ISO/IEC 38500:2024
(Main)Information technology — Governance of IT for the organization
Information technology — Governance of IT for the organization
This document provides guiding principles for members of governing bodies of organizations and those that support them on the effective, efficient and acceptable use of information technology (IT) within their organizations. This document is applicable to: — the governance of the organization’s current, and future, use of IT; — the governance of IT as a domain of governance of organizations. In terms of audience, this document is applicable to: — all organizations, including public and private companies, government entities, and not-for-profit organizations; — organizations of all sizes, from the smallest to the largest, regardless of the extent of their use of IT.
Technologies de l'information — Gouvernance des technologies de l'information pour l'entreprise
General Information
Relations
Standards Content (Sample)
International
Standard
ISO/IEC 38500
Third edition
Information technology —
2024-02
Governance of IT for the
organization
Technologies de l'information — Gouvernance des technologies
de l'information pour l'entreprise
Reference number
© ISO/IEC 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2024 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Good governance of IT . 3
4.1 Outcomes of good governance of IT .3
4.1.1 Overview .3
4.1.2 Effective performance .3
4.1.3 Responsible stewardship .4
4.1.4 Ethical behaviour .4
4.2 Principles, model and framework.4
5 Principles for the governance of IT . 5
5.1 Overview .5
5.2 Purpose .6
5.2.1 Principle .6
5.2.2 Governance implications for use of IT .6
5.2.3 Outcomes .7
5.3 Value generation.7
5.3.1 Principle .7
5.3.2 Governance implications for use of IT .7
5.3.3 Outcomes .7
5.4 Strategy .8
5.4.1 Principle .8
5.4.2 Governance implications for use of IT .8
5.4.3 Outcomes .8
5.5 Oversight . .8
5.5.1 Principle .8
5.5.2 Governance implications for use of IT .8
5.5.3 Outcomes .9
5.6 Accountability .9
5.6.1 Principle .9
5.6.2 Governance implications for use of IT .9
5.6.3 Outcomes .10
5.7 Stakeholder engagement .10
5.7.1 Principle .10
5.7.2 Governance implications for use of IT .10
5.7.3 Outcomes .10
5.8 Leadership .11
5.8.1 Principle .11
5.8.2 Governance implications for use of IT .11
5.8.3 Outcomes .11
5.9 Data and decisions .11
5.9.1 Principle .11
5.9.2 Governance implications for use of IT .11
5.9.3 Outcomes . 12
5.10 Risk governance . 12
5.10.1 Principle . 12
5.10.2 Governance implications for use of IT . 12
5.10.3 Outcomes . 13
5.11 Social responsibility . 13
5.11.1 Principle . 13
5.11.2 Governance implications for use of IT . 13
© ISO/IEC 2024 – All rights reserved
iii
5.11.3 Outcomes . 13
5.12 Viability and performance over time. 13
5.12.1 Principle . 13
5.12.2 Governance implications for use of IT .14
5.12.3 Outcomes .14
6 Model for the governance of IT . 14
6.1 Introduction .14
6.2 Governance of IT practice . 15
6.2.1 Engage stakeholders . 15
6.2.2 Evaluate . 15
6.2.3 Direct .16
6.2.4 Monitor .16
6.3 Management of IT practice .16
6.4 Framework for the governance of IT .16
7 Framework for the governance of IT .
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.