ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 20000 vs ISO 27001 is the comparison IT service providers make when a customer’s contract asks for both and the budget stretches to one. The two standards share a structure — both follow the harmonized structure, both are certifiable by accredited bodies on a three-year cycle, both require risk-based management — and they overlap on incident, change, supplier and continuity management. But they answer different questions.
ISO/IEC 20000-1:2018 asks whether the organization delivers IT services that meet agreed requirements, reliably and efficiently; ISO/IEC 27001:2022 asks whether it protects the information those services handle. This guide sets the two side by side on five differences, shows where a shared process satisfies both, explains which to certify first for four common situations, and describes how organizations run the two from one integrated system.
ISO/IEC 20000-1:2018 specifies requirements for a service management system: clauses 4 to 10 on the harmonized structure, with clause 8 — operation of the SMS — carrying the service-specific processes: service portfolio, relationship and agreement management, supply and demand, service design and transition, resolution and fulfilment (incident and service request management), service assurance (availability, continuity, security), and the supporting processes of change, configuration, release and asset management. It is the certifiable counterpart to ITIL’s guidance; our guide to ISO 20000 vs ITIL covers that relationship.
ISO/IEC 27001:2022 specifies requirements for an information security management system: the same harmonized clauses 4 to 10, with the security-specific content in clause 6.1 risk assessment and treatment, the Statement of Applicability under 6.1.3, and Annex A’s 93 controls in four themes — 37 organizational, 8 people, 14 physical and 34 technological. Amendment 1 of 2024 added climate change as a context consideration.
| Difference | ISO/IEC 20000-1:2018 | ISO/IEC 27001:2022 |
|---|---|---|
| 1. Objective | Services meet agreed requirements and deliver value; efficiency and effectiveness of service delivery | Confidentiality, integrity and availability of information are preserved through risk treatment |
| 2. Scope object | Services in a service catalogue, delivered to customers under agreements | Information and the assets, people, processes and technology that handle it |
| 3. Core mechanism | Defined service management processes with planned, measured and improved performance (SLAs, service reports) | Risk assessment, risk treatment and a Statement of Applicability selecting from 93 controls |
| 4. Who asks for it | Customers of IT services: outsourcing, managed service and cloud contracts; public-sector tenders | Customers, regulators and partners concerned with data protection and security; increasingly a tender prerequisite |
| 5. Evidence an auditor tests | Service catalogue, SLAs and service reports, incident and change records, capacity and continuity plans, customer satisfaction | Risk register and SoA, control implementation evidence, incident records, access and logging evidence, supplier agreements |
ISO 20000 is about delivery: whether the service is available when promised, restored when it fails, changed without breaking, and improved over time. ISO 27001 is about protection: whether the information the service handles is kept confidential, accurate and available against threats. A service can be beautifully managed and insecure, or locked down and unreliable. The two standards exist because both failures happen.
An SMS scope is written in terms of services — “the managed hosting and service desk services delivered to external customers from the Dublin operations centre”. An ISMS scope is written in terms of information and its handling — “the information assets, systems and personnel supporting the managed hosting service”. The two scopes can coincide, and for a service provider they usually should, but they are declared separately and each certificate names its own.
ISO 20000 prescribes processes and expects them to be planned, documented, measured against targets and improved. ISO 27001 prescribes almost no controls; it prescribes a risk process and expects the organization to select controls from Annex A on the strength of it. The practical consequence is that an ISO 20000 audit tests whether the processes ran and hit their targets, while an ISO 27001 audit tests whether the risk logic holds and the selected controls operate. Our guide to ISO 20000 mandatory documents lists the process documentation the first kind of audit expects.
ISO 20000 is asked for by buyers of IT services who want assurance that service management is mature — public-sector outsourcing frameworks, large enterprises procuring managed services, cloud customers with availability obligations of their own. ISO 27001 is asked for by anyone whose data you will hold, and by regulators whose rules point at it. Most service providers find ISO 27001 demanded first and more often; ISO 20000 is asked for by a narrower set of customers who value it highly.
The table shows the ISO 20000 vs ISO 27001 difference. The overlap in the evidence base — incident records, change records, supplier agreements, continuity plans — is where the integration argument starts.
| Process | ISO 20000-1:2018 clause | ISO 27001:2022 control(s) | One process satisfies both if |
|---|---|---|---|
| Incident management | 8.6.1 Incident management | A.5.24–A.5.28 Information security incident management | Security incidents are a classified type in the incident process with their own escalation and evidence rules |
| Change management | 8.5.1 Change management | A.8.32 Change management | Security impact is an assessed field on every change; emergency changes are reviewed after the fact |
| Supplier management | 8.3.4 Supplier management | A.5.19–A.5.22 Supplier relationships | Supplier agreements carry service levels and security requirements; monitoring covers both |
| Service continuity | 8.7.2 Service continuity management | A.5.29, A.5.30 Continuity and ICT readiness | Continuity plans are tested and the tests evidence recovery objectives for both |
| Asset and configuration management | 8.2.4 Asset management, 8.2.6 Configuration management | A.5.9 Inventory of assets, A.8.9 Configuration management | The CMDB is the asset inventory, with owners, classification and configuration baselines |
| Capacity and availability | 8.7.1 Availability management, 8.4.3 Capacity management | A.8.6 Capacity management | Availability targets in SLAs are the availability objective in the ISMS |
| Information security within the SMS | 8.7.3 Information security management | Clauses 4–10, Annex A | ISO 20000’s own security clause is met by pointing at the ISMS |
The ISO 20000 vs ISO 27001 overlap has a hinge, ISO 20000-1 clause 8.7.3: it requires an information security policy, risk-based controls and security incident handling within the SMS, and it is satisfied outright by a certified ISMS. An organization with ISO 27001 already holds a large part of ISO 20000’s clause 8.7; an organization with ISO 20000 already runs the incident, change and supplier processes ISO 27001’s controls require.
| Situation | First | Why |
|---|---|---|
| Service provider holding customer data; contracts mention security | ISO 27001 | The more frequently demanded certificate; its incident, change and supplier controls seed the SMS |
| Internal IT function or provider whose customers measure it on SLAs | ISO 20000 | The audit tests what the customers already measure; security can be scoped in via 8.7.3 later |
| Cloud or managed service provider bidding for public-sector work | Both, ISO 27001 slightly ahead | Tenders commonly require 27001 and score 20000; build the ISMS with the service catalogue as its scope |
| Organization with ISO 9001 already | Either; ISO 20000 is the shorter step | The QMS processes for customer requirements, nonconformity and review carry directly into an SMS |
Because both standards use the harmonized structure, clauses 4, 5, 7, 9 and 10 can be built once: one context and interested-party analysis, one leadership commitment and policy set, one competence and documented-information process, one internal audit programme, one management review. Clause 6 needs two risk processes — service risks and information security risks — which most organizations hold in one register with typed entries.
Clause 8 is where the standards do different jobs: the service processes and the security controls are separate procedures inside the same system, cross-referenced where they touch. The certification body can audit both under IAF MD 11’s integrated-audit rules, with the audit duration reduced by up to 20% of the sum of the two single-standard durations where integration is genuine. Our guide to implementing ISO 20000 covers the SMS build; the ISO 20000 certification cost post covers what the combined audit saves.
What is the difference in ISO 20000 vs ISO 27001?
ISO/IEC 20000-1 certifies a service management system — that IT services meet agreed requirements through defined, measured processes. ISO/IEC 27001 certifies an information security management system — that information is protected through risk assessment and selected controls. They share a structure and several processes but have different objectives and evidence.
Does ISO 27001 cover ISO 20000?
No. An ISMS satisfies ISO 20000-1’s own information security clause (8.7.3) and supplies the incident, change and supplier processes, but ISO 20000’s service portfolio, SLA, capacity, availability, release and service reporting requirements are not in ISO 27001.
Can we get one certificate?
Certification is per standard. A certification body can audit both together under IAF MD 11 and issue two certificates, and integration can reduce the combined audit duration by up to 20%.
Which is more in demand?
ISO 27001, by a wide margin: it is asked for by any customer whose data you hold and pointed at by regulators. ISO 20000 is asked for by a narrower set of service buyers, particularly in outsourcing and public-sector procurement, who weight it highly.
Which should a managed service provider do first?
Usually ISO 27001, because it is demanded more often and its incident, change and supplier controls seed the SMS. Build the ISMS with the service catalogue as its scope so that ISO 20000 is an extension rather than a second project.
Read ISO 20000 vs ISO 27001 as two objectives on one skeleton. Delivery and protection are different questions, but they share the incident, change, supplier, continuity and asset processes, and ISO 20000’s own security clause points at the ISMS. Certify the one your customers demand first, scope it around the services, and build the second inside the same system — then let one integrated audit test both.
The IT service management manual, the incident, change, configuration, availability, capacity and service continuity processes, the information security policy that satisfies clause 8.7.3 and the management review set are in the ISO 20000 Toolkit, or start with the free templates.
September 22, 2026
September 21, 2026
September 21, 2026
September 20, 2026
September 20, 2026