Back to Assessments & Documents
IT Service Management Active

Service Management System Maturity Assessment

A 58-question diagnostic across 8 domains for the owner of the service management system (SMS). It answers two questions: is our service management system, as a whole, governed, planned, evaluated and improved, and which...

Start Assessment

Overview

A 58-question diagnostic across 8 domains for the owner of the service management system (SMS). It answers two questions: is our service management system, as a whole, governed, planned, evaluated and improved, and which practices need a deep dive next? The result therefore has two parts, read separately. Part one is the SMS result from Domains 1 to 7 (40 questions): context and scope, leadership, policy and roles, planning, support, service portfolio and planning, performance evaluation, and nonconformity and improvement, tested at system level. Part two is the Practice Health Snapshot, questions 8.1 to 8.18: one self-evaluation per service management practice, reported as a separate practice profile that names the deep-dive model and the questions to run next for each weak practice.

Detailed Description

Many organizations run sound individual practices, such as incident, change or service level management, yet have no system that holds them together: no agreed scope, no single policy above the practice policies, no plan with measurable objectives, no audit program, and no management review that acts on results. This assessment tests that system at the level of the whole, following the clause structure of ISO/IEC 20000-1:2018 without re-testing practice depth. Domain 1 covers context, interested parties and service requirements, the SMS scope, the process interface map and processes run by other parties. Domain 2 covers top management commitment, the Service Management Policy, alignment of practice policies, the SMS owner and process owners, the governance forum and decision rights, and integration with other management systems. Domain 3 covers the SMS risk approach, risk and opportunity actions, the Service Management Plan and objectives, the objective cascade, delivery plans and control of changes to the SMS itself. Domain 4 covers resources, competence, awareness, communication and documented information control. Domain 5 covers the service portfolio view, planning against demand, budget and capacity, operational control, delivery to plan, control of other parties, the new or changed service gate and the portfolio review. Domain 6 covers the measurement plan, internal audit, auditor independence, management review, service reporting to governance and certification readiness. Domain 7 covers nonconformity routing, corrective action effectiveness, SMS-level improvements, automations and AI agents acting in SMS processes, and the annual SMS maturity review. These seven domains give the SMS result. Domain 8, the Practice Health Snapshot, has its own row on the Dashboard and is read as a separate practice profile, question by question, so that one weak practice does not hide a sound system, or the reverse. The workbook's overall percentage includes all 58 questions, so use the Domain 1 to 7 rows when judging the SMS itself. Owner's note: Questions 8.1 to 8.18 are practice self-evaluations: rate Documented for the policy, process and procedures kept current; Implemented for consistent use with configured tools; Effective for the deep-dive measure at target. The result points to the matching deep-dive model and the questions to run next. In the snapshot recommendations, a "Q" prefix refers to the deep-dive model, not to this model: "Q2.4" means question 2.4 of the named deep-dive model.

Assessment Details

Audience

Primary: the SMS owner, head of service management or chief information officer. Secondary: top management and governance forum members, practice and process owners, service owners and delivery teams, and internal audit, risk and compliance staff.

Purpose

Gives the SMS owner two clear results. The SMS score shows whether the system that holds the practices together is defined, run and improved: scope, policy, ownership, plan and objectives, resources, audit, management review and corrective action. The practice profile shows which of 18 practices are weak and points each gap to the deep-dive model and the exact questions to run next, so assessment effort goes where it is needed. Together they give a prioritized, evidence-based improvement plan and a view of readiness for ISO/IEC 20000-1 certification or customer assurance.

Effort

Initial assessment: 8 to 12 hours of facilitated sessions over one to two weeks with the SMS owner and service management office, top management, practice and process owners, service owners and internal audit, starting with a 30-minute session with every area for the four all-area questions. The 18 snapshot questions take about 5 minutes each with the practice owner. Evidence gathering: the SMS Scope Statement, Service Management Policy, Service Management Plan, roles and ownership matrix, process interface map, document register, portfolio review record, audit program and reports, management review minutes and the practice policies and performance reports named in Domain 8. Reassessment: 4 to 6 hours.

Cadence

Annually, ahead of the management review, and after a change in SMS scope, a reorganization, a major sourcing or integrator change, a certification audit or a significant service failure.

Framework Alignment

ISO/IEC 20000-1:2018 ISO/IEC 20000-2:2019 ITIL 4 COBIT 2019 ISO/IEC 20000-3:2019 ISO/IEC TR 20000-7:2019 ISO 19011:2026 ISO/IEC 27001:2022 ISO/IEC 42001:2023 IIA Three Lines Model OWASP Top 10 for Agentic Applications 2026

KPIs

  • SM Objectives on Track - Share of service management objectives on track or achieved at the last plan review. Target: at least 80%.
  • Service Level Targets Met - Share of agreed service level targets met in the period across in-scope services. Target: at least 95%.
  • Audit Program Coverage - Share of SMS requirements and processes audited within the program cycle. Target: 100%.
  • Repeat Nonconformities - Number of SMS nonconformities that recur within 12 months of closure. Target: 0.
  • SMS Roadmap Actions on Schedule - Share of SMS maturity roadmap actions due in the period completed on schedule. Target: at least 80%.

Dependencies

Service Desk (v7.9.6): deep dive for service desk and request fulfilment; owns the Service Desk Charter and Service Desk KPI Framework (4.2, 6.1, 7.4, 7.5, 8.1). Incident Management (v9.9.6): deep dive for incident management; owns the incident policy, process, performance report and the Automation and AI Agent Authority Standard (1.4, 2.3, 2.4, 4.2, 4.3, 6.1, 6.5, 7.4, 8.2, 8.14). Problem and Root Cause Management (v8.9.6): deep dive for problem management; owns the problem policy and performance report. Post-Incident Review and RCA Quality (v4.9.6) is the linked deep dive when root causes are often unconfirmed or actions do not stop repeats (1.4, 2.3, 2.4, 4.2, 4.3, 6.1, 6.5, 7.5, 8.3). Change Management (v8.9.6): deep dive for change; owns the change policy, process, authority matrix and CAB terms, performance report and Standard Change Library; uses SMS change control (1.4, 2.3, 2.4, 2.5, 3.6, 4.1, 4.2, 5.3, 6.1, 7.4, 8.4). Configuration Management (v9.9.6): deep dive for configuration; owns the configuration policy and performance and value report (1.4, 2.3, 2.4, 4.2, 4.3, 6.1, 6.2, 7.4, 7.5, 8.5). Service Transition, Release and Deployment (v5.9.6): deep dive for release and deployment; owns the Service Transition Policy and Transition Performance Report and runs the transition behind the new or changed service gate (2.3, 3.6, 5.6, 8.6). Knowledge Management (v10.9.6): deep dive for knowledge; owns the KM Policy and KM Performance Workbook (1.4, 2.1, 2.3, 2.4, 4.5, 6.2, 6.4, 7.5, 8.7). Technology Service Catalog (v10.9.6): deep dive for the service catalog; owns the catalog index, pipeline, acceptance criteria, policy and performance workbook; the portfolio decisions stay here (1.3, 2.3, 4.1, 4.4, 4.5, 5.1, 5.2, 5.6, 5.7, 8.8). Service Level Agreements and Performance (v5.9.6): deep dive for service level management; owns the SLA Register, SLM Policy, report pack standard and underpinning agreements (1.2, 1.4, 1.5, 2.3, 2.4, 4.1, 4.2, 4.4, 5.4, 5.5, 6.5, 8.9). Continual Service Improvement (v8.9.6): deep dive for improvement; owns the Continual Improvement Register, policy, annual plan and dashboard, and uses the Management Review Minutes owned by this model (2.1, 2.2, 2.4, 2.5, 2.6, 3.2, 3.3, 3.5, 4.1, 4.3, 6.3, 6.4, 6.6, 7.1, 7.2, 7.3, 7.5, 8.18). Service Integration and Management (SIAM) (v6.9.6): deep dive for supplier and integrator control; owns the cross-provider RACI, process manual, provider register, performance scorecard and, for now, the Supplier Management Policy (1.3, 1.5, 2.5, 5.3, 5.5, 6.4, 7.4, 7.5, 8.13). Capacity Performance Management (v6.9.6): deep dive for capacity; owns the capacity policy, Capacity Report and Enterprise Capacity Plan (2.3, 2.4, 4.1, 5.2, 6.2, 7.5, 8.10). Service Availability Management (v6.9.6): deep dive for availability; owns the availability policy and Availability Report. Data Center and Facilities Operations (v7.9.6) is the linked deep dive where critical services run in owned or colocation data centers (2.3, 2.4, 6.2, 7.5, 8.11). Business Continuity and Disaster Recovery Management (v6.9.6): linked model for service continuity; owns the continuity policy, Exercise Report and Continuity Management Review Record (2.6, 6.2, 6.4, 8.12). SRE, DevOps and ITSM Convergence (v4.9.6): bridge only; takes SMS ownership and the measurement plan and supplies no Input (2.1). Monitoring and Event Management (v4.9.6): deep dive for monitoring and events; owns the monitoring policy and Monitoring Performance Report (8.15). Technology Governance and Strategy (v10.9.6): the technology governance hub; owns the Technology Policy Framework and the Technology Decision Rights Matrix used for policy registration and forum authority (2.3, 2.5). IT Performance Management (v6.9.6), IT Budget and Financial Management (v9.9.6), IT Demand Management (v9.9.6) and Business Relationship Management (BRM) (v10.9.6): own the KPI Catalog, objective cascade map, cost allocation model, demand register and relationship plans used for objectives and service planning; BRM is also the deep dive for 8.16 (1.1, 1.2, 3.3, 3.4, 4.4, 5.2, 5.4, 5.7, 6.1, 6.4, 8.16). Technology Workforce Readiness (v6.9.6), IT Compliance and Control Assurance (v4.9.6) and Value Realization and Investment ROI (v7.9.6): own the Technology Skills Framework, compliance obligations and value tracking used for competence, certification readiness and portfolio review (4.2, 5.7, 6.6). IT Risk Management (v7.9.6), Enterprise Risk Management (v7.9.6) and Cyber Risk Management (v8.9.6): own the IT Risk Register, Technology Risk Tolerance Statement and Combined Assurance Map used for SMS risk; the register stays with IT Risk Management (1.1, 3.1, 3.2, 6.2, 8.14). Security Operations Center Cyber and Incident Response (v8.9.6): deep dive for the information security interface; owns the security monitoring and incident policy and SOC Performance Framework (2.6, 8.14). Information Security Management System (v8.9.6), the ISMS hub, owns the Information Security Policy and its Topic-Specific Policy Index and is the route for the information security policy and the wider ISMS (2.6, 8.14). Records and Information Management (v1.9.6) and IT Asset Management (v6.9.6): own the Records Retention Schedule and Compliance Obligations Register; IT Asset Management is also the deep dive for 8.17 (4.5, 6.6, 8.17). Recommended: Run this model first in the IT Service Management family, ahead of the management review, then run the deep dives the practice profile points to, starting with the practices rated lowest and the questions named in each recommendation.

Assessment Outline

(8 domains · 58 questions)
  1. 1

    1 SMS Context and Scope

    Context and issues, interested parties and service requirements, SMS scope statement, SMS design and process interface map, processes run by other parties

    • 1.1 SMS Context 1 questions
    • 1.2 Interested Parties and Service Requirements 1 questions
    • 1.3 SMS Scope Statement 1 questions
    • 1.4 SMS Process Interface Map 1 questions
    • 1.5 Processes Run by Other Parties 1 questions
  2. 2

    2 Leadership, Policy and Roles

    Top management commitment, Service Management Policy, practice policies under the policy and the Technology Policy Framework (Hub A), SMS owner and process ownership, governance forum and delegated authority, integration with other management systems

    • 2.1 Top Management Commitment 1 questions
    • 2.2 Service Management Policy 1 questions
    • 2.3 Practice Policy Alignment 1 questions
    • 2.4 SMS Owner and Process Ownership 1 questions
    • 2.5 SMS Governance Forum and Decision Rights 1 questions
    • 2.6 Integration with Other Management Systems 1 questions
  3. 3

    3 Planning: Risks, Objectives and the SM Plan

    SMS risk approach and acceptance criteria (IT Risk register), risk and opportunity actions, Service Management Plan and objectives, objective cascade (IT Performance KPI Catalog), plans to achieve objectives, SMS change control

    • 3.1 SMS Risk Approach 1 questions
    • 3.2 Risk and Opportunity Actions 1 questions
    • 3.3 Service Management Plan and Objectives 1 questions
    • 3.4 Objective Cascade and Measures 1 questions
    • 3.5 Plans to Achieve Objectives 1 questions
    • 3.6 SMS Change Control 1 questions
  4. 4

    4 Support of the SMS

    Resources across practices, SMS competence (Technology Workforce Readiness), awareness, communication plan, documented information register and control

    • 4.1 SMS Resources 1 questions
    • 4.2 SMS Competence 1 questions
    • 4.3 SMS Awareness 1 questions
    • 4.4 SMS Communication Plan 1 questions
    • 4.5 Documented Information Control 1 questions
  5. 5

    5 Service Portfolio and Service Planning

    One portfolio view, planning services against demand, budget and capacity, operational planning and control, delivery to plan, control of other parties, new or changed service gate, portfolio review decisions

    • 5.1 Service Portfolio View 1 questions
    • 5.2 Service Planning Against Demand, Budget and Capacity 1 questions
    • 5.3 Operational Planning and Control 1 questions
    • 5.4 Service Delivery to Plan 1 questions
    • 5.5 Control of Other Parties 1 questions
    • 5.6 New or Changed Service Gate 1 questions
    • 5.7 Service Portfolio Review 1 questions
  6. 6

    6 Performance Evaluation

    SMS measurement plan (KPI Catalog), internal audit program, auditor independence and results, management review, service reporting (bridge), certification readiness

    • 6.1 SMS Measurement Plan 1 questions
    • 6.2 SMS Internal Audit Program 1 questions
    • 6.3 Auditor Independence and Audit Results 1 questions
    • 6.4 Management Review 1 questions
    • 6.5 Service Reporting to Governance 1 questions
    • 6.6 Certification and External Assessment Readiness 1 questions
  7. 7

    7 SMS Nonconformity and Improvement

    Nonconformity routing to the Continual Improvement Register, corrective action effectiveness, SMS-level improvements, automation and AI agents as process performers, annual SMS maturity review

    • 7.1 Nonconformity Routing 1 questions
    • 7.2 Corrective Action Effectiveness 1 questions
    • 7.3 SMS-Level Improvements 1 questions
    • 7.4 Automation and AI Agents in the SMS 1 questions
    • 7.5 Annual SMS Maturity Review 1 questions
  8. 8

    8 Practice Health Snapshot

    One outcome-level question per ITSM practice owned by a deep dive: is the practice defined, run consistently, measured and improving; each routes a low score to its deep dive

    • 8.1 Service Desk and Request Fulfilment 1 questions
    • 8.2 Incident Management 1 questions
    • 8.3 Problem Management 1 questions
    • 8.4 Change Management 1 questions
    • 8.5 Configuration Management 1 questions
    • 8.6 Release and Deployment 1 questions
    • 8.7 Knowledge Management 1 questions
    • 8.8 Service Catalog Management 1 questions
    • 8.9 Service Level Management 1 questions
    • 8.10 Capacity and Performance Management 1 questions
    • 8.11 Availability Management 1 questions
    • 8.12 Service Continuity 1 questions
    • 8.13 Supplier Management 1 questions
    • 8.14 Information Security Interface 1 questions
    • 8.15 Monitoring and Event Management 1 questions
    • 8.16 Business Relationship Management 1 questions
    • 8.17 IT Asset Management 1 questions
    • 8.18 Continual Service Improvement 1 questions

At a Glance

Category IT Service Management
Type Free
Roles 6
Domains 8
Questions 58
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance