ISO/IEC 38500

What is ISO/IEC 38500?

ISO/IEC 38500, often searched as ISO 38500, is the international standard giving guiding principles on the governance of IT. ISO and IEC publish it through committee JTC 1/SC 40. It is written for members of governing bodies, and those who support them, in organisations of any type or size.

The current version is ISO/IEC 38500:2024, Information technology — Governance of IT for the organization (Edition 3), published in February 2024. It replaces ISO/IEC 38500:2015, which is now withdrawn. The 2015 edition had itself replaced the 2008 edition.

As an ISO/IEC 38500 governance framework, it is guidance for the people who direct an organisation, not a catalogue of technical controls. Its subject is the effective, efficient and acceptable use of IT. The ISO abstract sets out the scope.

Why it matters

The board approves the IT budget, then asks one question: is it on track? That is a management question. Governance asks whether the money is going to the right things, and who answers for the result.

Approving an IT budget is not the same as governing IT.

ISO/IEC 38500 gives a governing body a shared vocabulary and a set of principles for that conversation. The 2015 edition named three purposes: to assure stakeholders, to guide governing bodies, and to establish a vocabulary for the governance of IT. The withdrawn 2015 edition's page records them.

People often compare ISO 38500 with COBIT. The clearest difference is placement. The 2015 edition defined governance of IT as a subset or domain of organisational governance, so ISO/IEC 38500 is a governance-layer standard that sits above IT management. COBIT 2019 reaches below that line into management.

Who it applies to

ISO/IEC 38500 applies to all organisations: public, private, government and not-for-profit, from the smallest to the largest, whatever the extent of their use of IT. The primary audience is the governing body: a board, a council or its equivalent.

The 2015 edition also gave guidance to those who advise or assist governing bodies: executive managers, internal and external service providers (including consultants) and auditors. A CTO or IT director meets the standard mostly as one of those supporters.

On obligation, treat ISO/IEC 38500 as voluntary guidance. ISO describes it as guiding principles, and we found no primary source that makes it a legal or regulatory requirement. A customer or board can still ask you to align with it, which makes it contractual or internal in that case.

The relationship to ISO 27001 is one of level. ISO 27001 is a management-system standard for information security. ISO/IEC 38500 works above management, at the level of the people who direct the organisation and hold management to account. A firm can hold one without the other.

The UK position

A UK firm rarely meets ISO/IEC 38500 through law. We found no UK statute or regulator that names it. It is also absent from the GOV.UK cyber governance mapping, which maps the Cyber Governance Code of Practice to COBIT 2019, ISO/IEC 27001:2022 and other frameworks.

A UK firm usually meets it in one of three ways: a board or non-executive director asks for a recognised IT governance reference, a tender or customer asks about IT governance, or an adviser uses its vocabulary. Any link to directors' duties or the UK Corporate Governance Code would be our inference, so we do not draw one.

Key requirements

ISO/IEC 38500 is a principles standard. Its structure, at the level of the public abstract and ISO's own commentary on the 2024 edition, is:

1. Scope. The governance of the organisation's current and future use of IT, and the governance of IT as a domain of organisational governance.
2. Audience. Members of governing bodies and those who support them.
3. Outcomes. Three outcomes taken from ISO 37000, the organisational governance standard: effective performance, responsible stewardship and ethical behaviour.
4. Principles. The principles of ISO 37000, with guidance on how each one applies to the governance of IT.

The 2024 edition changed the principles. The 2015 edition had six:

• responsibility;
• strategy;
• acquisition;
• performance;
• conformance;
• human behaviour.

The 2024 edition replaces them with the eleven principles of ISO 37000, according to ISO's committee for the standard. Many summaries still list the six, so check which edition a source describes.

Governance sets direction and holds management to account. Management delivers. When the two blur, IT spend loses an owner.

The standard has no assessment scheme we can point to. Anything you describe as "ISO 38500 aligned" should rest on your own board records and the current text of the standard, not on a certificate.

Frequently asked questions