ISO/IEC 38500:2024 is the international standard that gives boards and other governing bodies principles for governing their organisation's use of IT. The third edition, published in February 2024, replaced the 2015 edition and moved from six principles to eleven, taken from ISO 37000 on the governance of organizations.
This guide is for directors, company secretaries, CIOs and the governance, risk and audit staff who support them.
What is ISO/IEC 38500:2024?
Its full title is "Information technology: Governance of IT for the organization". ISO and IEC publish it jointly through committee ISO/IEC JTC 1/SC 40. ISO's catalogue page lists it as edition 3, 21 pages, published on 23 February 2024. The 2015 edition is withdrawn.
The standard is written for members of governing bodies and the people who support them. It applies to companies, government entities and not-for-profit organisations of every size, whatever the extent of their IT use.
It is a principle-based standard, not a management system standard. It does not set out management system clauses for a certification body to audit, as ISO/IEC 27001 does. Instead it describes what good governance of IT looks like and how governance and management of IT relate.
What are the eleven principles?
The 2024 edition adopts the principles of ISO 37000:2021, Governance of organizations, and explains what each one means for IT, data and digital capability. ISO/IEC JTC 1/SC 40 sets this out in its white paper on the revision.
The principles sit in three tiers. Purpose is the primary principle. Four are foundational and six are enabling.
For each one, the standard gives the principle, its governance implications for the use of IT, and the expected outcomes. Value generation, for example, is clause 5.3.
The right-hand column below is AGS's interpretation of the question each principle puts to a board about IT. It is not the standard's wording.
| Tier | Principle | The IT question a board should be able to answer |
|---|---|---|
| Primary | Purpose | How do IT and data serve the reason the organisation exists? |
| Foundational | Value generation | Which IT investments create value, for whom, and how is it measured? |
| Foundational | Strategy | Does the strategy reflect what current and emerging technology makes possible, or threatens? |
| Foundational | Oversight | How does the board see IT performance, major projects and incidents between meetings? |
| Foundational | Accountability | Who answers for each delegated IT decision, and how are they held to account? |
| Enabling | Stakeholder engagement | Are customers, staff, regulators and suppliers heard before IT changes affect them? |
| Enabling | Leadership | Do leaders set an ethical tone for the use of technology and data? |
| Enabling | Data and decisions | Is data governed as a resource, with its quality and use controlled? |
| Enabling | Risk governance | Are cyber, cloud, supplier and AI risks judged against the risk appetite? |
| Enabling | Social responsibility | Are the social and environmental effects of IT use weighed in decisions? |
| Enabling | Viability and performance over time | Will today's IT choices keep the organisation viable in ten years? |
What changed from the 2015 edition?
The 2015 edition had six principles: responsibility, strategy, acquisition, performance, conformance and human behaviour. Guides written before 2024 still list those six. Only strategy keeps its name as a principle in 2024.
The model also changed. In 2015 the governing body evaluated, directed and monitored the use of IT. The 2024 model adds a fourth element, engage stakeholders.
SC 40 notes a larger shift behind it. Governance is now described as exercised throughout the organisation, with management working inside a framework the governing body defines.
That framework has six elements in the 2024 edition: direction, capability, policy, delegation, performance and accountability. The idea builds on ISO/IEC TR 38502:2017, the framework and model report in the same family.
Finally, the standard explains what the three governance outcomes of ISO 37000 mean for IT. They are effective performance, responsible stewardship and ethical behaviour. ISO's governance committee summarises ISO 37000 on its ISO 37000 page.
What should you update if your framework follows the 2015 edition?
Your IT governance charter, board reporting pack or internal audit programme may be mapped to the six 2015 principles. It still works as a governance document, but the mapping no longer matches the current edition.
Start with the principle map. Anything filed under acquisition, conformance or human behaviour needs a new home.
Investment approval usually moves to value generation and oversight. Legal and policy compliance usually moves to accountability and risk governance. These moves are AGS's suggestion, so test them against the standard itself.
Then look for gaps. Check three areas that had no principle of their own in 2015.
Data and decisions asks how data quality and data use are governed. Social responsibility and viability over time ask about environmental and long-term effects of IT choices. Stakeholder engagement now sits in the model itself, so the board needs a way to hear affected groups before major IT changes.
Last, check delegation. The 2024 framing expects governance to run through management. A board that approves an IT strategy once a year and receives no structured reporting between meetings will struggle to show oversight.
What records show a board is governing IT?
ISO/IEC 38500 does not prescribe records. In practice, when internal audit or an external reviewer looks at IT governance, they typically ask for evidence like this. The list is AGS's practical view, not a quote from the standard.
- An IT governance charter or terms of reference that states what the board decides and what it delegates.
- A delegation or RACI matrix for IT decisions, with named roles.
- Business cases and approval records for significant IT investments, with a later check on whether the value arrived.
- An IT risk register reported to the board or a committee, with cyber, supplier and AI risks.
- Board or committee minutes that show IT items were discussed, challenged and decided.
- Periodic IT performance and conformance reports, and the actions taken on them.
If you want an independent view, ISO/IEC 38503:2022 covers the assessment of the governance of IT.
How does ISO/IEC 38500 relate to other IT standards?
ISO/IEC 38500 works at a different level from management system standards. ISO/IEC 27001 specifies an information security management system and ISO/IEC 20000-1 a service management system. ISO/IEC 38500 is about how the governing body directs and oversees all of it. Our ISO/IEC 20000-1 guide covers the service management side.
Other standards in the family apply ISO/IEC 38500 to particular topics. ISO/IEC 38506:2020 covers IT-enabled investments. ISO/IEC 38507:2022 covers the governance implications of AI, explained in our ISO/IEC 38507 guide.
Risk governance at board level also draws on enterprise risk practice. Our guide to ISO 31000 and IEC 31010 explains the risk process that IT risk reporting usually follows.
How AGS can help
The ISO 38500- IT Governance kit contains 43 editable Microsoft Word documents. It includes an IT governance framework manual, a model and framework map, 14 procedures and 14 forms. Several procedures are named after the 2024 principles and model, including an engage, evaluate, direct and monitor cycle. It also has 5 checklists, including an eleven principles checklist and a self-assessment and gap analysis, and 4 guidance documents.
Frequently asked questions
Can an organisation be certified to ISO/IEC 38500?
It is not written as a set of certifiable management system requirements. Organisations use it to design and review their governance of IT. ISO/IEC 38503:2022 supports assessment.
Is ISO/IEC 38500:2015 still valid?
No. ISO lists the 2015 edition as withdrawn and the 2024 edition as current.
Do we need ISO 37000 as well?
Not to use ISO/IEC 38500, which explains each principle for IT. ISO 37000:2021 covers governance of the whole organisation, and ISO confirmed it as current in August 2026 after its systematic review.
Does it apply to small organisations?
Yes. The standard states it applies to organisations of all sizes. In a small business the owner or partners usually act as the governing body.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by ISO or IEC.
Reviewed October 2026. Facts checked against the sources current at publication.
