continuity and security arrangements, records accumulating | Typical |
| Months 6-8 | Certification cycle | Full internal audit of the SMS, corrective actions started, first management review covering all clause 9.3 inputs, service reports produced for at least one cycle | Typical |
| Month 8 | Certification cycle | Stage 1 audit: documentation and readiness review (scope, policy, plan, objectives, processes, risk approach, internal audit and management review evidence, site-specific conditions); Stage 2 readiness confirmed | Typical |
| Months 9-10 | Certification cycle | Stage 2 audit: implementation and effectiveness, sampling of records across all processes and services, interviews with top management, process owners, staff and suppliers; nonconformities raised (major to be closed before certification) | Typical |
| Months 10-12 | Certification cycle | Certification decision and certificate issued (valid 3 years from decision, subject to surveillance); corrective actions on minor nonconformities verified at next audit | Typical |
| Year 1 | Certification cycle | First surveillance audit (typically within 12 months of the certification decision): internal audit, management review, complaints, use of the mark, progress on nonconformities and a sample of processes | Typical |
| Year 2 | Certification cycle | Second surveillance audit: remaining processes and sites sampled, changes to scope or organisation reviewed | Typical |
| Year 3 | Certification cycle | Recertification audit before certificate expiry: full assessment of the SMS over the 3-year cycle and of continual improvement; new 3-year cycle starts | Typical |
| 15/09/2018 | ISO/IEC 20000-1 | ISO/IEC 20000-1:2018 (third edition) published, replacing ISO/IEC 20000-1:2011; high-level structure, fewer mandatory documents, new requirements on knowledge (7.6), service reporting (9.4), demand management and control of other parties | Published |
| 09/2018 | ISO/IEC 20000-10 | ISO/IEC 20000-10:2018 published: concepts and vocabulary of the ISO/IEC 20000 series | Published |
| 08/2019 | ISO/IEC 20000-2 | ISO/IEC 20000-2:2019 published: guidance on the application of service management systems (clause-by-clause guidance on ISO/IEC 20000-1:2018) | Published |
| 09/2019 | ISO/IEC 20000-3 | ISO/IEC 20000-3:2019 published: guidance on scope definition and applicability of ISO/IEC 20000-1 | Published |
| 2021 | ISO/IEC 20000-1 | End of the transition period from ISO/IEC 20000-1:2011 to the 2018 edition (three years from publication, with COVID-19 extensions granted by some accreditation bodies): certificates to the 2011 edition no longer valid | Completed |
| 02/2024 | ISO/IEC 20000-1 | ISO/IEC 20000-1:2018/Amd 1:2024 (climate action changes) published: organisations shall determine whether climate change is a relevant issue (4.1) and note that interested parties can have climate-related requirements (4.2) | Published |
Frequently asked questions
Is the ISO/IEC 20000-1 / ITSM maturity self-assessment free?
Yes. The tool is free, requires no account and stores nothing on our servers: the assessment runs entirely in your browser and you download the PDF report and an optional save file to your computer.
Which standard is the ISO/IEC 20000-1 / ITSM maturity assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 20000-1:2018. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Service management leads, process owners, IT managers, consultants and internal auditors preparing an ISO/IEC 20000-1 certification, surveillance or recertification audit, or assessing the maturity of their ITSM processes; it is a self-assessment and does not replace a certification audit.
Can the result be used as a certification gap analysis?
Yes. Each requirement states what an auditor checks, the evidence expected and whether it is reviewed at Stage 1 (documentation) or Stage 2 (implementation). The PDF report lists prioritised gaps, a certification roadmap and the coverage of every clause and control of ISO/IEC 20000-1:2018, so it can be used as the gap analysis of an implementation project or before a surveillance audit.
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
Self-assessment tool for information purposes only; it is not a certification audit and does not replace the judgement of an accredited certification body. GoToCertify is not affiliated with ISO or IEC; requirements are paraphrased and references to ISO/IEC 20000-1:2018 and related standards are to the official texts available from ISO and national standards bodies. ITIL is a registered trade mark of its owner; practice names are used for cross-reference only. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.