ISO/IEC 19770-1:2017 sets the requirements for an IT asset management system (ITAMS): the policy, processes, data and records an organisation needs to control its hardware, software and software licences. ISO confirmed the 2017 edition in May 2024, and its only amendment, Amd 1:2024, is a one-page change that adds climate action statements to the context clauses.
This guide is for IT asset managers, software licence managers, procurement and finance leads, and the IT audit and compliance staff who check them.
What is ISO/IEC 19770-1:2017?
Its full title is "Information technology: IT asset management: Part 1: IT asset management systems: Requirements". ISO's catalogue page lists it as edition 3, 37 pages, published in December 2017 by ISO/IEC JTC 1/SC 7, the software and systems engineering committee. It replaced the 2012 edition, which was technically revised to become a management system standard.
The standard is a discipline-specific extension of ISO 55001:2014, the asset management system standard. It builds on the ISO 55001 requirements, with the changes listed in its Annex D, and adds what IT assets need, above all software. Meeting ISO/IEC 19770-1 does not by itself mean you meet ISO 55001.
It applies to all types of IT assets and all sizes of organisation. That includes hardware, executable software such as applications, and non-executable software such as fonts and configuration data, on premises or delivered as a service. It does not cover information as an asset in its own right, and it sets no financial, accounting or technical requirements.
What did Amendment 1:2024 change?
ISO/IEC 19770-1:2017/Amd 1:2024 is titled "Climate action changes". ISO's amendment page shows it was published on 23 February 2024, runs to one page and is listed at no charge.
It belongs to a set of climate amendments ISO made to its management system standards after the London Declaration on climate action. The IAF and ISO joint communiqué of 22 February 2024 explains the two additions.
Under clause 4.1 the organisation decides whether climate change is a relevant issue. Under clause 4.2 a note says that interested parties can have climate-related requirements. ISO/IEC 19770-1 calls interested parties "stakeholders".
IAF treats the change as a clarification, so there is no formal transition period and the publication year stays 2017. Certification bodies check the new statements from publication. If you judged climate change relevant, they look for it in your objectives and mitigation activities. If you judged it not relevant, they test how you reached that decision.
Some older descriptions present Amd 1:2024 as a refresh for cloud and SaaS. It is not. Software as a service was already in the 2017 field of application, and the climate amendments add statements to clauses 4.1 and 4.2 only.
What does ISO/IEC 19770-1 require, clause by clause?
Clauses 4 to 10 follow the usual management system order. The IT-specific weight sits in clauses 6, 7 and 8 and in the normative Annex A, which sets out the ITAM operation processes and their objectives.
The evidence column is AGS's view of what an auditor typically asks to see. It is not the standard's wording.
| Clause | Topic | Evidence typically asked for (AGS view) |
|---|---|---|
| 4.1 to 4.4 | Context, stakeholders, ITAMS scope (with the 2024 climate statements) | Context and issues register with a recorded climate change decision, list of stakeholders, written scope of assets covered |
| 5 | Leadership, ITAM policy, roles | Signed ITAM policy, named asset owners and responsibilities |
| 6.1, 6.2 | IT asset risk assessment and treatment, operation process specification, objectives | Risk analysis sheet, selected Annex A processes, objectives with targets |
| 7.5, 7.6 | Information requirements, traceability of ownership, audit trails of authorisations | Asset data definitions, approval records for acquisitions, moves and disposals |
| 8.2 to 8.5 | Change, core data management, licence management, security management | Change records, reconciled asset inventory, licence entitlement and deployment position per publisher |
| 8.7, 8.8 | Outsourcing and services, mixed responsibilities with personnel | Supplier and cloud service list, rules for staff-owned and BYOD devices |
| 9 | Monitoring, internal audit, management review | Audit plan and reports, management review minutes |
| 10 | Nonconformity and corrective action, preventive action, continual improvement | Corrective and preventive action reports, improvement plan |
Why do IT assets need more than ISO 55001?
The introduction to ISO/IEC 19770-1 gives the reasons, and they are a good checklist for where to start. Software can be copied, changed and distributed in ways a pump or a vehicle cannot. So the standard adds controls over modification, duplication and distribution, and audit trails of who authorised what.
Licensing is the second reason. The standard expects controls over under-licensing, over-licensing and compliance with licence terms. In practice that means knowing, per publisher, what you are entitled to and what is installed or in use.
Mixed ownership is the third. Cloud services and staff-owned devices blur who owns and controls an asset, which is why clause 8.8 exists. The fourth is reconciliation of ITAM data with other systems, in particular the finance system that records assets and expenses.
The standard also offers optional groupings of process objectives, called tiers, in informative Annex B. The first tier is "trustworthy data", followed by life cycle integration and optimisation. Most organisations get the most value from finishing the first tier before anything else. A reconciled inventory that finance, security and procurement all trust is worth more than a polished policy over unreliable data.
How does certification to ISO/IEC 19770-1 work?
Certification bodies that audit an ITAMS are expected to meet ISO/IEC 19770-11:2021 on top of ISO/IEC 17021-1, the general requirements for management system certification bodies. ISO lists 19770-11 as "to be revised", so check which version your certification body works to.
Before you choose a body, ask whether its ISO/IEC 19770-1 certification is accredited and by which accreditation body. Then ask how it audits the 4.1 climate decision and how it samples licence positions in stage 2.
Which standards sit around ISO/IEC 19770-1?
ISO 55001:2014, the base standard, has been withdrawn and replaced by ISO 55001:2024, published in July 2024. ISO/IEC 19770-1 still refers to the 2014 edition. If you run both an asset management system and an ITAMS, agree with your certification body how it treats the difference.
Two newer technical specifications in the same series help with implementation. ISO/IEC TS 19770-10:2025, published in June 2025, gives guidance on implementing ITAM processes. ISO/IEC TS 19770-13:2026, published in April 2026, gives guidance on building sustainability aspects into an ITAMS, which pairs naturally with the climate amendment.
ISO/IEC 19770-1 is designed to integrate with ISO/IEC 27001 and ISO/IEC 20000-1. Our ISO/IEC 27001:2022 guide covers the security side, where the asset inventory is shared. The ISO/IEC 20000-1 guide covers service management. For board oversight of IT spend and risk, see our ISO/IEC 38500:2024 guide.
How AGS can help
The ISO-IEC 19770-1-2017 + Amd.1-2024-IT Asset Management System contains 75 editable Microsoft Word documents. They include an ITAM manual, a system scheme, a compliance and document matrix and 15 procedures, such as licensing compliance and supplier management. Forms include an IT asset inventory register, a software licensing tracker and a strategic ITAM plan. There are 8 checklists, among them a climate action readiness checklist for Amendment 1:2024, plus guidance and training documents.
Frequently asked questions
Is ISO/IEC 19770-1:2017 still the current edition?
Yes. ISO confirmed it in May 2024 after its systematic review, and Amd 1:2024 is its only amendment.
Do we need to rebuild our ITAMS because of Amendment 1:2024?
No. Record a reasoned decision on whether climate change is relevant to your ITAMS under 4.1, consider stakeholder climate requirements under 4.2, and carry any relevant issue into your objectives and actions.
Does the standard cover data and information assets?
Only partly. It covers data about the IT assets in scope, but it is not meant for managing information as an asset independent of hardware and software.
Can a small organisation use ISO/IEC 19770-1?
Yes. It applies to organisations of all types and sizes, and you decide which IT assets are in scope.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by ISO, IEC or IAF.
Reviewed October 2026. Facts checked against the sources current at publication.
