Standards and schemes
ICT service management (ISO/IEC 20000-1)
ITIL is guidance on how to manage IT services. ISO/IEC 20000-1 is the standard against which it can be checked whether you really do.
Who it is for
It makes sense where a service that does not work is a loss you can count — and where someone outside asks how you manage it.
IT service and outsourcing providers · internal IT departments of larger organisations · ICT service providers to financial entities · public administration · Financial sector · Healthcare
It does not make sense where there is nothing to standardise yet. The standard organises an existing operation; it does not replace it.
ITIL is guidance. ISO/IEC 20000-1 is evidence
This is the question that comes first, so let us deal with it straight away.
ITIL is a body of recommended practice. It describes how an IT service can be managed well. People are certified in it, not organisations — your company cannot be certified to ITIL.
ISO/IEC 20000-1:2018 is a standard with requirements. It does not say how you should do things. It says what must demonstrably be in place — and an accredited certification body can assess you against it.
That is why they do not exclude each other. ITIL is the material a system is built from; ISO/IEC 20000-1 is the yardstick against which it is checked.
Not only for those who sell IT services
Incident handling, supplier management and continuity also appear in information security under ISO/IEC 27001 and in business continuity under ISO 22301. They are not called service management there, but they are the same processes.
An organisation that already works with these frameworks usually has several sets of documentation describing the same processes. A service management system brings them together into one.
The second reason is commercial. If you provide ICT services to financial entities, DORA reaches you through your customer: the contract has to contain specific provisions (Article 30). Sooner or later someone will ask how you manage changes — and “we have it under control” is not an answer.
For providers of managed ICT services, NIS2 is the other framework to check. Directive (EU) 2022/2555 lists the sectors of high criticality in its Annex I: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Where it applies, it does so through the national law of each Member State. Whether it covers you, and in which regime, depends on the service you provide, on your size and on the national rules — it cannot be inferred from the industry alone.
What it means in practice
It is not about ticketing software. These are things that must exist, be measurable and be maintained.
A service catalogue. A list of what you actually provide, to whom and to what extent. Surprisingly often it does not exist.
SLAs that describe reality. An agreed level you can measure and evidence — not a number copied from a template.
Change management. Who approves a change, how its impact is assessed and how it is rolled back when it fails.
Incidents and problems kept apart. An incident is resolved; a problem is removed. Merge them and you deal with the same thing over and over.
Capacity and availability. So that you do not learn about an outage from your customer.
Supplier management. Your service is only as reliable as the chain beneath it.
Where our role ends
The ISO/IEC 20000-1 certificate is issued by an accredited certification body, not by a consultant. The same organisation does not both build a system and certify it.
We prepare you for certification and guide you through it; the assessment itself is carried out by someone else.
Whoever built the system does not carry out its internal audit. If we help you build it, the internal audit is done by people who did not.
We do not operate IT services or a service desk for you. We set up how services are managed; running them stays with you or your provider.
Related
Service management overlaps with information security under ISO/IEC 27001 and with business continuity under ISO 22301 — the same assets, the same suppliers, the same incidents from a different angle. For ICT service providers to financial entities, see also DORA.
Legal position verified as of 22 October 2026.
How we help
Packages, scope and indicative price
ICT service manager role
If you do not want to create an internal position, we take on the role — running the management system, managing the processes and reporting regularly to management. Running the IT services themselves stays with you.
Assessment of the current state
A comparison of what you have with what the standard requires. The output is a prioritised list of gaps, not a list of failings.
Documentation
Policy, service catalogue, process documentation and records that can be presented at the assessment.
Implementing the processes
From design to handover to the people who are to run them. A process known only to its author is not implemented.
SLAs and indicators
So that they measure what matters to the customer and can actually be evaluated.
Internal audit
Checking conformity before the certification assessment — with findings and recommendations, not a confirmation that it took place. Carried out by people who did not build the system.
We do not list prices on this page. We agree the scope and the price with you in advance — the quotation follows the initial assessment.
What determines the price
The price is determined by scope, not by the size of the company. Effort is driven mainly by an additional site, an additional information system in scope, a supplier that has to be assessed, and a second jurisdiction. Each such extension adds roughly a third to a half to the effort. We agree the scope at the initial assessment and the quotation states the number of days as well.
Frequently asked
What people ask us most often
What is the difference between ITIL and ISO/IEC 20000-1?
ITIL is a body of recommended practice — it describes how an IT service can be managed well, and people are certified in it, not organisations. ISO/IEC 20000-1 is a standard with requirements: it says what must demonstrably be in place, and an accredited certification body can assess you against it. They do not exclude each other — ITIL is the material a system is built from, the standard is the yardstick against which it is checked.
Do you issue the ISO/IEC 20000-1 certificate?
No. The certificate is issued by an accredited certification body, not by a consultant — the same organisation does not both build a system and certify it. We prepare you for certification and guide you through it; the assessment itself is carried out by someone else.
Does the standard make sense if we do not sell IT services?
It can. Information security under ISO/IEC 27001 and business continuity under ISO 22301 also call for incident handling, supplier management and continuity — and those are service management disciplines. An organisation working with several frameworks usually has several sets of documentation about the same processes; a service management system brings them together.
We are an ICT service provider. Do our customer’s obligations concern us?
If your customer is a financial entity, DORA reaches you through it: the contract has to contain specific provisions (Article 30). Sooner or later someone will ask how you manage changes — and “we have it under control” is not an answer.
When does the standard not make sense?
Where there is nothing to standardise yet. The standard organises an existing operation; it does not replace it.
Tell us which services you run
Send us what you have — a service catalogue, SLAs, process documentation — and we will tell you what is missing and what the work involves.