1、Information technology Service managementPart 6: Requirements for bodies providing audit and certification of service management systemsBS ISO/IEC 20000-6:2017BSI Standards PublicationWB11885_BSI_StandardCovs_2013_AW.indd 1 15/05/2013 15:06Information technology Service management Part 6: Requiremen
2、ts for bodies providing audit and certification of service management systemsTechnologies de linformation Gestion des services Partie 6: Exigences pour les organismes procdant laudit et la certification des systmes de management de la gestion des servicesINTERNATIONAL STANDARDISO/IEC20000-6Reference
3、 numberISO/IEC 20000-6:2017(E)First edition2017-06 ISO/IEC 2017National forewordThis British Standard is the UK implementation of ISO/IEC 20000-6:2017.The UK participation in its preparation was entrusted to Technical Committee IST/60/2, IT Service Management.A list of organizations represented on t
4、his committee can be obtained on request to its secretary.This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2017 Published by BSI Standards Limited 2017ISBN 978 0 580 85566 5IC
5、S 35.020; 03.080.99; 03.120.20Compliance with a British Standard cannot confer immunity from legal obligations. This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 June 2017.Amendments/corrigenda issued since publicationDate Text affectedBRITI
6、SH STANDARDBS ISO/IEC 20000-6:2017Information technology Service management Part 6: Requirements for bodies providing audit and certification of service management systemsTechnologies de linformation Gestion des services Partie 6: Exigences pour les organismes procdant laudit et la certification des
7、 systmes de management de la gestion des servicesINTERNATIONAL STANDARDISO/IEC20000-6Reference numberISO/IEC 20000-6:2017(E)First edition2017-06 ISO/IEC 2017BS ISO/IEC 20000-6:2017ii ISO/IEC 2017 All rights reservedCOPYRIGHT PROTECTED DOCUMENT ISO/IEC 2017, Published in SwitzerlandAll rights reserve
8、d. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO a
9、t the address below or ISOs member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 CP 401CH-1214 Vernier, Geneva, SwitzerlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyrightiso.orgwww.iso.orgISO/IEC 20000-6:2017(E)BS ISO/IEC 20000-6:2017ii ISO/IEC 2017 All rights reser
10、vedCOPYRIGHT PROTECTED DOCUMENT ISO/IEC 2017, Published in SwitzerlandAll rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an i
11、ntranet, without prior written permission. Permission can be requested from either ISO at the address below or ISOs member body in the country of the requester.ISO copyright officeCh. de Blandonnet 8 CP 401CH-1214 Vernier, Geneva, SwitzerlandTel. +41 22 749 01 11Fax +41 22 749 09 47copyrightiso.orgw
12、ww.iso.orgISO/IEC 20000-6:2017(E)ISO/IEC 20000-6:2017(E)Foreword vIntroduction vi1 Scope . 12 Normative references 13 Terms and definitions . 14 Principles . 15 General requirements . 15.1 Legal and contractual matters . 15.2 Management of impartiality 25.3 Liability and financing 26 Structural requ
13、irements 27 Resource requirements . 27.1 Competence of personnel 27.1.1 General considerations . 27.1.2 Determination of competence criteria 27.1.3 Evaluation processes 37.1.4 Other considerations 37.2 Personnel involved in certification activities 37.3 Use of individual external auditors and extern
14、al technical experts 37.4 Personnel records. 37.5 Outsourcing 38 Information requirements . 48.1 Public information . 48.2 Certification documents 48.3 Reference to certification and use of marks 48.4 Confidentiality . 48.5 Information exchange between a certification body and its clients . 49 Proce
15、ss requirements . 49.1 Pre-certification activities . 49.1.1 Application 49.1.2 Application review . 49.1.3 Audit programme 59.1.4 Determining audit time 59.1.5 Multi-site sampling 89.1.6 Multiple management systems standards . 89.2 Planning audits . 99.2.1 Determining audit objectives, scope and cr
16、iteria 99.2.2 Audit team selection and assignments . 99.2.3 Audit plan . 99.3 Initial certification 109.4 Conducting audits 109.4.1 General. 109.4.2 Conducting the opening meeting 109.4.3 Communication during the audit .109.4.4 Obtaining and verifying information .109.4.5 Identifying and recording a
17、udit findings .119.4.6 Preparing audit conclusions . 119.4.7 Conducting the closing meeting 119.4.8 Audit report .119.4.9 Cause analysis of nonconformities 119.4.10 Effectiveness of corrections and corrective actions .11 ISO/IEC 2017 All rights reserved iiiContents PageBS ISO/IEC 20000-6:2017ISO/IEC
18、 20000-6:2017(E)9.5 Certification decision 119.6 Maintaining certification . 119.7 Appeals . 119.8 Complaints . 119.9 Client records 119.10 Management system requirements for certification bodies .12Bibliography .13iv ISO/IEC 2017 All rights reservedBS ISO/IEC 20000-6:2017ISO/IEC 20000-6:2017(E)9.5
19、Certification decision 119.6 Maintaining certification . 119.7 Appeals . 119.8 Complaints . 119.9 Client records 119.10 Management system requirements for certification bodies .12Bibliography .13iv ISO/IEC 2017 All rights reserved ISO/IEC 20000-6:2017(E)ForewordISO (the International Organization fo
20、r Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective or
21、ganization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information techn
22、ology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of
23、ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be hel
24、d responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www .iso .org/ patents).Any trade name used in this document is informat
25、ion given for the convenience of users and does not constitute an endorsement.For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the World Trade Organization (WTO) principles in the Technical Barrie
26、rs to Trade (TBT) see the following URL: www .iso .org/ iso/ foreword .html.For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISOs adherence to the World Trade Organization (WTO) p
27、rinciples in the Technical Barriers to Trade (TBT) see the following URL: www .iso .org/ iso/ foreword .html.This document was prepared by Technical Committee ISO/IEC JTC 1, Information technology, subcommittee, SC 40, IT Service Management and IT Governance.A list of all parts in the ISO/IEC 20000
28、series can be found on the ISO website. ISO/IEC 2017 All rights reserved vBS ISO/IEC 20000-6:2017ISO/IEC 20000-6:2017(E)IntroductionThis document is for use by certification bodies for auditing and certifying a service management system (SMS) in accordance with ISO/IEC 20000-1. It can also be used b
29、y accreditation bodies when assessing certification bodies. It is intended to be used in conjunction with ISO/IEC 17021-1, which sets out criteria for certification bodies providing audit and certification of management systems. This document provides requirements additional to those in ISO/IEC 1702
30、1-1.Correct application of this document will enable certification bodies to harmonize their application of ISO/IEC 17021-1 for assessments against ISO/IEC 20000-1. It will also enable accreditation bodies to harmonize their application of the standards they use to assess certification bodies.This d
31、ocument follows the structure of ISO/IEC 17021-1, as far as possible. The requirements additional to those in ISO/IEC 17021-1 are shown as subclauses numbered “SMxxx”.ISO/IEC 17021-1 and this document use the term “client” for the organization seeking certification.vi ISO/IEC 2017 All rights reserve
32、dBS ISO/IEC 20000-6:2017ISO/IEC 20000-6:2017(E)IntroductionThis document is for use by certification bodies for auditing and certifying a service management system (SMS) in accordance with ISO/IEC 20000-1. It can also be used by accreditation bodies when assessing certification bodies. It is intende
33、d to be used in conjunction with ISO/IEC 17021-1, which sets out criteria for certification bodies providing audit and certification of management systems. This document provides requirements additional to those in ISO/IEC 17021-1.Correct application of this document will enable certification bodies
34、 to harmonize their application of ISO/IEC 17021-1 for assessments against ISO/IEC 20000-1. It will also enable accreditation bodies to harmonize their application of the standards they use to assess certification bodies.This document follows the structure of ISO/IEC 17021-1, as far as possible. The
35、 requirements additional to those in ISO/IEC 17021-1 are shown as subclauses numbered “SMxxx”.ISO/IEC 17021-1 and this document use the term “client” for the organization seeking certification.vi ISO/IEC 2017 All rights reserved Information technology Service management Part 6: Requirements for bodi
36、es providing audit and certification of service management systems1 ScopeThis document specifies requirements and provides guidance for certification bodies providing audit and certification of an SMS in accordance with ISO/IEC 20000-1. It does not change the requirements specified in ISO/IEC 20000-
37、1. This document can also be used by accreditation bodies for accreditation of certification bodies.A certification body providing SMS certification is expected to be able to demonstrate fulfilment of the requirements specified in this document, in addition to the requirements in ISO/IEC 17021-1.2 N
38、ormative referencesThe following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any
39、 amendments) applies.ISO/IEC 17021-1:2015, Conformity assessment Requirements for bodies providing audit and certification of management systems Part 1: RequirementsISO/IEC 20000-1, Information technology Service management Part 1: Service management system requirementsISO/IEC TR 20000-10, Informati
40、on technology Service management Part 10: Concepts and terminology3 Terms and definitionsFor the purposes of this document, the terms and definitions given in ISO/IEC 17021-1 and ISO/IEC TR 20000-10 apply.ISO and IEC maintain terminological databases for use in standardization at the following addre
41、sses: IEC Electropedia: available at h t t p :/ www .electropedia .org/ ISO Online browsing platform: available at h t t p :/ www .iso .org/ obp4 PrinciplesFor the purposes of this document, the principles in ISO/IEC 17021-1:2015, Clause 4 apply.5 General requirements5.1 Legal and contractual matter
42、sThe requirements in ISO/IEC 17021-1:2015, 5.1 apply.INTERNATIONAL STANDARD ISO/IEC 20000-6:2017(E) ISO/IEC 2017 All rights reserved 1BS ISO/IEC 20000-6:2017ISO/IEC 20000-6:2017(E)5.2 Management of impartialityThe requirements in ISO/IEC 17021-1:2015, 5.2 apply. In addition, the following requiremen
43、ts and guidance apply.5.2.1 SM5.2.1 Conflicts of interestCertification bodies may carry out the following duties without them being considered as consultancy or having a potential conflict of interest:a) arranging and participating as a lecturer in training courses. Where these courses relate to ser
44、vice management, related management systems or auditing, certification bodies shall confine themselves to the provision of generic information and advice which is publicly available, i.e. they shall not provide company-specific advice;b) making available or publishing on request information describi
45、ng the certification bodys interpretation of the requirements of the certification audit standards;c) activities prior to audit, solely aimed at determining readiness for certification audit. These activities shall not result in the provision of recommendations or advice that would contravene this s
46、ubclause. The certification body shall be able to confirm that such activities do not contravene these requirements and that they are not used to justify a reduction in the eventual certification audit duration;d) performing second and third-party audits according to standards or regulations other t
47、han those being part of the scope of accreditation;e) adding value during certification audits and surveillance visits, e.g. by identifying opportunities for improvement, as they become evident during the audit, without recommending specific solutions.The certification body shall not provide interna
48、l service management reviews of the clients SMS subject to certification. The certification body shall be independent of the body or bodies (including any individuals) which provide the internal SMS audit.5.3 Liability and financingThe requirements in ISO/IEC 17021-1:2015, 5.3 apply.6 Structural req
49、uirementsThe requirements in ISO/IEC 17021-1:2015, Clause 6 apply.7 Resource requirements7.1 Competence of personnel7.1.1 General considerationsThe requirements in ISO/IEC 17021-1:2015, 7.1.1 apply.7.1.2 Determination of competence criteriaThe requirements in ISO/IEC 17021-1:2015, 7.1.2 apply. In addition, the following requirements and guidance apply.2 ISO/IEC 2017 All rights reservedBS ISO/IEC 20000-6:2017ISO/IEC 20000-6:2017(E)5.2 Management of impartialityThe requirements in ISO/IEC 1
