ISO 20000 SMS Workspace: From Service Catalog to Certification Readiness in 22 Steps
A practical guide for ITSM consultants and IT service providers on using Rakenne's ISO 20000 SMS workspace template to build a complete, internally consistent Service Management System documentation set — with tool-assisted validation at every step.
Achieving ISO/IEC 20000-1:2011 certification requires documenting and demonstrating a complete Service Management System across 13 process areas — from service level management and incident handling to configuration management and continual improvement. For a mid-sized managed service provider, first-time certification typically takes 8–14 months of consulting effort, with the bulk of the time spent translating ad-hoc ITSM practices into auditable, clause-aligned documentation.
Rakenne’s ISO 20000 SMS workspace template provides 22 specialized skills and 22 validation tools that guide an LLM agent through the entire PDCA cycle. Each skill enforces a structured workflow, produces clause-specific artifacts, and uses deterministic tools to validate the agent’s output — catching errors that plain LLM drafting misses: missing process linkages, orphaned service dependencies, inconsistent SLA targets, incomplete CMDB designs, and cross-document contradictions.
This guide walks through all 22 skills in sequence, shows dialog excerpts and tool outputs, and explains what makes tool-assisted SMS documentation materially better than generic AI drafting.
Why plain LLMs fall short for ISO 20000
A plain LLM can draft process documents and policies. Where it struggles is compliance-grade validation across 13 interdependent process areas:
| Concern | Plain LLM | Rakenne with ISO 20000 skills |
|---|---|---|
| Clause completeness | Can miss mandatory requirements across 6 clauses | Validates all 15 clause areas with structured checks |
| Process integration | Describes processes in isolation | Enforces links between incident → problem → change → release → configuration |
| Service–SLA traceability | Weak without structured state | Validates SLAs map to catalog services, capacity plans reference SLA targets |
| Cross-document consistency | Contradictions across documents go unnoticed | Validators cross-check service catalog against SLAs, CMDB against change process |
| Repeatable process | Output varies with prompt phrasing | Each skill defines a fixed workflow; same checks run every time |
| Self-correction | Model may claim coverage without delivering it | Validation tools return PASS/FAIL; the agent revises until checks pass |
The difference is structural: skills give the agent a spec (workflow + references + structure) and tools (deterministic checks) to verify its own output. This is what turns a draft into an auditable artifact.
The 22-step SMS journey
The workspace template installs 22 skills that map to the ISO/IEC 20000-1:2011 PDCA cycle:
| Phase | Step | Skill | What gets validated |
|---|---|---|---|
| Plan | 1 | Organization Profile | Profile completeness, service provider classification |
| Plan | 2 | SMS Scope | Services/processes/locations in scope, exclusion justifications |
| Plan | 3 | Service Catalog | Service entries, dependency mapping, owner assignment |
| Plan | 4 | Gap Assessment | All 15 clause areas assessed, maturity scores, remediation roadmap |
| Plan | 5 | Service Management Plan | Objectives, governance, PDCA approach, timeline |
| Do | 6 | Service Level Management | SLA targets, measurement methods, service mapping |
| Do | 7 | Service Reporting | Report types, audiences, data sources, frequency |
| Do | 8 | Service Continuity & Availability | BIA, RTO/RPO, continuity strategies, testing schedule |
| Do | 9 | Budgeting & Accounting | Cost categories, allocation method, budgeting cycle |
| Do | 10 | Capacity Management | Resource baselines, thresholds, demand forecasting |
| Do | 11 | Information Security | Security domains, controls mapped to services, incident handling |
| Do | 12 | Business Relationship Management | Customers per service, complaint procedure, satisfaction measurement |
| Do | 13 | Supplier Management | Supplier register, criticality tiers, performance KPIs |
| Do | 14 | Incident Management | Priority matrix, lifecycle stages, escalation, major incident procedure |
| Do | 15 | Problem Management | RCA techniques, KEDB approach, incident/change integration |
| Do | 16 | Configuration Management | CI types, CMDB structure, naming conventions, verification |
| Do | 17 | Change Management | Change types, CAB, emergency procedure, process integrations |
| Do | 18 | Release Management | Release types, acceptance criteria, rollback, deployment |
| Do | 19 | Design & Transition | Service design lifecycle, acceptance criteria, transition planning |
| Check | 20 | Internal Audit | Clause coverage, finding classification, corrective actions |
| Check | 21 | Monitoring & Measurement | KPIs per process, measurement methods, CAPA tracking |
| Act | 22 | Management Review | All 9 required inputs, decisions, improvement actions |
Each skill reads workspace files produced by earlier steps — the organization profile feeds into scoping, the service catalog feeds into SLM, SLAs feed into continuity planning, and so on. The entire chain is traceable.
Step 1: Organization Profile — the foundation everything else reads
Every ISO 20000 engagement starts with understanding the organization. The Organization Profile skill captures structured facts — service provider type, org structure, ITSM maturity, technology stack, management commitment — into a reusable profile file.
You: We’re NetOps Solutions, a managed service provider with 120 employees in Melbourne. We provide IT infrastructure management, help desk, and cloud hosting to mid-market clients. We use ServiceNow for ITSM, Zabbix for monitoring, Azure for cloud hosting, and Confluence for documentation. Our IT Service Manager is Sarah Chen, CTO is James Park. We’ve been using ITIL v3 informally for 3 years but have no formal SMS.
Agent: I’ve drafted the organization profile. Let me classify your service provider type and run the completeness check.
Service provider classification: Type II (external) — you provide services to external customers as a managed service provider.
Profile completeness: PASS (94%). Minor gap: management commitment section is missing the target timeline for Stage 1 and Stage 2 audits. I’ve also noted your ITSM maturity as “informal ITIL v3 adoption with ServiceNow” — this gives us a strong baseline for the gap assessment.
I’ve updated the project dashboard to mark the Organization Profile as complete.
Step 2: SMS Scope — drawing the boundaries
The SMS Scope skill defines which services, processes, locations, and organizational units are in scope for certification. ISO/IEC 20000-1:2011 does not allow exclusion of any requirement in Clauses 4–9, but specific services can be scoped in or out.
You: Define the SMS scope. Our managed infrastructure services and help desk should be in scope. Our internal corporate IT and the mobile app development team are out of scope. All 13 process areas apply.
Agent: I’ve drafted the scope statement based on the organization profile. Let me validate the scope completeness.
Scope completeness check: PASS. Services in scope: Managed Infrastructure (IaaS), Cloud Hosting, Help Desk (L1/L2 support). All 14 process clause areas confirmed as in scope (Clauses 4.1–9.3). Two exclusions documented — Corporate IT and Mobile App Development — with justifications that they don’t deliver services to external customers.
One advisory: the scope references “cloud hosting” but the service catalog doesn’t exist yet. I recommend building the service catalog next to formalize the service definitions that feed into SLM.
The scope statement becomes the anchor for every subsequent step — the service catalog only covers in-scope services, SLAs only address in-scope service targets, and the gap assessment checks coverage against the defined boundaries.
Step 3: Service Catalog — naming what you deliver
Before managing service levels, you need a definitive list of services. The Service Catalog skill builds the service portfolio listing all services with owners, customers, dependencies, and criticality.
You: Build the service catalog based on our scope. Our main services are: Managed Infrastructure (server monitoring, patching, backup), Cloud Hosting (Azure VM management, storage, networking), and Help Desk (incident logging, triage, resolution for L1/L2).
Agent: I’ve created the service catalog with 3 business-facing services and 5 supporting services (monitoring platform, backup system, Azure management portal, ticketing system, knowledge base). Let me validate.
Service catalog validation: PASS. All 8 services have required fields — ID, name, owner, type, and customers. Business services have at least one customer each. No orphan dependencies — all supporting services are referenced by at least one business service.
Dependency map: Managed Infrastructure depends on Monitoring Platform (Zabbix) and Backup System. Cloud Hosting depends on Azure Management Portal. Help Desk depends on Ticketing System (ServiceNow) and Knowledge Base (Confluence).
The service catalog becomes the reference point for SLAs, capacity planning, continuity planning, and incident categorization. When you add a service later, the catalog validator catches orphaned dependencies and missing owners.
Step 4: Gap Assessment — finding the gaps
After establishing the foundation, the Gap Assessment skill reviews the organization’s current state against all 15 clause areas of ISO/IEC 20000-1:2011 on a 0–5 maturity scale.
You: Assess our current service management maturity against ISO 20000. We have informal processes for most areas — ServiceNow handles incidents and changes, but we don’t have formal SLAs, no documented capacity plan, and our CMDB is incomplete.
Agent: I’ve assessed all 15 clause areas. Here are the results.
Maturity highlights:
- Clause 8.1 (Incident Management): Level 3 — defined process in ServiceNow, but missing formal priority matrix and major incident procedure
- Clause 9.2 (Change Management): Level 2 — managed process, but no formal CAB or emergency change procedure
- Clause 6.1 (Service Level Management): Level 1 — initial, no formal SLAs in place
- Clause 9.1 (Configuration Management): Level 1 — CMDB exists but incomplete and unverified
- Clause 6.5 (Capacity Management): Level 0 — nonexistent
Gap assessment validation: PASS. All 15 clause areas assessed with maturity scores 0–5, each gap has a remediation action and priority.
Top remediation priorities:
- Immediate — Service Level Management (formalize SLAs), Configuration Management (complete CMDB)
- Short-term — Capacity Management (create plan), Service Continuity (BIA and DR plan)
- Medium-term — Formalize all Do-phase processes with documented procedures
- Audit readiness — Internal audit, management review, CAPA process
Step 5: Service Management Plan — the governance framework
The Service Management Plan is the master document that ties the SMS together. It covers objectives, governance structure, PDCA approach for each process area, resources, and implementation timeline.
You: Create the service management plan. Our target is Stage 1 audit in 6 months, Stage 2 in 9 months. Sarah Chen is the SMS manager. Budget is $80K for the implementation.
Agent: I’ve drafted the service management plan based on the organization profile, scope, and gap assessment. Let me validate.
SMS plan validation: PASS. The plan covers all 6 required elements — objectives (4 measurable, time-bound), governance structure (SMS manager, process owners, service owners), PDCA approach for each process area, resources (personnel, tools, training), documentation framework, and implementation timeline.
The timeline works backwards from your Stage 2 target: Plan phase complete by month 2, Do phase by month 6, Check phase by month 7, Act phase by month 8, with a month buffer before Stage 2.
Steps 6–11: Service Delivery Processes — the core of Clause 6
The Do phase covers the largest group of skills — six process areas that form the operational backbone of the SMS.
Service Level Management (Clause 6.1)
The Service Level Management skill defines SLAs for each service in the catalog, with measurable targets, monitoring methods, and review cycles.
You: Define SLAs for our three business services. Managed Infrastructure should have 99.9% availability and 4-hour response for P1 incidents. Cloud Hosting needs 99.95% uptime. Help Desk should resolve 80% of L1 tickets within 30 minutes.
Agent: I’ve created the SLA framework with 3 customer-facing SLAs and 2 internal OLAs. Each SLA maps to a service in the catalog with measurable targets.
SLA register validation: PASS. All SLAs have service_id matching the catalog, measurable targets with units, measurement methods (ServiceNow reporting, Zabbix uptime monitoring), and quarterly review frequency.
I’ve also identified 2 underpinning contracts needed — Azure SLA (99.95% VM uptime) and Zabbix support contract — to ensure your SLA commitments are backed by supplier guarantees.
Service Continuity & Availability (Clause 6.3)
You: Create the continuity and availability plan. Our most critical service is Cloud Hosting — clients can’t afford more than 2 hours of downtime. Managed Infrastructure has an 8-hour RTO. Help Desk can be down for 24 hours.
Agent: I’ve completed the BIA and drafted both the continuity and availability plans. Let me validate.
Continuity plan validation: PASS. BIA completed for all 3 business services with RTO/RPO defined. Cloud Hosting: RTO 2h / RPO 15min with Azure geo-redundant failover. Managed Infrastructure: RTO 8h / RPO 1h with backup restoration. Help Desk: RTO 24h / RPO 4h with email-based fallback.
Testing schedule established: quarterly tabletop exercises, annual failover test for Cloud Hosting, and bi-annual full DR test.
Steps 12–13: Relationship Processes — managing customers and suppliers
Business Relationship Management (Clause 7.1)
The Business Relationship Management skill establishes how the organization communicates with customers, measures satisfaction, and handles complaints.
You: Set up our customer relationship management process. We have 45 clients — 5 enterprise, 15 mid-market, and 25 SMB. Enterprise clients expect monthly service reviews.
Agent: I’ve created the BRM process document and validated it.
BRM validation: PASS. All services have identified customers. Complaint procedure covers 5 stages: receipt, logging, investigation, resolution, feedback — with 2-business-day acknowledgement SLA. Customer satisfaction measured via quarterly NPS survey with a target of 40+. Communication plan defines monthly reviews for enterprise, quarterly for mid-market, and annual for SMB.
Steps 14–15: Resolution Processes — restoring and preventing
Incident Management (Clause 8.1)
You: Formalize our incident management process. We already use ServiceNow but need a formal priority matrix and escalation paths. We also need a major incident procedure for P1/P2 incidents.
Agent: I’ve created the incident management process with a 4-level priority matrix (P1–P4) based on impact × urgency. Let me validate.
Incident process validation: PASS. Priority matrix defined with 3 impact levels × 3 urgency levels. Response and resolution targets set per priority (P1: 15min response / 4h resolution, P2: 30min / 8h, P3: 4h / 24h, P4: 8h / 72h). Escalation paths cover functional (L1 → L2 → L3) and hierarchical (Team Lead → Service Manager → CTO). Major incident procedure includes dedicated bridge call, 30-minute status updates, post-incident review within 48 hours.
Service request fulfillment is documented separately with 5 standard request models (access provisioning, VM deployment, backup restore, report generation, password reset).
Problem Management (Clause 8.2)
The problem management skill creates the process for identifying root causes and preventing recurrence, with integration points to incident and change management.
Steps 16–18: Control Processes — managing the infrastructure
Configuration Management (Clause 9.1)
You: Design our CMDB. We need to track servers (physical and virtual), network devices, applications, and customer service agreements. We’re using ServiceNow CMDB.
Agent: I’ve designed the CMDB structure with 6 CI types: Server (physical), Virtual Machine, Network Device, Application, Service, and SLA Document. Each type has defined attributes and relationship types.
CMDB design validation: PASS. All CI types have required attributes (name, ID, owner, status, location). Naming convention follows the pattern
{TYPE}-{CUSTOMER}-{SEQ}(e.g.,VM-ACME-001). Relationship types defined: “runs on”, “depends on”, “used by”, “managed by”. Verification process scheduled quarterly with 95% accuracy target.
Change Management (Clause 9.2)
The change management skill establishes the CAB, defines standard/normal/emergency change types, and integrates with configuration and release management.
Release Management (Clause 9.3)
The release management skill defines how changes are packaged, tested, deployed, and verified — with rollback procedures for failed deployments.
Step 19: Design & Transition — bringing new services to life
The Design & Transition skill defines the lifecycle for new or changed services — from requirements gathering through design, testing, and go-live.
You: Document our process for onboarding new services. We’re about to launch a managed security service (SOC-as-a-Service) for our enterprise clients.
Agent: I’ve created the design and transition process document. Let me validate.
Design transition validation: PASS. Lifecycle stages defined: requirements → design → development → testing → transition → go-live → post-implementation review. Acceptance criteria documented: functional testing, performance baseline, SLA targets defined, CMDB updated, support team trained, customer communication sent. Integration with change management (new service requires RFC), configuration management (CMDB population), and SLM (new SLA drafting) is documented.
Steps 20–21: Check Phase — verifying the SMS works
Internal Audit (Clause 4.5.4.2)
You: Plan and document an internal audit covering all our SMS processes. Our quality manager David Wong will lead the audit. Include 3 sample findings based on what we’ve built so far.
Agent: I’ve created the annual audit program and a detailed audit report. Let me validate.
Audit report validation: PASS. All clause areas (4–9) covered in the audit program. David Wong confirmed as having no operational SMS responsibilities (impartiality check passed). Three findings documented:
- Minor NC — Clause 9.1: CMDB verification has not been performed since initial population (no evidence of quarterly verification)
- Minor NC — Clause 6.1: SLA review meeting minutes not retained for Q1 (documentation gap)
- Observation — Clause 8.2: Problem management KEDB has only 2 entries; consider proactive problem identification from incident trend analysis
Each finding has clause reference, evidence, root cause, corrective action, responsible person, and target date.
Monitoring & Measurement (Clause 4.5.4.1)
The monitoring skill defines KPIs for every process area and establishes the CAPA process for tracking corrective actions from audit findings and operational issues.
Step 22: Management Review — the PDCA capstone
The Management Review skill compiles all 9 required inputs per Clause 4.5.5, prepares the review agenda, and documents management decisions and improvement actions.
You: Prepare the management review. Pull together all the inputs from our SMS artifacts — audit results, service performance, customer satisfaction, risk, and everything else Clause 4.5.5 requires.
Agent: I’ve compiled the management review input pack from all workspace artifacts. Let me validate.
Management review validation: PASS. All 9 required inputs compiled:
- Results of audits and reviews — 3 findings from internal audit
- Status of previous actions — first review, no prior actions
- Follow-up on corrective actions — 2 CAPAs in progress
- Resource requirements — additional FTE for SOC service launch
- SMS policies and objectives — all 4 objectives on track
- Service performance against SLAs — 99.92% availability (target: 99.9%)
- Customer satisfaction — NPS 42 (target: 40)
- New/changed services pipeline — SOC-as-a-Service in design phase
- Risks and improvement opportunities — 3 improvement initiatives proposed
Decisions documented with owners and target dates. Improvement actions tracked in the action register.
The dashboard — tracking progress across 22 skills
As each skill completes, the workspace dashboard updates automatically. The dashboard shows:
- Audit Readiness radar — weighted readiness across 9 areas (Scope & Context, Planning, Service Delivery, Relationships, Resolution, Control, Design, Monitoring, Management Review)
- Clause Maturity heatmap — 15 clause areas scored 0–5
- Skill Progress table — status of all 22 skills (Not Started / In Progress / Complete)
- CAPA tracking — open, closed, and overdue corrective actions
- Service portfolio — services cataloged, SLAs documented, SLA coverage percentage
This gives the SMS manager a real-time view of implementation progress without having to open individual documents.
What comes after the 22 steps
Completing all 22 skills gives you a complete SMS documentation set ready for Stage 1 (documentation review) and Stage 2 (implementation audit). But certification is the beginning, not the end.
The SMS is a living system. Use the workspace to:
- Update artifacts when services, processes, or the organization changes
- Re-run gap assessments periodically to catch drift
- Prepare for surveillance audits by running the internal audit and management review skills annually
- Onboard new services using the design and transition skill
The tools ensure consistency even as documents evolve — a change to the service catalog propagates through SLAs, capacity plans, and CMDB designs, with validators catching any inconsistencies.
Getting started
- Create a new project in Rakenne using the ISO 20000 SMS Implementation template
- Start with the Organization Profile to establish the foundation
- Follow the PDCA sequence through all 22 skills
- Use the dashboard to track your progress toward certification readiness
The template installs all 22 skills plus an Executive Readiness Report skill for board-level summaries. Each skill can be run independently, but the recommended sequence ensures upstream artifacts are available for downstream skills to reference.
Try it yourself
Open a workspace with the skills described in this article and start drafting in minutes.
Get Started Free — No Sign-Up