ISO 20k GAQM p004-017

• Services have existed for a long time including legal, transport, and governmental services.
• IT services led to IT Service Management (ITSM) to control services and their costs.
• ITSM has been generalized to Service Management by applying its principles to other services than IT.
• Most services today contain some IT component, such as a payment method or a website.
• The ISO/IEC 20000-1 standard refers to Service Management rather than ITSM to show its applicability to all service types.
• Service management should not be an old-fashioned, rigid framework that slows down positive changes.
• The fast pace of service development, driven by customer needs, makes developers believe traditional service management should give way to newer frameworks like Lean, Agile, and DevOps.
• The ISO/IEC 20000-1 standard supports newer methodologies and traditional approaches to service management.
• The ISO/IEC 20000-1 standard only states what service management processes should conform to, not how processes should be implemented.
• This provides flexibility for organizations to implement processes suitable to their circumstances.
• Frameworks like ITIL can be modified to suit an organization's needs.
• Adapt service management practices to your organization's culture to maximize the outcome.
• ISO/IEC 20000-1 requirements can be adapted to management practices and services.
• It applies to waterfall and continuous delivery practices, depending on service management policy, principles, and organizational culture.
• Service management is valuable because it enables a flexible structure adapted to the organization's culture.
• This structure provides a framework for autonomy and decision-making.
• Customers expect value from services, and management has a structure that promotes efficiency, reduces costs, and keeps customers satisfied.

The ISO/IEC 20000 Standard

• The ISO/IEC 20000 is a series of ten documents.
• The primary standard ISO/IEC 20000-1:2018 is included.
• ISO decided to distinguish these documents as parts of the 20000 series by assigning numbers to them, hence the primary standard is 20000-1..
• ISO/IEC 20000-1: International standard for Service Management System requirements.
• ISO/IEC 20000-10: General series introduction, containing descriptions of aims.
• ISO/IEC 20000 contains all terms and definitions used in the series, parts, and related ISO standards.
• ISO/IEC 20000-2 (Part 2): Larger document providing further guidance on interpreting and implementing requirements of Part 1.
• ISO/IEC 20000-3 (Part 3): Guidance on defining the scope for Part 1 implementation.
• ISO/IEC 20000-5 (Part 5): Implementation plan example for an SMS according to Part 1 with guidance on a business case and templates.
• ISO/IEC 20000-6 (Part 6): Requirements for SMS certification bodies based on ISO/IEC 20000-1 for both the 2011 and 2018 editions.
• ISO/IEC 20000-7 (Part 7): Guidance on integrating management systems based on ISO/IEC 20000-1, ISO 9001 (quality management), and ISO/IEC 27001 (information security management).
• ISO/IEC 20000-11 (Part 11): Comparison between Part 1 and ITIL.
• ISO/IEC 20000-12 (Part 12): Comparison between Part 1 and CMMI-SVC.
• ISO/IEC 20000-13 (Part 13): Comparison between Part 1 and COBIT.
• Parts 4, 8, and 9 are missing due to cancellation, withdrawal, or renumbering.

Structure and Contents of ISO/IEC 20000-1:2018

• ISO/IEC 20000-1 is aligned with the "Annex SL" high-level structure and terminology, an appendix to the ISO Directives.
• The Annex SL structure is applied to all management system standards, including ISO 9001, ISO/IEC 27001, ISO 14001, and ISO/IEC 20000-1.
• This structure results in many identical or similar requirements across standards, easing the integration of multiple management systems.
• Previous ISO 9001:2015 certification work can be re-used for ISO/IEC 20000-1:2018 certification.
• The new structure of ISO/IEC 20000-1:2018 differs from the 2011 edition, with similar requirements in different places.
• Appendix B shows all the changes between the two editions.

Scope

• Clause 1 gives a general description of the standard.
• ISO/IEC 20000-1 covers the establishment, implementation, maintenance, and continual improvement of an SMS.
• The standard is applicable to IT services (like cloud hosting) and non-IT services (like transport or health care).
• The standard is applicable to organizations of all sizes, from self-employed consultants to large corporations.

Normative References

• Clause 2 contains references to other standards for combined use.
• Since ISO/IEC 20000-1 has no references, it can be used as a stand-alone standard.

Terms and Definitions

• Clause 3 lists terms used in the standard with context, such as 'organization', 'service', and 'incident'.
• Many terms come from Annex SL, indicated in Clause 3.1, with others added for ISO/IEC 20000-1 in Clause 3.2.
• The list of terms and definitions in ISO/IEC 20000-1 is identically included in ISO/IEC 20000-10.

Context of the Organization

• Clause 4 describes the actual SMS requirements, is mostly based on default Annex SL requirements, similar to other management system standards.
• Clause 4 asks you perform activities to determine the environment for the SMS and services.
• The process includes identifying internal and external issues that impact the operation, objectives, and customer value.
• These issues can be positive or negative, like competition or staff availability.
• Identify internal and external stakeholders ("interested parties") who have an interest in what your organization does,
• Examples of stakeholders are employees, customers, regulators, HR team, competitors and unions.
• Stakeholders interact with you and have expected needs.
• Define a scope for the SMS, indicating the included part of the organization and services.
• Clause 4 has a following statement: "Tie SMS supporting the utility services provided by Clean Water, Inc. from Jakarta, Indonesia". ISO/IEC 20000-3 helps to define SMS scope in more complex cases, like when using multiple suppliers.

Leadership

• Clause 5 has requirements for the organization's top management.
• Top management is the people accountable for the SMS, who need to back the establishment of the SMS.
• They need to support the SMS and have an appropriate level of involvement to successfully implement and run an SMS that supports the services delivered to the customers.
• Leadership support is key to running a successful SMS.
• Top management needs to explicitly show their involvement in the following areas:
• Ensuring a service management policy (overall direction for the SMS).
• Service management objectives (measurable targets for the SMS).
• A service management plan (implementation and maintenance of the SMS) that are created and communicated to all involved parties.
• Ensuring third parties such as suppliers involved in the SMS are controlled through service level agreements (SLAs).
• Ensuring the SMS meets its objectives and the services meet their outcomes.
• This is done by the measurement of service management objectives and the customer SLAs.
• Making resources available such as staff, information, budgets, and technical resources, to run the SMS and services.
• Assigning roles, authorities and responsibilities to the right people so they can independently make relevant decisions.
• Top management differs from a governing body; the latter is part of larger companies.
• The governing body consists of a board of directors, who have a strategic role rather than a management one.
• A governing body would be responsible for governance, direction and monitoring of the organization.
• Top management would apply implemented methods for them in an operational environment.
• In smaller companies, the roles of the governing body and top management may be fulfilled by the same person(s).
• Governance of IT is covered in ISO/IEC 38500.
• The service management policy is a high-level statement of intention and direction for the SMS and services.
• It should show commitment to satisfy SMS requirements.

Planning

• Clause 6 contains requirements for the planning of the SMS, including risk management, setting service management objectives and planning to create the SMS itself.
• Risk management is required to assess SMS and service risks and opportunities.
• The risks derive from issues and stakeholders identified in Clause 4, and should assessed and treated where required.
• Service management objectives must be set at all organizational levels to make everyone aware of SMS goals.
• Service management objectives state measurable SMS and service targets, being regularly assessed and updated where needed.
• These can be part of regular performance objectives many organizations set annually.
• Based on information gathered in Clauses 4 to 6, you can plan the actual SMS.
• This should be documented in a service management plan, containing:
  • A list of services
  • Restrictions and obligations
  • Assigned SMS support authorities
  • Resources needed
  • Measurement, assessment, and improvement of SMS success.
• This helps personnel understand their purpose and deliver services.

Support

• Clause 7 states that the support needed for the SMS and the services can be determined.
• It includes requirements for communication, competency, knowledge, awareness, providing resources for the SMS and creating and maintaining documentation for it
• Resources need to be available to support all phases of the SMS and services lifecycle (These include human, financial, technical and information resources).
• The competence of people supporting the SMS and services needs to be planned, assessed and managed.
• Education and experience increase where required to have the right person to perform the right job.
• All people working in the context of the SMS recognize the service management policy, objectives and services, for direction, motivation, and understanding for support.
• Communication is vital to any functioning organization.
• Determine when, how, and what to communicate to make relevant stakeholders are aware of expectations.
• Service management, even with an Agile approach, needs some documentation to prove SMS functioning.
• Service documentation relating to policies, objectives, processes and reports needs to be maintained for agreed way to develop, support and improve SMS and services.
• The section's final subject is knowledge to decide what for supporting SMS and services, making sure access by people who need it.
• Knowledge may include documentation, databases with incident tickets, or design specifications.
• This contributes operational efficiencies in SMS/Services.
• Service documentation ensures well-operated, accessible SMS.

Operation

• Clause 8 contains all requirements for the main service management processes.
• It is the standard's largest section, with extensive requirements for the following processes and activities:
• Operational Planning: Control all processes needed to meet SMS/service needs, including those outsourced to third parties.
• Service Delivery: Coordinate the activities and resources needed to operate the SMS and the services.
• Plan the services: Determine requirements, identify services based on criticality and align them with the service management policy, objectives and requirements.
• Service Objectives: Plan the services effectively so both business objectives of the service provider and outcomes of SMS are achieved
• Control of parties involved in the service lifecycle requires you control outsourced services/components, retaining accountability for SMS and service lifecycle end-to-end.
• This is to make certain all Services and processes generate their desired outcomes, and the service management objectives are achieved.
• It is explicit that not all elements in scope of one SMS may be outsourced.
• The requirements in clauses 4 and 5 yourself, may be achieved requirements in clauses 6 to 10 with third parties.
• Service catalogue management includes a creation of services, outcomes and dependencies for the benefit of internal organization and customer expectations.
• Create service catalogues for different audiences, such as a internal one and a customer-facing one.
• Asset management has a requirement to identify assets (people, software, hardware, real estate) so they are managed to meet service requirements and obligations/ legal and contractual requirements.
• Configuration management applies to the elements of services throughout the lifecycle is known as configuration items (CI).
• Examples include software, Be servers, trucks and vital components the service is providing.
• Maintain configuration information for other processes, for incident an change management.
• Business relationship management refers to setting up communications between your organization & customers for service to ensure satisfaction. Reviews should measure customer satisfaction and that customer complaints are handled effectively.
• Service level agreements (SLAs) should be established between customer and service provider to maintain agreed service levels.
• Supplier management includes controlled (internal, external or customers acting as a supplier) for seamless service provision.
• Create contracts, with documented agreements, with both internal and external organizations that act as suppliers.
• Supplier performance objectives should be aligned with customer SLAs because there is a risk of not meeting their performance objectives.
• Budgeting and accounting for services should be part of overall financial management but applied to the services in the SMS.
• The standard keeps you track and control the budget to make informed, based on the financial performance.
• Demand Management: Requires that you monitor the services demand.
• Capacity management means that resources supporting the service should meet short-term and long-term requirements, must be measured, adjusted (bandwidth).
• This would encompass for example; people, computers and resources, linking to clause 5 + 7 requirements.
• Change management is processes that must be controlled to eliminate unwanted outages/quality reduction.
• Change management states the types of changes (standard, emergency, minor, major) as well as best manage their direction.
• It includes who can approve the changes and flexibility, where changes have been initiated, properly evaluated and approved before they are carried out with deployment management.
• This increases the service stability.
• Service design and transition: focuses on managing change requests to new or existing services categorized as the change management policy as per a project. It shows Clause 6.3 conformance and that 6.2 objectives are achieved.
• Service delivery: coordinate activities resources needed to deliver the SMS and services..
• Planning the services: establish quality levels delivered and budgets managed.
• Plan the services: the process involves building and transitioning to a live environment which involves the lifecycle management exercising control.
• It shows that you must delivered them with in agreed service requirements delivered with the service quality in mind.

More on Clause 8

• Release and deployment management: deployed live, based on approved change/service requests, either a single change, or groups of changes batched as single releases.
• These manage a change, ensures releases implemented without unplanned interruptions.
• Incident management: interruptions stem from human/tech reasons, where recording-prioritizing is managed.
• This gets the back up and running, but finds a specific fix, where significant incidents command attention from executive management.
• service request management: is service request activities without the change approval management, such as access data reset, these requests must efficiently fulfill, prioritize which would allow the customers will continue to benefit.
• Problem management: identifies problem incidents where requests should fixes requests, should the requests not work.
• Management of service availability: considers continued use for these and reduce risks/hazarding.
• Continuously monitor/update goals vs. available targets.
• Continuity in the service: manages service to identify continuity issues and manage risks.
• All services generate part of overall business continuity, so that that client can reliably use/maintain service.
• Information Security Management means ISO/IEC 27000 requirements are relatively tight and light in comparison
• A policy on direction + SMS will be to have service, confidentially/available for intended use.
• This helps the assessment of risk setting physical badges and cyber-attacks prevention systems to keep info secure, while incidents should follow that principle.

Performance Evaluation

• Clause 9 covers the SMS evaluation, with reporting, internal audit, and measurement.
• It is based on Annex SL, but has service reporting requirements that monitor, evaluate, analyze so it is organization/effectively-managed.
• Metrics of SMS/service must be assessed + provided, serving it's input, assess a regular meeting, so a chance can assess SMS/service.
• A regular audit is required: providing information for requirements, should they be the case.
• It must be free of influence from people of the audited area.
• Reporting is performed throughout for the correct decisions and to ensure all aspects/features are applied/working.

Improvement

• Clause 10's goal is ways to improve an SMS, where nonconformities can be addressed, ensured and resolved for a quality experience.
• The clause provides corrective plans for all SMS/organizational needs
• To continuously create value for the consumer through customer feedback and meet targets.