Compliance FrameworksInternational
ISO/IEC 20000
IT Service Management: configuration item inventory, supplier management, change management.
IT Service Management: configuration item inventory, supplier management, change management.
| Short name | ISO 20000 |
| Region | International |
| Country or scope | International |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 20000
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ISO 20000.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for ISO 20000 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO20000-CM-INV Configuration Item Records | Configuration information for services must be recorded, meaning the software components (CIs) that make up a service are inventoried (ISO/IEC 20000-1:2018, configuration management requirements) | Scan |
ISO20000-CM-VER CI Version Information | Configuration item records must be accurate enough to support service management decisions, which requires the version of each software CI (ISO/IEC 20000-1:2018, configuration management requirements) | Scan |
ISO20000-8.3.4 Supplier Management | External suppliers contributing to services must be identified and managed under documented agreements, presupposing known suppliers for the components used (ISO/IEC 20000-1:2018 §8.3.4, Supplier management) | Scan |
ISO20000-8.5.1 Change Management Precision | Changes must be assessed for impact before deployment, which is only feasible when component versions are specific rather than vague ranges (ISO/IEC 20000-1:2018 §8.5.1, Change management) | Scan |
ISO20000-INFOSEC Information Security of Services | Information security controls must protect services, supported by the ability to verify the integrity of deployed software components (ISO/IEC 20000-1:2018, information security management requirements) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ISO20000-4.1 | SMS Context and Scope |
ISO20000-5.1 | Leadership Commitment to SMS |
ISO20000-6.3 | Service Portfolio Planning |
ISO20000-8.2.2 | Change Management |
ISO20000-8.2.3 | Configuration Management |
ISO20000-8.3.1 | Incident Management |
ISO20000-8.6.1 | Service Level Management |
ISO20000-8.7 | Supplier Management |
ISO20000-8.8 | Asset Management |
ISO20000-8.5 | Capacity and Demand Management |
ISO20000-9.1 | Monitoring and Measurement of the SMS |
ISO20000-10.1 | Continual Improvement of SMS |
Policy templates
Written for ISO 20000:
- Service Management System (SMS) Policy
- Change and Configuration Management Policy
- Supplier Management Policy for IT Services
And 22 from the standard set, adapted to ISO 20000.