Do outsourced providers and suppliers need to be included in the SMS?

They often do, especially when they contribute directly to the delivery or support of services within scope. ISO/IEC 20000-1 expects organizations to control supplier relationships where external parties affect service performance, service continuity, or service commitments. This does not always mean every vendor is treated the same way, but it does mean critical service dependencies must be visible and governed within the service management system.