ISO/IEC 19770

What is ISO/IEC 19770?

ISO 19770 is the ISO/IEC family of standards for IT asset management. Its Part 1, ISO/IEC 19770-1:2017, specifies requirements for an IT asset management system. ISO and IEC publish it through committee JTC 1/SC 7. Organisations of all types and sizes can apply it, to all types of IT assets.

The current edition of Part 1 is ISO/IEC 19770-1:2017 (Edition 3), Information technology — IT asset management — Part 1: IT asset management systems — Requirements. It was published in December 2017, and Amendment 1 (Amd 1:2024) added climate action changes in February 2024. The committee is ISO/IEC JTC 1/SC 7, Software and systems engineering.

ISO last reviewed and confirmed the 2017 edition in 2024, so it remains current. The ISO page for ISO/IEC 19770-1 lists no revision under way.

The series has other parts. This entry covers Part 1, the management system requirements; check the ISO catalogue for the current edition of any other part before you cite it.

Why it matters

ISO 19770 matters when someone asks you to show how you manage IT assets and your honest answer is a spreadsheet. The question tends to arrive in a customer questionnaire, a tender or a contract clause, not from a regulator.

The reasons organisations manage IT assets formally are familiar: knowing what you own, keeping software licences in order, controlling cost and understanding risk. ISO/IEC 19770-1 asks for those concerns to be run as a management system, with the organisation's own context at the centre.

An asset list tells you what you had when someone last counted. A management system tells you what you have now.

Who it applies to

ISO/IEC 19770-1 can be applied by any organisation, of any type or size, and to any type of IT asset. In practice it is most relevant to organisations that hold a large or fast-changing estate of hardware, software and cloud services, and to those whose customers ask how that estate is controlled. A small firm with a handful of devices is unlikely to be asked.

We found no law or regulator that requires ISO/IEC 19770-1. Treat it as voluntary unless a customer or supplier contract names it, at which point it becomes a contractual requirement for you.

ISO 27001 manages information security risk; ISO/IEC 19770-1 manages IT assets as a management system in their own right, and holding one does not show you meet the other. The overlap is the asset inventory. ISO 27001 control A.5.9 Inventory of information and other associated assets asks for one, and an ISO 27001 programme that struggles to keep it current is the natural place to ask whether a fuller IT asset management system is worth having.

The UK position

We found no UK law or regulator that names ISO/IEC 19770. A UK firm is most likely to meet it commercially: when a customer, a supplier contract or a tender asks for IT asset management to a recognised standard, or when an ISO 27001 programme raises the question. That is our reading; no primary source confirms it.

If you are asked about ISO 19770 and cannot tell whether the request means certification or simply a documented process, ask the customer which they mean before you commit.

Key requirements

ISO/IEC 19770-1 is a requirements standard for a management system, based on the Plan-Do-Check-Act cycle. ISO's abstract and the JTC 1/SC 7 committee's summary describe its shape:

• A management system in context. Requirements to establish, implement, maintain and improve an IT asset management system, shaped by the organisation's own circumstances.
• 15 process areas. A normative annex (Annex A) sets out 15 IT asset management process areas the standard expects an organisation to have.
• Three tiers for implementation order. An informative annex (Annex B) suggests an order: trustworthy data, then life cycle integration, then optimisation.
• IT assets, not information itself. It covers every type of IT asset, but it is not meant for managing information as an asset apart from the hardware and software that hold it.
• No financial, accounting or technical rules. It does not set these for any specific type of IT asset.
• Assessment by others. Internal and external parties can use it to assess whether an organisation meets its own IT asset management requirements.

A standard that stays out of your accounting and tooling choices still expects you to have a system that works.

Relationship to ISO 55001

ISO/IEC 19770-1 is a discipline-specific extension of ISO 55001:2014, with changes. ISO 55001 was written mainly for physical assets, and ISO/IEC 19770-1 adds requirements specific to IT assets. Conformance to ISO/IEC 19770-1 does not imply conformance to ISO 55001:2014.

Frequently asked questions