ISO/IEC 38500 2015 Standard

The ISO/IEC 38500:2015 Standard

ISO/IEC 38500 provides principles, definitions and a model for governing bodies to use when evaluating, directing and monitoring the use of information technology (IT) in their organisations, helping those at the highest level to understand and fulfil their legal, regulatory and ethical obligations in respect of their organisations' use of IT.

It also provides guidance to those advising, informing or assisting governing bodies, such as:

• Executive managers
• Members of groups monitoring the organisation’s resources
• External business or technical specialists
• Internal and external service providers, including consultants
• Auditors.

ISO/IEC 38500 applies to the governance of management processes and decisions relating to the information and communication services used by an organisation . Processes could be controlled by IT specialists within the organisation, by external service providers or by business units within the organisation.

ISO/IEC 38500 is the first international standard for IT governance, and provides an efficient and effective framework for IT governance, leading to better alignment of IT with organisational decisions.

The advice and guidance in this standard is applicable to all organisations, including public and private companies, government organisations, and not-for-profit organisations, irrespective of their size or type, and regardless of the extent of their use of IT. It not only applies to directors but also provides essential guidance on the appropriate governance of IT to all key members of staff.