ITSS Certification: Conditions, Materials & Timeline

Bottom line first: ITSS is the "national-standard" form of proof for IT service capability in China. It does not look at your product; it looks at whether you have built O&M service delivery into a system — whether you have a service catalogue and SLAs, whether the right people and tools are in place, and whether you can produce service records that hold up when someone checks them. It comes up fairly often in informatisation O&M projects run by government bodies, central SOEs and state-owned enterprises, and many tender documents list it alongside ISO 20000.

But the two are not interchangeable. ISO 20000 is a management system certification against an international standard, asking whether your service management system is compliant and can be sustained; ITSS is a service capability assessment under a domestic standards system, asking what level your O&M capability has reached. They measure different dimensions, which is why many companies do both — the industry often calls ISO 20000 and ITSS the "dual standard" for IT service capability. As for which to do first, and whether one system build can yield both certificates, sections 6 and 7 set out the practical sequence.

1. What ITSS is: its position in one sentence

ITSS stands for Information Technology Service Standards — a standards system for IT services developed in China, covering basic IT service standards, service control and service business, among other areas. The standards system itself is a set of standards, not a certificate. Its focus differs from other qualifications in the management systems section: ISO 27001 covers information security, ISO 20000 covers service management, CCRC covers security services, and ITSS covers the capability level of O&M services.

When a company says it is "doing ITSS", it usually means the set of assessments tied to O&M service capability — colloquially "ITSS certification" or "ITSS O&M service capability assessment". These assess four capability elements together:

• Personnel — whether job roles, competence requirements, training and appraisal form a system
• Process — whether incident, problem, change, release and configuration processes are clearly defined and actually followed
• Technology — whether monitoring, ticketing and knowledge-base tools do the work, instead of relying on memory
• Resources — whether spare parts, the knowledge base, the service desk and the service catalogue can be reused

In one sentence: it translates "we have a few brilliant engineers" into "we have a service capability that can be replicated". That is exactly what a tender buyer wants — not a team's personality, but a service that can be delivered and held to account.

2. How the levels are divided and what each level means

ITSS O&M service capability is graded by maturity level: the higher the level, the stricter the requirements on how fully the capability elements are covered, on quantification, and on evidence of continual improvement. The industry commonly describes it as grading from level one to level four, but the exact number of levels, their names and the thresholds at each level change from year to year and between assessment directions — subject to the latest requirements of the ITSS branch / assessment body.

Set the numbering aside and look only at substance: there are roughly three tiers:

Start at entry or intermediate level; do not jump straight to the top. The level measures capability and records, not years in business and not turnover. If you aim too high and any one of the three — personnel, contracts, records — does not line up, the documents will be sent back at pre-review, and the rework costs far more than starting one level lower.

3. Which companies should do it, and which can defer it

There is only one test: are you providing IT O&M services to external clients, and can you prove it with a contract? Among companies that pass, demand is concentrated in these types:

Three cases that can wait: pure product companies with no external O&M contracts; businesses that have only just started and cannot yet produce a single complete annual O&M contract; and companies that want "a certificate first" and will not actually run services to process in the short term — for that last group, even with the certificate in hand, annual maintenance and the next re-assessment will be an uphill struggle.

4. Eligibility: four hard thresholds

The specific thresholds move with the level, but the skeleton is these four — miss one and your level is capped:

Quantitative thresholds such as headcount, the number and value of contracts, and the number of premises or service desks differ by level and follow the rules in force at the time — subject to the latest requirements of the ITSS branch / assessment body. Do not copy a peer's old list: what a peer filed last year and what it needs to file this year may not be the same set of requirements.

5. Document list: what the review is really looking at

Grouping documents into four categories works better than following the "item numbers in some template", because the review asks whether the four categories corroborate one another:

Prepare documents in reverse order: first settle the service catalogue and SLA → then processes and posts → then staff and tools → only then write the documents → and collect at least 1-3 months of real records. Doing it the other way round — writing the documents first and filling in records afterwards — is the usual cause of rework.

6. Assessment process, timeline and cost range

The process runs to roughly eight steps, and the "record trial run" is the part companies commonly leave out of their schedule:

Timeline range: in typical cases, the period from starting preparation to receiving a result falls within 2-6 months. The span depends mainly on four things — the level, how much of a system and how many records already exist, how many months of records need to be built up, and the assessment body's scheduling. Companies that already run an ISO 20000 system usually land towards the lower end of the range, because the service catalogue, SLAs, and incident and change processes are already in place; those starting from zero, without even a ticketing system, move towards the upper end. Schedules precise to the week are subject to the assessment body's arrangements for the current period.

Cost range: total investment generally consists of two parts — assessment-related fees (charged by the assessment body under its own rules, and tied to level, headcount and number of service premises) + consulting fees (system building, documents, record coaching, on-site support). Overall it usually falls in a range of tens of thousands of RMB; the higher the level, the more premises, and the bigger the gaps to close, the further up the figure moves. Whether tooling (ticketing or monitoring systems) is included is counted separately. Specific amounts are subject to the latest quotations from the assessment body and the service provider; if someone quotes a fixed figure without looking at headcount and premises, it is worth asking one more question: "what exactly does this price include?"

Certificate and maintenance: an ITSS certificate has a validity period. During it you must accept surveillance or maintenance assessment as required, and arrange re-assessment before expiry; letting process-based service delivery lapse after certification, so that records break off, is the main reason companies get stuck at the maintenance stage. The length of validity and the specific maintenance arrangements are subject to the latest requirements of the ITSS branch / assessment body.

7. How it relates to ISO 20000, CCRC and CMMI

These four certificates often appear in the same tender document, but they examine four different things. They do not replace one another, and cannot stand in for one another.

Two practical sentences:

• ISO 20000 system documents can be reused for ITSS. The service catalogue, SLAs, incident / problem / change / release / configuration processes, the service desk and the knowledge base overlap heavily. Doing ISO 20000 first and ITSS second clearly cuts the document workload for ITSS; in the other order — ITSS first, then adding ISO 20000 — what you add is mainly the general management-system components (policy and objectives, internal audit, management review, document control, continual improvement).
• But the two sets of records cannot simply be submitted as one and the same. ITSS looks more at the actual execution trail of O&M services (tickets, inspections, monthly reports, SLA attainment), while ISO 20000 looks more at evidence that the system is running (internal audit, management review, correction of nonconformities, service reviews). The same tickets can support both sides, but the statistics need to be compiled separately, each with its own criteria and aggregation.

8. Common pitfalls: six real rework points

• Writing documents but no records. Documents can be written in a day; records have to grow. The review asks whether you actually worked to the documents once they took effect — if the documents are dated later than the tickets, you have proved non-execution yourself.
• Mismatched entities. Contract with an affiliate, social insurance at head office, staff at the branch on the project site — three entities that do not line up is one of the more frequently returned problem types. Before applying, reconcile the three tables: entity, personnel, contracts.
• Aiming too high on level. The level follows from capability and evidence, not from intention. Starting one level lower, running a year of records and then moving up saves more time than a single leap that gets sent back.
• Passing off tool screenshots as capability. Buying a ticketing system but having only three test records in it earns no credit — it exposes the tool as decoration. Either use it for real, or describe your current stage honestly.
• Ignoring maintenance once certified. The certificate has a validity period and surveillance must be accepted within it. Once service records break off, the next assessment is effectively a fresh start.
• Confusing ITSS with ISO 20000. One failure mode is assuming that having done one makes the other unnecessary, and being disqualified at tender; the other is building two completely independent sets of documents and doubling the effort for nothing. The right approach is one system, two sets of evidence criteria, filed separately.

Action checklist

Go through this in order before you start; move on only when you can give a concrete answer to each line:

• ⬜ I can state clearly which type of O&M service customers paid for over the past 1-2 years (on-site, remote, data centre hosting, annual maintenance)
• ⬜ I hold contracts corresponding to that service, and the contracting entity, the performing entity and the social insurance entity are the same company
• ⬜ I have confirmed the target level and know its approximate requirements on headcount, contracts and premises (subject to the requirements in force)
• ⬜ I have usable ticketing / monitoring tools that are already producing real data
• ⬜ I can set aside at least 1-3 months of record trial run, and I am not counting on filling records in while applying
• ⬜ I know the sequence of ITSS and ISO 20000 in my case, and which documents can be shared
• ⬜ I have confirmed which certificate and which level the tender document / customer requirement actually names, rather than "hearing that we need it"

If fewer than four of these seven can be ticked, now is not the time to submit an application — closing the gaps first is much faster than submitting and being sent back. Where things are unclear, you can also contact us directly and go through it line by line.

Conclusion: map the evidence first, then talk about the timeline

With ITSS, the difficulty has never been in the clauses of the standard, but in turning the service you already deliver into a chain of verifiable evidence: the contract shows you are doing it, the people show who does it, the processes show how it is done, and the records show it was really done. String the four together and the level follows naturally; miss one and you have to go back to the business floor to fill the gap.

So the order is always: map the business and the evidence first → then settle the direction and level → only then talk about documents and timeline. Do it the other way round and, however polished the documents are, you will not get past the on-site interview.

▍Not sure which level to apply for, or want to know how to sequence ITSS and ISO 20000? Leave a comment or message me with "ITSS self-check" and I will send you a line-by-line comparison checklist.