The ITSS IT Service Standards Guide

The Short Answer

If you only remember three sentences, remember these three:

One, ITSS is the domestic tier-based proof of IT service capability. It belongs to the standards system and capability assessment of the domestic information technology service field. The focus is the actual capability level of IT services — especially operations and maintenance (O&M) services — not how polished a management manual reads. The assessment conclusion lands on the question of "which tier is reached".

Two, ITSS and ISO 20000 are two different lines. ISO 20000 is certification of a management system (ITSMS) under an international standard: it asks whether you have a service management system that can operate sustainably. ITSS is a domestic capability assessment: it asks how far you actually get in specific service scenarios. Neither substitutes for the other; many companies do both, and tender documents often list them side by side.

Three, the usual driver for ITSS is tendering and market entry. IT tenders for O&M services from government bodies and state-owned enterprises, and the entry conditions large enterprises set when choosing O&M suppliers, are the two scenarios where ITSS is cited relatively often in practice. So whether to do it, and which tier to target, is usually a market judgement rather than a technical one.

What ITSS Assesses: Service Capability, Not Document Volume

Many companies meeting ITSS for the first time treat it as "writing another set of documents". That is the wrong direction. For management system certification such as ISO 20000, the core deliverables really are system documents and operating records; for an ITSS capability assessment, the focus is whether you can deliver O&M services consistently.

In detail, the assessment usually looks at several capability elements: people (role design, capability requirements, development and backup), process (service levels, incident and problem, change and release, continuity and availability, and so on), technology (tooling platforms, the level of monitoring and automation) and resources (knowledge base, spare parts, service catalogue and resource allocation). How these are divided and how granular the requirements are is subject to the standards and assessment rules in force.

Put another way: ITSS wants to see whether the service has someone accountable, a process to fall back on, tooling to support it and knowledge that accumulates. If any one of these four is empty, the tier cannot be raised — because the assessment looks at operating evidence, not at promises.

What Evidence the Assessment Looks At: Four Categories Decide the Outcome

The problem with a capability assessment is "clear in conversation, impossible to produce". What assessors actually go through roughly falls into these four categories:

These four categories share one feature: they are all "run out", not "written out". Two or three months of backfilling documents may produce a set of text, but it cannot produce half a year of ticket curves. So the real starting point is usually to get the service process running to a standard first, and only then talk about applying.

Which Companies It Suits

Not every company needs ITSS. The test is plain: does your revenue come from running IT for someone else. If the answer is no, the priority usually sits lower.

If you are still comparing several systems, start with the standards overview and put the domestic and the international lines side by side; for supporting qualifications on the information security side see CCRC information security, and if you need someone alongside to get the processes running, the scope is set out under services.

Difference from CMMI / CSMM: One Looks at Service, One at Delivery

These three are often put into the same "software company qualification list", which leads many people to assume they can stand in for each other. In fact the directions are entirely different.

The distinction in one sentence: ITSS cares about "how well you run the system once it has been handed over to you"; CMMI / CSMM care about "how you built it before it was handed over". One faces the operating phase, the other the build phase. Companies that do integration plus O&M are asked for both; purely R&D-oriented companies usually need only the latter.

Further reading: DCMM data management capability maturity (which assesses data management capability, yet another direction), and how to choose between ITSS / CMMI / DCMM / CSMM. The four systems have different objectives: rank them first by what the customer asks for, then by what foundation you have internally, and the answer is usually clear.

Key Information