ISO 20000-1 and service management

Service commitments only mean something when changes, incidents and suppliers are controlled and measured. This cluster covers building a service management system that shares its evidence with quality and information security instead of duplicating it.

Start here

The product view lives on ISO 20000-1 software, and the shared spine on risk, controls and evidence.

The standard in practice

Resilience and continuity

Sector reading

Deciding how to run it

The other resource clusters

Answers buyers, procurement and auditors want

Is ISO/IEC 20000-1 the same as ITIL?+

No. ITIL is a body of practice guidance; ISO/IEC 20000-1 is a certifiable management system standard for service management. ITIL practices are a common way to meet its requirements, but they are not required.

Who typically needs it?+

Managed service providers, IT service organisations and technology teams whose customers or tenders ask for evidence that services are defined, measured and controlled rather than delivered on goodwill.

How much overlaps with ISO 27001?+

A great deal: change management, incident management, supplier management, capacity, availability, continuity and configuration all appear in both. Held once in a shared control set, the evidence answers both standards.

See how your existing risks, controls and evidence could become one integrated management system

Bring what you already have — a part-finished risk register, a folder of policies, last year's audit findings — and see it mapped across the standards you need.

Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.

AI-enabled — privacy-respecting

AI does the drafting. You keep the control — and the data.

How we handle data →
  • AI that assists — not replaces

    Assisted drafting for policies, risks, controls and buyer questionnaires. Every AI suggestion is reviewed and approved by you before it lands in the record.

  • Opt-in, workspace-scoped

    AI features run only when you invoke them, only against the workspace you're in. We never mine your data to answer someone else's prompt.

  • Your data stays yours

    Prompts routed via the AI Gateway to model providers whose API terms exclude your content from model training. Nothing is sold or shared for advertising.

  • Isolated by design

    Row-level security enforces workspace boundaries at the database. MFA, SSO, audit logs and least-privilege roles govern who sees what.

We never sell personal information, never share it for advertising, and never use your workspace content to train third-party models. Full sub-processor list and Acceptable Use Policy on the Trust page.

MM
Michael McCarroll
Founder · 25+ years
IT governance · Information security · AI
Why this platform exists

Enterprise-grade governance — built for the SMEs and consultants enterprise GRC forgets.

I've spent 25 years in corporate governance — aligning technology, controls and compliance with what the business is actually trying to do. Time and again, the same pattern: the organisations that win new clients aren't the ones with the biggest GRC budget. They're the ones who can demonstrate trust on demand. This platform is the tool I wanted for the SMEs and consultants I've worked with — institutional-grade governance without an institutional price tag, built on the way audits and buyer reviews actually happen.