YaSM and ISO 20000

 

Comparison: YaSM and ISO 20000 (ISO/IEC 20000:2018)

Part of: YaSM vs. other service management frameworks and standards

 

Fig. 1: YaSM and ISO/IEC 20000
Process and document templates for every ISO 20000 requirement.

One of the objec­tives when creating YaSM^® was to provide a process model that is closely aligned with ISO/IEC 20000 ('ISO 20000'), the internationally acknowledged standard for service management.

Organizations often seek certification to ISO 20000 because it enables them to prove that they are customer-oriented, efficient and effective suppliers of services. The certification can thus be used for marketing purposes, or to gain access to customers and markets which require their service suppliers to be ISO 20000 certified.

 

Closely aligned with ISO/IEC 20000 - the YaSM model

ISO 20000 sets out "requirements for establishing, implementing, maintaining and continually improving a service management system (SMS)".

To meet these requirements, organizations typically must define and implement a set of service management processes which comply with the standard. But ISO 20000 does not prescribe specific processes, nor does it provide detailed descriptions that organizations could use as guidance.

Some more guidance can be found in the popular service management frameworks and approaches, such as ITIL^®, CMMI-SVC^®, COBIT^®, VeriSM™, SIAM™, etc. But some of these frameworks provide only high-level descriptions of service management processes, while others are not well aligned with ISO 20000, especially regarding the requirements related to the service management system.

As a result, there is a need for detailed process descriptions that are based on established service management frameworks and concepts and, at the same time, offer better alignment with ISO 20000:

The YaSM process model provides such detailed descriptions as process templates in a graphical, easy-to-read format, including document templates for the policies and other documented information that usually needs to be prepared for the certification audit.

The YaSM service management model thus provides a solution for every ISO 20000 requirement, and implementing the YaSM processes is a straightforward approach for obtaining ISO 20000 certification.

ISO 20000 requirements and related service management processes

YaSM is designed to be well aligned with ISO 20000, and there are one or several related service management processes for every section in ISO/IEC 20000:2018, Part 1 (Mandatory requirements), as exemplified in the following tables:

• Section 4: Context of the organization
• Section 5: Leadership
• Section 6: Planning
• Section 7: Support of the service management system
• Section 8: Operation of the service management system
• Section 9: Performance Evaluation
• Section 10: Improvement

Notes:

• This overview omits sections 1 to 3 of ISO 20000, part 1, as they do not contain actual requirements (sections 1 to 3 cover scope, normative references, as well as terms and definitions).
• The following tables are based on ISO/IEC 20000:2018, part 1. Learn more about the new edition of the ISO 20000 standard:

• The new version of ISO/IEC 20000:2018, and changes between ISO 20000:2018 and ISO 20000:2011.

 

A detailed cross-reference between the YaSM service management processes and every single ISO 20000 requirement is available in the form of the YaSM - ISO 20000 Bridge, an additional component to the YaSM Process Map.

The ISO 20000 Bridge makes the task of designing ISO 20000 compliant processes for your organization manageable.

• Watch the video: "The YaSM - ISO 20000 Bridge: Introduction" (6:03 min.)

 

Context of the organization

---

Processes for ISO/IEC 20000 section 4: 'Context of the organization'

Related service mgmt. processes	Notes
SP1: Set up and maintain the service mgmt. system	The main service management policy contains a section that lists the relevant factors affecting the organization, including their impacts and approach for addressing these factors. The service management policy includes an overview of the interested parties and their requirements. The scope of the SMS is defined in the main service management policy.

Leadership

---

Processes for ISO/IEC 20000 section 5: 'Leadership'

Related service mgmt. processes

Notes

LP1: Set the strategic direction LP2: Design new or changed services LP5: Improve the services SP1: Set up and maintain the service mgmt. system SP10: Manage human resources SP11: Manage suppliers SP12: Manage service financials

The process for setting up and maintaining the SMS ensures that policies and objectives are established. The organization maintains a number of service management plans, in particular the strategic plan and service and process improvement plans. Authorities are assigned through the RACI matrix (part of the process model). Control of other parties is ensured through the supplier management process. SMS requirements are taken into account during process design, for example by including the service requirements and involving compliance management. Resources are provided, for example, by the financial management and HR processes. Regular reviews of the processes and services ensure the SMS achieves its intended outcomes. Continual improvement is ensured through the processes for improving the services and for improving the service management processes.

Planning

---

Processes for ISO/IEC 20000 section 6: 'Planning'

Related service mgmt. processes

Notes

LP1: Set the strategic direction LP5: Improve the services SP1: Set up and maintain the service mgmt. system SP6: Manage projects SP10: Manage human resources

High-level service management objectives are stated in the service management policy. More detailed objectives are established, for instance, in the form of strategic objectives, process and service objectives, project objectives, etc. The service management processes, as defined and mandated through the process model, ensure alignment of planning activities with the various elements of the service management plan. Planning is done at several levels: At the strategic level, at the level of services and processes, and at the level of individual projects or initiatives. Evaluation of results is ensured, for example, through regular strategic reviews, service and process reviews, project reviews, etc.

Support of the SMS

---

Processes for ISO/IEC 20000 section 7: 'Support of the service management system'

Related service mgmt. processes

Notes

LP1: Set the strategic direction LP5: Improve the services SP1: Set up and maintain the service mgmt. system SP2: Maintain the service portfolio SP10: Manage human resources

Required resources are determined when planning initiatives for setting up - or upgrading - services or (parts of) the service management system. Such initiatives are typically managed through the strategic plan and the various service and process improvement plans. Skills are managed through the human resources management process and documented in the sills inventory. Awareness of service management policies is achieved through publication and communication of the policies, for example via a service management portal on the intranet. Awareness of the list of services is ensured by making the service portfolio accessible throughout the organization. The data model (a particular view of the process model) provides a complete overview of the documented information required by the SMS.

Operation of the SMS

---

Processes for ISO/IEC 20000 section 8: 'Operation of the service management system'

Related service mgmt. processes	Notes
8.1 Operational planning and control
SP1: Set up and maintain the service mgmt. system SP5: Assess and coordinate changes SP11: Manage suppliers	The service management processes are planned and implemented through the process improvement plans. Processes are defined and documented in the process model. Changes to the service management processes, policies and services are controlled through the change management process. Outsourced services and processes are controlled via the supplier management process. This includes specifying requirements for service suppliers in line with the SMS requirements.
8.2 Service portfolio
LP1: Set the strategic direction LP2: Design new or changed services LP5: Improve the services SP2: Maintain the service portfolio SP3: Manage customer relation­ships SP4: Manage config. infor­mation	Descriptions of the services, their purpose and the intended outcomes are contained in the service portfolio and the service definitions. Service catalogues are specific views of the service portfolio for particular customers and users. Service requirements are determined during service design and documented in the service definitions. Proposals to change services may originate from several processes, for example service strategy, customer relationship management or service improvement. The types of CIs for which configuration information is maintained are defined in the configuration model. Configuration information is recorded as configuration item (CI) records, as specified in the configuration model. Configuration information is typically stored in a database to allow control of access and traceability of changes. The attributes to be recorded for each CI are specified in the configuration model.
8.3 Relationship and agreement
LP2: Design new or changed services LP4: Operate the services LP5: Improve the services SP3: Manage customer relation­ships SP11: Manage suppliers	Regular communication with the customers, in particular through customer meetings and surveys, ensures the organization is kept up-to-date on new or changed service requirements. Customer requirements are a key input for defining the services in service design and continual service improvement. The customer management process includes activities for recording, investigating and resolving customer complaints. The service properties, including service level targets, are specified in the service definitions. The service operation process tracks agreed vs. actual service levels and compiles service quality reports. Each supplier is assigned a supplier manager, as documented in the supplier portfolio. External service agreements and associated service definitions specify the properties of the services to be delivered, as well as the obligations and responsibilities of the contractual parties.
8.4 Supply and demand
LP2: Design new or changed services LP4: Operate the services LP5: Improve the services SP12: Manage service financials	Costs are budgeted and controlled through the financial budget and budget requests. Regular financial reports provide insight into actual costs for providing services. These reports are a key input for preparing financial forecasts and budgets. The reports prepared by financial management support the decision-making for services. Demand for services and capacity requirements are determined when specifying new or changed services. The service operation process produces regular service quality reports that include an analysis of capacity and performance data. If performance needs to be improved, improvement initiatives can be managed through the service improvement plan.
8.5 Service design, build and transition
LP2: Design new or changed services LP3: Build new or changed services SP5: Assess and coor­dinate changes	Items that are under the control of change management, categories of change and criteria to determine risk levels are specified in the change policy. How changes are managed is described in the process model, which includes a detailed definition of the change management process. Aspects to be considered when assessing proposed changes are specified in the change policy. Facts and arguments that lead to the approval or rejection of changes are documented in the change records. Requirements for changes to resources and skills are determined during service design and documented in the service implementation blueprint. Relevant service definitions are updated during service design. If required, customer and supporting agreements are updated in line with the service definitions as the new or changed services are implemented. Services are built according to the specifications in the service definitions, requirements specifications and in the service implementation blueprint. The service build process includes activities to create test cases and perform tests, to verify if all service components have been deployed successfully, and to take corrective action if necessary.
8.6 Resolution and fulfilment
LP4.6: Resolve incidents and service requests LP4.7: Resolve problems	Incidents are managed in the incident resolution process and documented in incident records. Actions taken to resolve incidents are documented in incident records. Service requests are managed in the incident and service request resolution process and documented in service request records. Actions taken to resolve service requests are documented in service request records. The problem resolution process performs data and trend analyses to detect problems. Any identified root causes and solutions are documented in problem records. If possible, problem management will identify workarounds and document them in the problem records. If feasible, problem management provides support staff with incident models, containing detailed instructions on how to apply the workarounds in order to resolve specific types of incidents. Known errors are documented in problem records with identified root causes and workarounds.
8.7 Service assurance
LP2: Design new or changed services LP3: Build new or changed services LP4: Operate the services LP5: Improve the services SP7: Ensure security SP8: Prepare for disaster events	Service availability requirements and targets are specified in the service definitions attached to customer service agreements. The service implementation blueprint, created during service design, describes the technical and other measures to ensure service availability. Service availability is monitored as part of service operation and documented in service quality reports. If availability targets are not met, the service improvement process will re-assess the risks to service availability and take corrective action if necessary. Service continuity requirements are specified in the service definitions attached to customer service agreements. The process for managing disaster events performs regular assessments of continuity risks and maintains a register of disaster events for which continuity mechanisms are to be put in place. Security risks are assessed on a regular basis, resulting in an updated register of security risks. This register identifies the relevant security risks with the mechanisms and controls applied to mitigate the risks. Security controls are designed and implemented through the service design and build processes or through the security management process. Security operation manuals provide guidance for the operation of the security controls.

Performance Evaluation

---

Processes for ISO/IEC 20000 section 9: 'Performance Evaluation'

Related service mgmt. processes

Notes

LP1: Set the strategic direction LP2: Design new or changed services LP4: Operate the services LP5: Improve the services SP1: Set up and maintain the service mgmt. system

Service levels and their target values are specified during service design in the service definitions. Monitoring and measurement for services is based on service levels. Services are evaluated against service requirements during service reviews. Process metrics are defined during process design. Effectiveness and performance of the SMS is evaluated as part of the regular process reviews. Monitoring and measurement for the service management processes is based on process metrics. The service and process operation manuals contain instructions for monitoring and measuring, and determine when service and process reviews are to be performed. Management reviews are held at regular intervals in the form of strategic assessments. The continued adequacy of the service management system and the services is also ensured through regular service and process reviews.

Improvement

---

Processes for ISO/IEC 20000 section 10: 'Improvement'

Related service mgmt. processes

Notes

LP5: Improve the services SP1: Set up and maintain the service mgmt. system SP9: Ensure compliance

Non-conformities are identified during service and process reviews. If corrective action is required, improvement initiatives are managed, for example, through the service and process improvement plans. Furthermore, the compliance management process reviews compliance with standards and regulations at regular intervals and takes corrective action if necessary. Evaluation criteria for potential service and process improvements are specified in the service management policies. Improvement initiatives are only approved if submitted with clearly defined, measurable objectives and a business case.

 

More about ISO 20000

ISO 20000 basics:

• What is ISO 20000?
• The current edition of ISO 20000:2018
• FAQs: ISO 20000 certification

ISO 20000 reference processes:

• Product page: The YaSM - ISO 20000 Bridge
• Use cases: How the YaSM model supports your ISO 20000 project
• Video: Introduction to the YaSM - ISO 20000 Bridge

References

• [ISO, 2018] International Organization for Standardization: ISO/IEC 20000-1:2018, Information technology - Service management - Part 1: Service management system requirements. - Geneva, Switzerland, September 2018.

Notes

Is based on: The YaSM - ISO 20000 Bridge.

By:  Andrea Kempter   and  Stefan Kempter , IT Process Maps.

 

Closely aligned with ISO/IEC 20000 - the YaSM model  › ISO 20000 requirements and related service management processes  › Context of the organization  › Leadership  › Planning