International (ISO/IEC JTC 1/SC 40); adopted nationally (JIS Q 20000-1, EN ISO/IEC 20000-1 and others)

ISO/IEC 20000-1:2018

101 controls. 178 other frameworks in our corpus share controls with it. Here is all of it, and how much of it you are already doing.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

101 controls 178 frameworks share controls with it International (ISO/IEC JTC 1/SC 40); adopted nationally (JIS Q 20000-1, EN ISO/IEC 20000-1 and others) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you runShared controls
ITIL 45measure it →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security5measure it →
FFIEC Cybersecurity Assessment Tool (CAT)4measure it →
MTCS (Singapore)4measure it →
NIST Privacy Framework4measure it →
SOC 24measure it →
SOC for Cybersecurity4measure it →
Annex 11 to EU GMP4measure it →
API 11644measure it →
BSI IT-Grundschutz4measure it →
IEC 624434measure it →
ISO/IEC 27019:20244measure it →

Every control

CodeControlAlso in
8.7.1Service Availability Management0
8.7.2Service Continuity Management0
8.7.3Information Security Management3
ISO20000-01Service portfolio management0
ISO20000-02Service level management0
ISO20000-03Capacity and availability management43
ISO20000-04IT service continuity management0
ISO20000-05Information security for services0
ISO20000-06Change management processes36
ISO20000-07Release and deployment management0
ISO20000-08Service validation and testing0
ISO20000-09Knowledge management0
ISO20000-10Configuration management45
ISO20000-11Incident management109
ISO20000-12Problem management0
ISO20000-13Event management and monitoring0
ISO20000-14Request fulfillment0
ISO20000-15Access management for services98
ISO20000-16Service measurement and reporting0
ISO20000-17Continual improvement process0
ISO20000-18Benchmarking and maturity assessment0
ISO20000-19Stakeholder feedback management0
1010 Improvement0
10.110.1 Nonconformity and corrective action0
10.210.2 Continual improvement0
44 Context of the organization0
4.14.1 Understanding the organization and its context0
4.24.2 Understanding the needs and expectations of interested parties0
4.34.3 Determining the scope of the service management system0
4.44.4 Service management system0
55 Leadership0
5.15.1 Leadership and commitment0
5.25.2 Policy0
5.2.15.2.1 Establish the service management policy0
5.2.25.2.2 Communicate the service management policy0
5.35.3 Organizational roles, responsibilities and authorities0
66 Planning0
6.16.1 Actions to address risks and opportunities0
6.26.2 Service management objectives and planning to achieve them0
6.2.16.2.1 Establish objectives0
6.2.26.2.2 Plan to achieve objectives0
6.36.3 Plan the service management system0
77 Support of the service management system0
7.17.1 Resources0
7.27.2 Competence0
7.37.3 Awareness0
7.47.4 Communication0
7.57.5 Documented information0
7.5.17.5.1 Documented information: general0
7.5.27.5.2 Creating and updating documented information0
7.5.37.5.3 Control of documented information0
7.5.47.5.4 Service management system documented information0
7.67.6 Knowledge0
88 Operation of the service management system0
8.18.1 Operational planning and control0
8.28.2 Service portfolio0
8.2.18.2.1 Service delivery0
8.2.28.2.2 Plan the services0
8.2.38.2.3 Control of parties involved in the service life cycle0
8.2.48.2.4 Service catalogue management0
8.2.58.2.5 Asset management0
8.2.68.2.6 Configuration management0
8.38.3 Relationship and agreement0
8.3.28.3.2 Business relationship management0
8.3.38.3.3 Service level management0
8.3.48.3.4 Supplier management0
8.3.4.18.3.4.1 Management of external suppliers0
8.3.4.28.3.4.2 Management of internal suppliers and customers acting as a supplier0
8.48.4 Supply and demand0
8.4.18.4.1 Budgeting and accounting for services0
8.4.28.4.2 Demand management0
8.4.38.4.3 Capacity management0
8.58.5 Service design, build and transition0
8.5.18.5.1 Change management0
8.5.1.18.5.1.1 Change management policy0
8.5.1.28.5.1.2 Change management initiation0
8.5.1.38.5.1.3 Change management activities0
8.5.28.5.2 Service design and transition0
8.5.2.18.5.2.1 Plan new or changed services0
8.5.2.28.5.2.2 Design0
8.5.2.38.5.2.3 Build and transition0
8.5.38.5.3 Release and deployment management0
8.68.6 Resolution and fulfilment0
8.6.18.6.1 Incident management0
8.6.28.6.2 Service request management0
8.6.38.6.3 Problem management0
8.78.7 Service assurance0
8.7.18.7.1 Service availability management0
8.7.28.7.2 Service continuity management0
8.7.38.7.3 Information security management0
8.7.3.18.7.3.1 Information security policy0
8.7.3.28.7.3.2 Information security controls0
8.7.3.38.7.3.3 Information security incidents0
99 Performance evaluation0
9.19.1 Monitoring, measurement, analysis and evaluation0
9.29.2 Internal audit0
9.39.3 Management review0
9.49.4 Service reporting0
SERIESThe ISO/IEC 20000 series around part 10
STANDARDISO/IEC 20000-1:2018: the standard, its scope and what is held0
STATUSEdition status: the 2018 third edition is current with Amd 1:2024; renamed from 'ISO 20000-1'0

Tell me when ISO/IEC 20000-1:2018 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

  • Roles and responsibilities matrix
  • Compliance policy
  • Compliance obligations register
  • Compliance objectives
  • Anti-bribery policy
  • Quality objectives

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

What this page is

A control-level reference for ISO/IEC 20000-1:2018, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition