Mandatory Documentation and Records for ISO/IEC 20000–1:2018 Compliance

ISO/IEC 20000–1:2018 is the international standard for IT service management, defining requirements for establishing, implementing, maintaining, and continually improving a Service Management System (SMS). A critical aspect of ISO 20000 compliance is maintaining the required documented information — this includes both documentation (policies, plans, procedures, etc.) and records (evidence of activities and outcomes). Proper ISO 20000 documentation ensures that processes are standardized, traceable, and auditable. The following sections outline the key documents and records mandated by the standard, explain their purpose, and offer guidance on effective maintenance.

Required Documentation

• Scope of the Service Management System: The SMS scope document defines the boundaries of the service management system — what services are covered, geographic locations, and organizational units included. This document is essential to establish clarity on which parts of the organization and which services must comply with ISO 20000. It should be reviewed whenever the business context changes (for example, adding or retiring services).
• Service Management Policy and Objectives: A formal Service Management Policy sets the overall intentions and direction for IT service management, reflecting the organization’s commitment to quality and customer satisfaction. Documented Service Objectives translate this policy into specific, measurable targets (such as availability goals or improvement targets). Together, they guide the SMS and ensure all staff understand the strategic aims. These documents are important because they communicate senior management’s priorities and are typically reviewed and updated at planned intervals.
• Service Management Plan: The Service Management Plan is a core document that outlines how the SMS will be implemented and operated. It includes information about service delivery approaches, roles and responsibilities, resource allocation, and timelines for achieving objectives. The plan integrates inputs from risk assessments, resource planning, and business priorities. Maintaining an up-to-date Service Management Plan helps ensure that services are delivered as intended and provides a roadmap for continual improvement.
• Risk Assessment and Treatment Records: ISO 20000–1:2018 requires documented evidence of how service management risks are identified, evaluated, and addressed. This typically takes the form of a risk assessment report or risk register. It may cover risks to service availability, security, compliance, and other factors. Maintaining this documentation ensures that the organization systematically considers threats (such as system failures or cyber incidents) and applies appropriate controls. It also supports decision-making and demonstrates to auditors that risks are managed.
• Service Requirements and Service Catalogues: Organizations must document the service requirements for services they provide. This includes customer or stakeholder needs for service performance and outcomes. Closely related is the Service Catalogue, which is a structured list of all live IT services, their descriptions, and key details (such as support hours). The service requirements and catalogues ensure that everyone understands what services exist and what is expected. They are important for aligning IT service offerings with business needs. Service catalogs should be regularly updated as services change or are introduced.
• Service Level Agreements (SLAs): SLAs are documented agreements with customers (internal or external) that specify the levels of service (such as uptime, response times, and support levels). SLAs are mandatory documentation because they form the basis for managing expectations and measuring service performance. Clear, signed SLAs ensure that both the provider and the customer agree on what “good service” means. Maintaining SLAs effectively involves periodic review and renegotiation as services evolve or when performance data suggests targets need adjusting.
• Supplier Contracts and Agreements: Any contract with an external supplier that affects the SMS (for example, a cloud provider or an outsourced IT function) must be documented. Similarly, agreements with internal suppliers (other departments providing services) or customers acting as suppliers must be recorded. These documents are required to show that outsourced or shared service components are under control. They should specify the responsibilities, service levels, and interfaces between parties. Well-managed supplier documentation is important for accountability and helps ensure that dependencies on third parties do not undermine service quality.
• Information Security and Change Management Policies: ISO 20000–1:2018 mandates a formal Information Security Policy and a Change Management Policy as part of the supporting documentation. The Information Security Policy defines how the organization protects data and service integrity, which is vital given IT services often rely on sensitive information. The Change Management Policy outlines how changes to services and infrastructure are assessed, authorized, and documented. Both policies provide high-level guidance for consistent practices. They must be kept current and communicated to staff, since they underpin secure and controlled service delivery.
• Service Continuity Plans: Documented Service Continuity Plan(s) describe how services will continue or be recovered in the event of a major disruption (such as a data center outage or cyberattack). ISO 20000–1 requires evidence that continuity risks have been assessed and that plans exist for rapid recovery. These plans are crucial for resilience. They typically include roles, backup procedures, failover processes, and communication strategies. Maintaining effective continuity plans involves regular testing and updates when new services or technologies are introduced.
• Procedures for Major Incident and Continuity Handling: The standard requires specific documented procedures for handling major incidents and restoring service. For example, a Major Incident Management Procedure explains how to quickly classify, escalate, and resolve significant service outages. A Continuing Operations Procedure and a Restoration Procedure detail steps to maintain or restore services during and after disruptions. These procedure documents ensure the team knows exactly what to do when things go wrong. Regular drills or simulations help ensure that these documented procedures remain practical and up to date.
• Release Acceptance Criteria: Whenever a new or changed service is deployed, there must be defined acceptance criteria. This documented information ensures that releases meet agreed requirements before going live. It typically includes quality checks, security reviews, and stakeholder approvals. Having clear release criteria in writing prevents premature rollouts and aligns deployments with service requirements.
• Capacity and Availability Documentation: ISO 20000–1:2018 requires documenting capacity plans and availability requirements. Capacity requirements detail how much computing or network capacity is needed to meet service demands, and this needs to be managed proactively. Service availability requirements and targets document the expected uptime and performance levels. Keeping these documents ensures that the organization can justify investments (such as additional servers) and that service performance targets are tracked. They should be reviewed as business needs or usage patterns change.

Required Records

• Competence and Training Records: The organization must retain records of staff training, qualifications, skills, and experience related to the SMS. This includes training on service management procedures, security awareness, and any other competence areas. These records demonstrate that personnel are qualified for their roles. They help in identifying training needs and ensuring continuous professional development. Managing these records effectively usually involves a human resources or learning management system that tracks completion of courses and certifications.
• Service Performance and Monitoring Records: ISO 20000–1 requires evidence of monitoring service performance, especially availability and capacity. This includes results of availability monitoring (such as uptime reports and incident logs showing downtime) and test results of service continuity plans. These records provide objective data on how well the SMS is performing against targets. Keeping accurate performance logs and test reports is important for assessing compliance with SLAs and for continuous improvement. Automated monitoring tools and dashboards are practical ways to gather and retain this information.
• Incident, Service Request, and Problem Records: Every reported incident (service interruption), service request (user request for information or routine change), problem (the root cause analysis record for incidents), and known error (problems awaiting a permanent fix) must be recorded. These records are fundamental to IT service operations. They demonstrate that the organization is effectively tracking and resolving issues. For ISO 20000 compliance, having well-organized records in an ITSM tool or ticketing system is crucial. Such tools automatically time-stamp entries and ensure that nothing is overlooked.
• Change Request Records: All requests for change (RFCs) must be logged, whether the change is approved or not. Each record typically includes the change description, risk assessment, approval status, and implementation plan. These records ensure traceability for any modifications to the IT environment. A robust change log helps in audits by showing that changes are controlled. Many organizations use a change management module in their ITSM system or a version control system for this purpose.
• Configuration Management Records: Documentation of the configuration of IT services and infrastructure (sometimes maintained in a Configuration Management Database or CMDB) is required. This configuration information includes details of hardware, software, network components, and their relationships. Accurate configuration records support impact analysis and troubleshooting. They also help in ensuring that changes do not disrupt services unexpectedly. Keeping the CMDB up to date is a practical challenge; using discovery tools or integrating change management updates can help.
• Customer Complaints and Dispute Records: Any formal service complaint from a customer (internal or external) must be recorded along with the resolution. Likewise, any dispute with a supplier affecting service delivery should be documented. These records are needed to show the organization is responsive to feedback and contract issues. They often feed into continual improvement activities, so it’s important to file them systematically (for example, using a customer feedback log or contract management system).
• Audit and Review Records: ISO 20000–1 requires a documented internal audit program (a schedule of audits) and records of internal audit results. After audits, records of nonconformities and corrective actions are kept. Additionally, records of management reviews (meetings where top management reviews SMS performance) are required. These documents prove that the organization regularly checks the SMS and takes corrective action where needed. Maintaining a history of audits, reviews, and actions provides evidence of continual improvement. Often, audit management software or even simple logs and meeting minutes can fulfill this requirement.
• Corrective Action and Improvement Records: Finally, records of corrective actions taken (with their outcomes) and opportunities for improvement are required. Whenever an issue is identified, its resolution steps are documented, as are any planned or implemented improvements (such as process enhancements). These records complete the feedback loop for continual improvement. Storing them in a quality management system or using an improvement tracking tool ensures that actions are not lost and that progress can be reviewed.

Maintaining Documentation and Records Effectively

Maintaining ISO/IEC 20000–1 documentation and records is an ongoing task. Here are some best practices:

• Centralize and Control Access: Use a centralized document management system or intranet repository to store policies, plans, and procedures. Ensure that access is controlled — for example, edits may require manager approval. Use version control so that updates are tracked and only the latest version is in active use.
• Assign Ownership: Each document or record type should have a designated owner (typically a process or department manager). That owner is responsible for reviewing it at scheduled intervals (e.g. annually) or when changes occur (like new services or technology). Clear ownership prevents outdated information.
• Regular Reviews and Updates: Establish a review cycle for all documentation. For example, policies might be reviewed every year, while SLAs might be reviewed with each contract renewal. Records like incident logs are continuous but should be audited periodically to ensure completeness and accuracy. Management reviews and internal audits should include checking that documents are current.
• Integrate with Tools and Processes: Where possible, capture records automatically through ITSM and monitoring tools. For instance, incidents and changes can be logged in service desk software, which also timestamps and archives them. Monitoring tools can export availability and performance reports. This reduces manual effort and errors.
• Use Clear Formats and Templates: Standardize documents with templates that include required sections (purpose, scope, references, etc.). Checklists can help ensure that all required topics (like risk, security, continuity) are addressed. Clear, concise documentation is easier to follow and audit.
• Ensure Accessibility and Security: While documents must be accessible to those who need them, sensitive records (such as personal training records or security incident details) should be secured. Implement access controls and backups. Maintaining an audit trail of document changes can help in investigations and audits.
• Train Staff: Ensure that all relevant personnel know where to find and how to use the documentation. ISO 20000 awareness Training sessions or orientation materials can introduce staff to key policies (like the incident management procedure). Staff should also be encouraged to suggest improvements to documentation based on practical experience.

By following these practices, an organization can keep its ISO/IEC 20000–1 documentation and records well organized and up to date. Good documentation not only supports certification but also leads to smoother IT operations and better service quality over time.

Conclusion: ISO/IEC 20000–1:2018 mandates a set of core documents and records to ensure a robust IT Service Management System. These include policies, plans, catalogues, agreements, procedures, and evidence of operational performance (such as incident logs and audit results). Each item plays a role in demonstrating that the organization understands its services, manages risks, and continually improves. By keeping these documents accurate and by recording key activities diligently, organizations lay the groundwork for consistent service delivery and successful compliance with the standard.