IT Service Management System Consultants in Dubai, Abu Dhabi & Saudi Arabia
Nathan ISO Consulting implements and certifies ISO/IEC 20000-1:2018 IT Service Management Systems for managed service providers, government IT departments, telecoms operators and internal technology functions across the UAE, Saudi Arabia and the wider GCC.
Most IT organisations already run something resembling service management — a helpdesk, a change process, an incident queue, some form of SLA. What they usually lack is the connective tissue: measured service performance against agreed targets, change and incident processes that actually interlock, capacity and continuity planning tied to real demand, and a governance layer proving to a client or a board that the service is managed rather than merely delivered.
What Is ISO/IEC 20000-1:2018?
ISO/IEC 20000-1 is the international standard for a Service Management System. It specifies requirements for planning, establishing, operating, monitoring and improving the delivery of services — most commonly IT services, though the standard is written to apply to service management generally.
It is the only certifiable IT service management standard. ITIL, with which it is frequently confused, is a body of best practice guidance that organisations and individuals can adopt and be trained in, but organisations cannot be certified against ITIL. Many organisations use ITIL practices to implement processes that then satisfy ISO 20000-1 requirements, which is a sensible combination.
The 2018 edition follows the Annex SL high-level structure shared with ISO 9001, ISO 27001 and ISO 22301, making integration straightforward for organisations already certified.
| Process group | What it covers |
|---|---|
| Service delivery | Service level management, service reporting, capacity management, demand management, and service continuity and availability management |
| Relationship | Business relationship management and supplier management, including managing services delivered through third parties |
| Resolution | Incident management, service request management and problem management, with the distinction between fixing symptoms and removing causes |
| Control | Configuration management, change management, and release and deployment management |
| Design and transition | Design and transition of new or changed services, from requirement through to live operation |
| Governance and improvement | Service management planning, performance evaluation, internal audit, management review and continual improvement |
Three areas account for most findings. Service level management is the first — organisations frequently have SLAs in contracts and no genuine measurement of performance against them, or measurement that nobody reviews. Problem management is the second, because most IT functions do incident management well and problem management barely at all, closing tickets without ever asking why the same failure keeps recurring. Configuration management is the third: a configuration management database that was accurate at implementation and has drifted since is worse than none, because decisions get made on data nobody has verified.
Why ISO 20000 Certification Matters in the UAE and GCC
Government entities and their technology suppliers across the UAE and Saudi Arabia increasingly require demonstrable service management maturity. For managed service providers bidding into government and semi-government contracts, certification is a scored qualification criterion rather than a differentiator.
When a client outsources IT to you, they are transferring operational risk. A certified service management system provides independently assessed evidence that incidents get resolved, changes get controlled, capacity is planned and continuity is arranged — the specific assurances a client’s own board will ask about.
National digital agendas across the region have expanded IT service portfolios rapidly. Organisations that scaled services quickly without corresponding service management discipline experience the consequences as availability problems, change-related outages and escalating support costs.
Organisations holding or pursuing ISO 27001 find substantial overlap — change management, incident management, capacity, continuity and supplier management appear in both. Implementing them together produces one coherent operational system rather than two competing process sets.
Problem management removing recurring incident causes, capacity planning preventing reactive procurement, and change control reducing change-induced outages all produce measurable operational savings. Organisations frequently underestimate how much of their support cost is consumed by repeat incidents nobody has traced to root cause.
Nathan ISO Consulting’s ISO 20000 Services
Which services, delivery locations, customers and supporting suppliers fall within scope. For managed service providers this is a commercial decision as much as a technical one, since the scope statement is what prospective clients read.
A clause-by-clause and process-by-process assessment of current practice, distinguishing between processes that exist, processes that exist but are not evidenced, and processes genuinely absent.
Service definitions, measurable service level targets that reflect what you can actually deliver, measurement arrangements, and service reporting that customers and management genuinely use.
Interlocking processes with clear distinction between restoring service, fulfilling requests and eliminating underlying causes — including the problem management discipline most IT functions lack.
Change control proportionate to risk, a configuration management approach you can realistically keep accurate, and release and deployment processes preventing the change-induced outages that dominate most incident statistics.
Demand forecasting, capacity planning tied to service targets, availability design, and service continuity arrangements that integrate with any ISO 22301 business continuity system you hold.
Managing services delivered through subcontractors and cloud providers, including underpinning contracts that actually support your customer-facing commitments — a frequent gap where SLAs promise more than supplier contracts guarantee.
We configure reporting around the ITSM platform you already run rather than forcing a replacement, and help specify a proportionate tool where service management still runs through email and spreadsheets.
Service management awareness across the technology function, process owner training, and internal auditor qualification for your nominated staff.
Full internal audit, properly minuted management review, certification body selection, Stage 1 and Stage 2 attendance, and nonconformity closure.
Our ISO 20000 Certification Process
Consultation and fixed proposal. Discussion of your service portfolio, customers, existing processes and objectives, followed by a fixed written quotation.
Scope definition. Services, locations, customers and suppliers within the certification boundary.
Gap analysis. Process-by-process assessment with a written findings report and prioritised plan.
Service definition and SLA framework. Services defined, targets set to what is genuinely deliverable, measurement arranged.
Process design and documentation. Incident, request, problem, change, configuration, release, capacity, availability, continuity and supplier processes.
Toolset configuration. ITSM platform and reporting aligned to produce required evidence.
Supplier contract alignment. Underpinning contracts reviewed against customer-facing commitments.
Training rollout. Process owner training, service management awareness and internal auditor qualification.
Operating period. Processes run long enough to generate the performance data the audit requires.
Internal audit and management review. Full audit cycle with genuine findings, then a properly minuted review.
Stage 1 and Stage 2 audits. Documentation review then implementation audit, with our consultant present throughout.
Certification and surveillance support. Nonconformity closure, certificate issue and ongoing support across the three-year cycle.
Why Choose Nathan ISO Consulting
Realistic service targets. We set SLA targets against what your team can actually deliver with current resourcing, because targets promised in contracts and missed in operation are the single most common finding.
Problem management taken seriously. Most IT functions run incident management competently and problem management barely at all. Removing recurring causes is where the operational savings actually come from.
Configuration management that stays accurate. We design a CMDB scope you can realistically maintain rather than an exhaustive one that drifts within months.
Toolset-aware implementation. Configured around the platform you already run, not a forced replacement.
Supplier contract reconciliation. We check that underpinning contracts genuinely support your customer commitments — a gap that only surfaces during a major incident if nobody checks in advance.
Integration with ISO 27001 and ISO 22301. Substantial overlap in change, incident, capacity, continuity and supplier management. We build one operational system rather than competing process sets.
ITIL-compatible without ITIL dependency. Where your team holds ITIL training, we use that vocabulary. Where it does not, we do not impose it.
One dedicated lead consultant throughout. Continuity from scoping through surveillance audits.
Fixed written pricing. Agreed upfront with audit attendance included.
Independent of certification bodies. Certification is issued independently under ISO/IEC 17021.
Industries We Serve
Managed service providers and IT outsourcers. Multi-client service delivery with contractual SLA commitments and third-party dependencies.
Government and semi-government IT functions. Public service delivery with availability obligations and procurement scrutiny.
Telecommunications operators. Network and platform service management at scale with high availability requirements.
Banking and financial services technology. Change control rigour, availability and regulatory expectations around operational resilience.
Healthcare IT. Clinical system availability where service interruption carries patient safety consequences.
Data centres and cloud service providers. Infrastructure service management with multi-tenant customer commitments.
Oil, gas and utilities technology functions. IT and OT service management supporting operational technology environments.
Education and research institutions. Distributed user bases with seasonal demand patterns.
Retail and logistics technology. Transaction-critical systems where downtime directly affects revenue.
Locations We Serve
ISO 20000 consultants across Dubai — Business Bay, Deira, Jebel Ali and Dubai South — with particular activity in the technology hubs: Dubai Internet City, Dubai Silicon Oasis, Dubai Media City, Dubai Production City, DMCC, JAFZA, DAFZA and DIFC.
Abu Dhabi city, Mussafah, ICAD, KEZAD, Masdar City, Abu Dhabi Global Market, Hub71 and Al Ain — including government technology functions, ADNOC group IT services and managed service providers serving public sector clients.
Sharjah city, Sharjah Publishing City, Hamriyah Free Zone and SAIF Zone; Ajman and Ajman Free Zone; Ras Al Khaimah and RAKEZ; Umm Al Quwain Free Trade Zone; Fujairah and Fujairah Free Zone.
Riyadh, Jeddah, Dammam, Al Khobar, Dhahran, Mecca, Medina and Tabuk — including King Abdullah Economic City, NEOM, digital transformation programme participants, and managed service providers serving government and Aramco-linked clients.
Qatar — Doha, Lusail, Qatar Free Zones and the Qatar Financial Centre. Kuwait — Kuwait City, Shuwaikh and Salmiya. Oman — Muscat, Sohar, Salalah and Knowledge Oasis. Bahrain — Manama, Seef and Bahrain Bay.
What Determines the Cost of ISO 20000 Certification?
Certification body audit fees follow mandatory audit-day tables based on headcount, number of sites, and the number and complexity of services within scope. Multi-client managed service providers typically attract more audit days than a single internal IT function of comparable headcount.
Our consultancy fee is separate and fixed in writing before engagement, driven by the number of services in scope, existing process maturity, whether an ITSM toolset is in place and adequately configured, the extent of third-party service delivery requiring supplier management, and whether you are implementing alongside ISO 27001 or ISO 22301. Building sufficient service performance data before the audit is usually the pacing factor rather than documentation effort.
Get Started with ISO 20000 Certification
For ISO/IEC 20000-1 certification in Dubai, Abu Dhabi, Sharjah, Saudi Arabia, Qatar, Kuwait, Oman or Bahrain, call +971 50 258 5024, email info@nathanisoconsulting.com, or visit our contact page for a service management gap assessment and a fixed written proposal.
Frequently Asked Questions About ISO 20000 Certification
ISO/IEC 20000-1 is a certifiable international standard specifying service management system requirements. ITIL is a body of best practice guidance — organisations and individuals can be trained in ITIL, but organisations cannot be certified against it. Many organisations use ITIL practices to build processes that then satisfy ISO 20000-1 requirements, which is a sensible combination rather than a choice between them.
No. The standard requires competence appropriate to the role, not specific credentials. ITIL training is common and useful, and gives teams a shared vocabulary, but organisations certify successfully without it where competence is demonstrated through experience and internal training.
Both. The standard applies to any organisation delivering services, whether to external customers or internal business units. Internal IT functions in banks, government entities, universities and large corporates certify regularly, often to demonstrate service maturity to their own boards.
Four to eight months for an organisation with reasonably mature existing processes. Where processes are informal or a toolset needs implementing, plan on nine to twelve months. The pacing factor is usually generating sufficient service performance data before the audit rather than documentation development.
They overlap substantially — change management, incident management, capacity, continuity and supplier management appear in both. Organisations holding ISO 27001 find ISO 20000 considerably faster to add, and we build them as one operational system rather than parallel process sets that eventually conflict.
The standard requires configuration information to be managed and available to support service management activities. That does not necessarily mean a full enterprise CMDB. What matters is that configuration data supporting change impact assessment, incident diagnosis and service decisions is accurate and maintained. We design a scope you can realistically keep accurate rather than an exhaustive one that drifts.
Incident management restores service as quickly as possible — fixing the symptom. Problem management identifies and eliminates the underlying cause so the incident stops recurring. Most IT functions do the first well and the second barely at all, which is why the same failures reappear month after month. Auditors examine this distinction directly.
Yes, but supplier management becomes a focus area. You remain accountable for services delivered through third parties, so you must evidence supplier performance management and underpinning contracts that genuinely support your customer commitments. A customer SLA promising more than your supplier contract guarantees is a common and consequential gap.
Targets you can actually meet with current resourcing and architecture. The most common finding we encounter is SLAs written by sales or inherited from a contract template, never reconciled against operational capability. Auditors compare targets to actual performance data, and consistently missed targets indicate a system not working rather than an ambitious one.
The standard is written for service management generally and its principles apply beyond IT, though in practice the overwhelming majority of certified organisations are IT service providers or IT functions, and certification bodies’ experience is concentrated there. For non-IT services, ISO 9001 is more commonly the appropriate route.
ISO/IEC 20000-1 specifies the requirements you certify against. Other parts in the series provide guidance — including guidance on application of the standard, scope definition and applicability, and relationships with other frameworks. You certify only against Part 1.
ISO 20000 requires service continuity and availability management for the services in scope — plans, testing and recovery arrangements for IT services. ISO 22301 is broader, covering the whole organisation including people, premises and suppliers. Where both exist, IT service continuity becomes the technology layer within the wider business continuity system.
No tool is mandated. Small service organisations certify using well-configured general-purpose tools, and some use spreadsheets for elements of the system. At meaningful scale a dedicated ITSM platform becomes practically necessary to produce the evidence required, but auditors assess the process discipline and data, not the software brand.
Auditors examine whether changes are risk-assessed, authorised at appropriate level, tested, scheduled with consideration of service impact, and reviewed afterwards — particularly failed changes and emergency changes. Change-induced incidents are a strong signal, and a change process with a high emergency change proportion attracts scrutiny.
Yes. Scope can be defined by service, customer, location or business unit. Scope wording matters commercially for managed service providers, since prospective clients read the certificate to establish whether the services they are buying are actually covered.
Look for accreditation from a recognised IAF member — EIAC, ENAS, GAC in Saudi Arabia, UKAS or ANAB — with ISO/IEC 20000-1 in the accreditation scope. We are independent of all certification bodies and will recommend one appropriate to your sector and target markets.
Forecasting demand, monitoring current utilisation against service targets, and planning capacity ahead of need rather than reacting to performance degradation. In cloud environments this shifts from procurement lead time toward cost management and scaling policy, but the requirement to plan rather than react remains.
That new or significantly changed services are planned, designed against requirements, tested, and transitioned into live operation with acceptance criteria met — including that support arrangements, documentation and capacity are in place before go-live. Services handed to operations without this discipline generate a disproportionate share of subsequent incidents.
Yes, included in our implementation programmes and available standalone. We also deliver process owner training for incident, problem, change and service level management, which is typically where the most valuable internal capability sits.
By continuing to measure and report service performance, running problem management genuinely rather than only under pressure, keeping configuration data current, reviewing supplier performance, completing the internal audit programme, and holding management review on schedule. Service reporting that lapses after certification is the most common surveillance finding.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving