IT Service Management Assessment

Service Management System Maturity Assessment

The entry model and hub of the IT Service Management family. It rates the service management system as a whole, from context, scope, policy, ownership and the Service Management Plan through resources, competence, documents, the service portfolio, measurement, internal audit, management review and corrective action, and adds a Practice Health Snapshot of 18 practices that routes each gap to its deep-dive model.

Already have an account? Log in to start

At a glance

Questions: 58
Domains: 8
Working time: Initial assessment: 8 to 12 hours of facilitated sessions over one to two weeks with the SMS owner and service management office, top management, practice and process owners, service owners and internal audit, starting with a 30-minute session with every area for the four all-area questions. The 18 snapshot questions take about 5 minutes each with the practice owner. Evidence gathering: the SMS Scope Statement, Service Management Policy, Service Management Plan, roles and ownership matrix, process interface map, document register, portfolio review record, audit program and reports, management review minutes and the practice policies and performance reports named in Domain 8. Reassessment: 4 to 6 hours.
Repeat: Annually, ahead of the management review, and after a change in SMS scope, a reorganization, a major sourcing or integrator change, a certification audit or a significant service failure.
Roles: 6
Updated: October 2026

Who it is for

SMS Owner and Service Management Office
Top Management and Governance
Practice and Process Owners
Service Owners and Delivery Teams
Internal Audit, Risk and Compliance
Process Owner/Full Model Assessor

Primary: the SMS owner, head of service management or chief information officer. Secondary: top management and governance forum members, practice and process owners, service owners and delivery teams, and internal audit, risk and compliance staff.

What you will gain

Gives the SMS owner two clear results. The SMS score shows whether the system that holds the practices together is defined, run and improved: scope, policy, ownership, plan and objectives, resources, audit, management review and corrective action. The practice profile shows which of 18 practices are weak and points each gap to the deep-dive model and the exact questions to run next, so assessment effort goes where it is needed. Together they give a prioritized, evidence-based improvement plan and a view of readiness for ISO/IEC 20000-1 certification or customer assurance.

About this assessment

Many organizations run sound individual practices, such as incident, change or service level management, yet have no system that holds them together: no agreed scope, no single policy above the practice policies, no plan with measurable objectives, no audit program, and no management review that acts on results. This assessment tests that system at the level of the whole, following the clause structure of ISO/IEC 20000-1:2018 without re-testing practice depth. Domain 1 covers context, interested parties and service requirements, the SMS scope, the process interface map and processes run by other parties. Domain 2 covers top management commitment, the Service Management Policy, alignment of practice policies, the SMS owner and process owners, the governance forum and decision rights, and integration with other management systems. Domain 3 covers the SMS risk approach, risk and opportunity actions, the Service Management Plan and objectives, the objective cascade, delivery plans and control of changes to the SMS itself. Domain 4 covers resources, competence, awareness, communication and documented information control. Domain 5 covers the service portfolio view, planning against demand, budget and capacity, operational control, delivery to plan, control of other parties, the new or changed service gate and the portfolio review. Domain 6 covers the measurement plan, internal audit, auditor independence, management review, service reporting to governance and certification readiness. Domain 7 covers nonconformity routing, corrective action effectiveness, SMS-level improvements, automations and AI agents acting in SMS processes, and the annual SMS maturity review. These seven domains give the SMS result. Domain 8, the Practice Health Snapshot, has its own row on the Dashboard and is read as a separate practice profile, question by question, so that one weak practice does not hide a sound system, or the reverse. The workbook's overall percentage includes all 58 questions, so use the Domain 1 to 7 rows when judging the SMS itself. Owner's note: Questions 8.1 to 8.18 are practice self-evaluations: rate Documented for the policy, process and procedures kept current; Implemented for consistent use with configured tools; Effective for the deep-dive measure at target. The result points to the matching deep-dive model and the questions to run next. In the snapshot recommendations, a "Q" prefix refers to the deep-dive model, not to this model: "Q2.4" means question 2.4 of the named deep-dive model.

What we assess: 8 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 5 questions

1 SMS Context and Scope

Context and issues, interested parties and service requirements, SMS scope statement, SMS design and process interface map, processes run by other parties

02 · 6 questions

2 Leadership, Policy and Roles

Top management commitment, Service Management Policy, practice policies under the policy and the Technology Policy Framework (Hub A), SMS owner and process ownership, governance forum and delegated authority, integration with other management systems

03 · 6 questions

3 Planning: Risks, Objectives and the SM Plan

SMS risk approach and acceptance criteria (IT Risk register), risk and opportunity actions, Service Management Plan and objectives, objective cascade (IT Performance KPI Catalog), plans to achieve objectives, SMS change control

04 · 5 questions

4 Support of the SMS

Resources across practices, SMS competence (Technology Workforce Readiness), awareness, communication plan, documented information register and control

05 · 7 questions

5 Service Portfolio and Service Planning

One portfolio view, planning services against demand, budget and capacity, operational planning and control, delivery to plan, control of other parties, new or changed service gate, portfolio review decisions

06 · 6 questions

6 Performance Evaluation

SMS measurement plan (KPI Catalog), internal audit program, auditor independence and results, management review, service reporting (bridge), certification readiness

07 · 5 questions

7 SMS Nonconformity and Improvement

Nonconformity routing to the Continual Improvement Register, corrective action effectiveness, SMS-level improvements, automation and AI agents as process performers, annual SMS maturity review

08 · 18 questions

8 Practice Health Snapshot

One outcome-level question per ITSM practice owned by a deep dive: is the practice defined, run consistently, measured and improving; each routes a low score to its deep dive

KPIs to track

Measures that show whether the improvements hold.

KPI
SM Objectives on Track - Share of service management objectives on track or achieved at the last plan review. Target: at least 80%.
Service Level Targets Met - Share of agreed service level targets met in the period across in-scope services. Target: at least 95%.
Audit Program Coverage - Share of SMS requirements and processes audited within the program cycle. Target: 100%.
Repeat Nonconformities - Number of SMS nonconformities that recur within 12 months of closure. Target: 0.
SMS Roadmap Actions on Schedule - Share of SMS maturity roadmap actions due in the period completed on schedule. Target: at least 80%.

Framework alignment

Questions are written in plain language and mapped to:

ISO/IEC 20000-1:2018
ISO/IEC 20000-2:2019
ITIL 4
COBIT 2019
ISO/IEC 20000-3:2019
ISO/IEC TR 20000-7:2019
ISO 19011:2026
ISO/IEC 27001:2022
ISO/IEC 42001:2023
IIA Three Lines Model
OWASP Top 10 for Agentic Applications 2026

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

Service Desk (v7.9.6): deep dive for service desk and request fulfilment; owns the Service Desk Charter and Service Desk KPI Framework (4.2, 6.1, 7.4, 7.5, 8.1).

Incident Management (v9.9.6): deep dive for incident management; owns the incident policy, process, performance report and the Automation and AI Agent Authority Standard (1.4, 2.3, 2.4, 4.2, 4.3, 6.1, 6.5, 7.4, 8.2, 8.14).

Problem and Root Cause Management (v8.9.6): deep dive for problem management; owns the problem policy and performance report. Post-Incident Review and RCA Quality (v4.9.6) is the linked deep dive when root causes are often unconfirmed or actions do not stop repeats (1.4, 2.3, 2.4, 4.2, 4.3, 6.1, 6.5, 7.5, 8.3).

Change Management (v8.9.6): deep dive for change; owns the change policy, process, authority matrix and CAB terms, performance report and Standard Change Library; uses SMS change control (1.4, 2.3, 2.4, 2.5, 3.6, 4.1, 4.2, 5.3, 6.1, 7.4, 8.4).

Configuration Management (v9.9.6): deep dive for configuration; owns the configuration policy and performance and value report (1.4, 2.3, 2.4, 4.2, 4.3, 6.1, 6.2, 7.4, 7.5, 8.5).

Service Transition, Release and Deployment (v5.9.6): deep dive for release and deployment; owns the Service Transition Policy and Transition Performance Report and runs the transition behind the new or changed service gate (2.3, 3.6, 5.6, 8.6).

Knowledge Management (v10.9.6): deep dive for knowledge; owns the KM Policy and KM Performance Workbook (1.4, 2.1, 2.3, 2.4, 4.5, 6.2, 6.4, 7.5, 8.7).

Technology Service Catalog (v10.9.6): deep dive for the service catalog; owns the catalog index, pipeline, acceptance criteria, policy and performance workbook; the portfolio decisions stay here (1.3, 2.3, 4.1, 4.4, 4.5, 5.1, 5.2, 5.6, 5.7, 8.8).

Service Level Agreements and Performance (v5.9.6): deep dive for service level management; owns the SLA Register, SLM Policy, report pack standard and underpinning agreements (1.2, 1.4, 1.5, 2.3, 2.4, 4.1, 4.2, 4.4, 5.4, 5.5, 6.5, 8.9).

Continual Service Improvement (v8.9.6): deep dive for improvement; owns the Continual Improvement Register, policy, annual plan and dashboard, and uses the Management Review Minutes owned by this model (2.1, 2.2, 2.4, 2.5, 2.6, 3.2, 3.3, 3.5, 4.1, 4.3, 6.3, 6.4, 6.6, 7.1, 7.2, 7.3, 7.5, 8.18).

Service Integration and Management (SIAM) (v6.9.6): deep dive for supplier and integrator control; owns the cross-provider RACI, process manual, provider register, performance scorecard and, for now, the Supplier Management Policy (1.3, 1.5, 2.5, 5.3, 5.5, 6.4, 7.4, 7.5, 8.13).

Capacity Performance Management (v6.9.6): deep dive for capacity; owns the capacity policy, Capacity Report and Enterprise Capacity Plan (2.3, 2.4, 4.1, 5.2, 6.2, 7.5, 8.10).

Service Availability Management (v6.9.6): deep dive for availability; owns the availability policy and Availability Report. Data Center and Facilities Operations (v7.9.6) is the linked deep dive where critical services run in owned or colocation data centers (2.3, 2.4, 6.2, 7.5, 8.11).

Business Continuity and Disaster Recovery Management (v6.9.6): linked model for service continuity; owns the continuity policy, Exercise Report and Continuity Management Review Record (2.6, 6.2, 6.4, 8.12).

SRE, DevOps and ITSM Convergence (v4.9.6): bridge only; takes SMS ownership and the measurement plan and supplies no Input (2.1).

Monitoring and Event Management (v4.9.6): deep dive for monitoring and events; owns the monitoring policy and Monitoring Performance Report (8.15).

Technology Governance and Strategy (v10.9.6): the technology governance hub; owns the Technology Policy Framework and the Technology Decision Rights Matrix used for policy registration and forum authority (2.3, 2.5).

IT Performance Management (v6.9.6), IT Budget and Financial Management (v9.9.6), IT Demand Management (v9.9.6) and Business Relationship Management (BRM) (v10.9.6): own the KPI Catalog, objective cascade map, cost allocation model, demand register and relationship plans used for objectives and service planning; BRM is also the deep dive for 8.16 (1.1, 1.2, 3.3, 3.4, 4.4, 5.2, 5.4, 5.7, 6.1, 6.4, 8.16).

Technology Workforce Readiness (v6.9.6), IT Compliance and Control Assurance (v4.9.6) and Value Realization and Investment ROI (v7.9.6): own the Technology Skills Framework, compliance obligations and value tracking used for competence, certification readiness and portfolio review (4.2, 5.7, 6.6).

IT Risk Management (v7.9.6), Enterprise Risk Management (v7.9.6) and Cyber Risk Management (v8.9.6): own the IT Risk Register, Technology Risk Tolerance Statement and Combined Assurance Map used for SMS risk; the register stays with IT Risk Management (1.1, 3.1, 3.2, 6.2, 8.14).

Security Operations Center Cyber and Incident Response (v8.9.6): deep dive for the information security interface; owns the security monitoring and incident policy and SOC Performance Framework (2.6, 8.14). Information Security Management System (v8.9.6), the ISMS hub, owns the Information Security Policy and its Topic-Specific Policy Index and is the route for the information security policy and the wider ISMS (2.6, 8.14).

Records and Information Management (v1.9.6) and IT Asset Management (v6.9.6): own the Records Retention Schedule and Compliance Obligations Register; IT Asset Management is also the deep dive for 8.17 (4.5, 6.6, 8.17).

Recommended: Run this model first in the IT Service Management family, ahead of the management review, then run the deep dives the practice profile points to, starting with the practices rated lowest and the questions named in each recommendation.