A cloud provider already follows ITIL practices and now wants an independent, third-party certification of its IT service management capability that it can show to customers. What should it pursue?
Select an answer to reveal the explanation.
Short Explanation
ITIL is the cookbook; ISO/IEC 20000-1 is the health inspection that hands you a certificate. You can follow ITIL recipes and then prove it with 20000-1. The trap is thinking the cookbook itself comes with a certificate for your whole company.
Full Explanation
ISO/IEC 20000-1 specifies requirements for an organization to establish, implement, maintain and continually improve a service management system, covering service planning, design, transition, delivery and improvement. Because it is a requirements standard, accredited certification bodies can audit against it and issue certificates, giving customers independent assurance of the provider's service management capability. Many organizations use ITIL practices to meet its requirements. ITIL is a best-practice framework published as guidance; individuals earn ITIL qualifications, but there is no organizational ITIL certification against which a provider can be audited. ISO/IEC 27001 is the requirements standard for an information security management system; it is certifiable, but it certifies security management, not IT service management. COBIT is a governance and management framework for enterprise information and technology; organizations may assess capability or maturity against it, but it is not an international certification standard for service operations. Exam caveat: the 2026 outline lists ITIL and ISO/IEC 20000-1 side by side, so distinguishing guidance from certifiable requirements is a likely test point. Operational check: confirm the planned certification scope names the specific cloud services, that the certification body is accredited, and that internal audits and management reviews required by the standard are already running before the external audit.