Services

ISO/IEC 20000

ISO/IEC 20000 is the international standard for IT service management — how IT services get designed, delivered, and improved in a disciplined, repeatable way. It's not a security standard on its own, but a lot of security outcomes quietly depend on the service management maturity it's built around: incident management, change management, and configuration management all show up in both worlds, just described in different language.

The connection matters more than it looks at first. A poorly controlled change process is a security problem as much as an operations problem — most outages and a fair number of breaches trace back to a change that wasn't reviewed, tested, or rolled back properly. Treating ITSM and security as separate conversations usually means both end up weaker than they need to be.

Where I come in

I work with organizations pursuing ISO/IEC 20000 to make sure the service management processes being built — incident handling, problem management, change control — are designed with security in mind from the start, rather than having security bolted on as a separate, parallel process afterward. That means change advisory processes that actually ask the security question, incident categorization that can distinguish a service outage from a security event, and configuration management that gives you an accurate picture of what's actually running.

A practical note

Certification is useful as a forcing function and as proof to customers and partners, but the actual value is in the discipline it builds — knowing what changed, when, why, and who approved it. That discipline pays off whether or not you ever put the certificate on the wall.

If you're building or tightening IT service management and want security built in rather than bolted on, get in touch.