Templates and records · ISO 20000 · Clause 8.7.2

ISO 20000-1 IT service continuity plan

How each critical service is kept running or recovered when something big fails, and proof that the plan works because it has been rehearsed, not just because it is written down.

In one sentence

The service continuity plan starts from a documented assessment of risks to continuity, sets the recovery requirements agreed with customers, describes how to invoke the plan and restore each service, and is backed by records of its testing at planned intervals and after major changes, because clause 8.7.2 of ISO/IEC 20000-1 requires those plans, their testing and the recording of results, and 7.5.4 includes them in the minimum documented information.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 20000 · Clause 8.7.2 Clauses are cited using the numbering of ISO/IEC 20000-1:2018, the current edition and the same one the Academy uses.
Type of information: Mandatory document Continuity plans maintained (8.7.2 and 7.5.4), with test results recorded
Who fills it in: Service continuity manager With the owners of critical services and customer input on requirements
When: Before critical services are delivered Testing as planned, usually annually, and after major changes
How long it is kept: Set by the organisation The standard requires control of the retention and disposition of documented information (7.5.3) without setting periods. It is usual to cover at least the three-year certification cycle, or the term of the customer contract if longer.

What the standard requires

What ISO 20000 demands and what it leaves to your judgement

The organisation assesses and documents the risks to service continuity and determines its continuity requirements, taking into account business requirements, customer requests, SLAs and risks.

The plans include or reference the criteria and responsibilities for invoking them, what is done in the event of a major loss of service, availability targets while invoked, restoration requirements and the return to normal working. They are tested at planned intervals against the requirements and retested after major changes to the environment; the results are recorded.

When the plan is actually invoked, what happened must be documented in a report. Continuity under ISO/IEC 20000-1 focuses on IT services; for the business as a whole, the reference is ISO 22301.

Read it in context: Service level agreements (SLAs), in the ISO 20000 Academy

Structure

Fields the template should include

Services covered and their criticality
Continuity risks assessed
Recovery requirements: recovery time objective and acceptable data loss
Invocation criteria and responsibilities
Recovery procedure and return to normal
Alternative resources and suppliers involved
Contacts and communication with customers
Test schedule
Result of each test and improvements

Example

Example: email service continuity

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Service	SRV-04 email and collaboration · high criticality
Main risk	Outage of the cloud provider's region
Requirements	Recovery within 4 hours · maximum data loss 15 minutes · agreed in SLA-CLI-07
Invocation	Outage of more than 1 hour with no estimate from the provider · decided by the continuity manager
Recovery	Failover to the secondary region and change of DNS records
Test	22 September 2026 · exercise during a low-activity period
Result	Service restored in 2 h 40 min · 1 shared mailbox not replicated
Improvement	Shared mailboxes included in replication · CHG-26-131

At the audit

Mistakes auditors commonly flag

A plan written and never tested.
Tests with no success criteria against the recovery requirements.
Recovery requirements that do not match what was promised in the SLA.
The test is not repeated after a major infrastructure change.
Contact details in the plan are out of date.

In Kimobox

How this record is kept in Kimobox

1The plan is kept as a controlled document, with versions and read receipts for the staff involved.
2Tests are scheduled as tasks with a date and a reminder, and their result is recorded.
3Improvements arising from each test are processed as changes through the approval workflow.

Frequently asked questions

What people ask us before getting started

How does it differ from ISO 22301?

ISO 22301 is the standard for business continuity management across the whole business. ISO/IEC 20000-1 requires continuity of the IT services agreed with customers. They complement each other: the IT continuity plan is usually one piece of the business continuity plan.

How often must it be tested?

The standard requires testing at planned intervals and after major changes to the environment, without setting a period. An annual test of critical services is the most widespread practice.

Keep your ISO 20000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring