ISO/IEC 19770-1:2017

Why does it matter?

The Introduction notes that information associated with IT assets is typically voluminous, highly complex and fast-changing, so organizations with such information are likely to need automated information systems. ISO/IEC 19770-1:2017 sets out the management system that keeps that information trustworthy and the controls that sit on top of it.

Key benefits include:

• Licensing under control

The Introduction requires controls over licensing, underlicensing, overlicensing and compliance with licensing terms and conditions, and Clause 8.4 covers license management.

• Trustworthy data first

Tier one in Annex B is trustworthy data, which the Introduction calls the most important tier for most end-user organizations and for software publishers; Clause 8.3 covers core data management.

• Ownership and authorizations on the record

Documented information includes traceability of ownership and responsibility (Clause 7.6.2) and audit trails of authorizations and execution of authorizations (Clause 7.6.3).

• Cloud and BYOD in scope

Clause 8.7 covers outsourcing and services and Clause 8.8 covers mixed responsibilities between the organization and its personnel; the Introduction cites cloud computing and BYOD as cases of mixed ownership and responsibilities.

• Built to join other systems

The Introduction says the ITAMS is designed to align and integrate with the requirements of ISO/IEC 27001 and ISO/IEC 20000-1.

How does it work?

ISO/IEC 19770-1:2017 gives its scope in Clause 1, with purpose (1.1), field of application (1.2) and limitations (1.3). Clause 2 has no normative references and Clause 3 defines terms, many repeated from ISO 55000:2014. The requirements are in Clauses 4 to 10: context and the scope of the ITAMS (4), leadership, policy and roles (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10).

Planning starts with IT asset risk assessment (6.1.2) and risk treatment (6.1.3), then sets the operation process specification (6.2.1), objectives for operation processes (6.2.2), overall IT asset management objectives (6.2.3) and planning to achieve them (6.2.4). Support adds information requirements (7.5) and documented information, including ownership traceability (7.6.2) and authorization audit trails (7.6.3).

Operation covers management of change (8.2), core data management (8.3), license management (8.4), security management (8.5), other processes (8.6), outsourcing and services (8.7) and mixed responsibilities (8.8). Improvement covers nonconformity and corrective action (10.1), preventive action (10.2) and continual improvement (10.3). The order of the requirements does not reflect their importance or an order of implementation (Introduction), and the standard does not specify the sequence of steps (Clause 1.3).

Key Elements

• Context and scope (Clause 4)

Understanding the organization, the needs and expectations of stakeholders (the standard uses stakeholder, not interested party), the scope of the ITAMS and the ITAMS itself (4.1 to 4.4). The organization determines which of its IT assets the standard applies to.

• Leadership, policy and roles (Clause 5)

Leadership and commitment (5.1), the ITAM policy (5.2) and organizational roles, responsibilities and authorities (5.3).

• IT asset risk and objectives (Clause 6)

IT asset risk assessment and treatment (6.1.2 and 6.1.3), and ITAM objectives with the operation process specification and planning (6.2.1 to 6.2.4).

• Information and documented information (Clauses 7.5 and 7.6)

Information requirements, traceability of ownership and responsibility, audit trails of authorizations, and creating, updating and controlling documented information.

• ITAM-specific operation (Clauses 8.2 to 8.8)

Management of change, core data management, license management, security management, other processes, outsourcing and services, and mixed responsibilities.

• Annex A: operation processes and objectives (normative)

The 15 ITAM process areas that are expected within organizations, with their objectives.

• Annexes B, C and D (informative)

Annex B groups process objectives into tiers, Annex C describes the characteristics of IT assets that drive the added requirements, and Annex D lists the changes from ISO 55001.

• Evaluation and improvement (Clauses 9 and 10)

Monitoring, measurement, analysis and evaluation (9.1), internal audit (9.2), management review (9.3), corrective action (10.1), preventive action (10.2) and continual improvement (10.3).

What does it cover?

ISO/IEC 19770-1:2017 specifies requirements for an IT asset management system within the context of the organization and can be applied to all types of IT assets by all types and sizes of organizations (Clause 1.1). It covers hardware, executable software such as application programs and operating systems, and non-executable software such as fonts and configuration information, in every technological environment, including virtualized software, on-premises and software-as-a-service (Clause 1.2). It is not intended for managing information as an asset independent of hardware and software, and it does not specify financial, accounting or technical requirements for specific IT asset types (Clause 1.1, Notes 1 and 2).

What are its objectives?

The standard aims to give organizations a management system for controlling IT assets across their life, within the context of the organization (Clause 1.1). Its Introduction frames the objectives as:

Establish, implement, maintain and improve an IT asset management system.

Add the requirements IT assets need beyond ISO 55001:2014, above all for software assets.

Let internal and external parties assess the organization's ability to meet legal, regulatory and contractual requirements and the organization's own requirements.

Align and integrate the ITAMS with related management system requirements such as ISO/IEC 27001 and ISO/IEC 20000-1.

Allow staged implementation through optional tiers of process objectives.

Framework in Context

ISO/IEC 19770-1:2017 is a discipline-specific extension of ISO 55001:2014, with changes, and not a sector-specific application of it; Annex D lists the changes. ISO 55002 gives further guidance on the requirements shared with ISO 55001, and general information and terminology are in ISO 55000 and ISO/IEC 19770-5 (Introduction). The standard applies the definition of risk from ISO 31000:2009 and ISO/IEC Guide 73:2009. ISO last confirmed it in 2024 (stage 90.93, May 10, 2024), and its second edition, ISO/IEC 19770-1:2012, is withdrawn.

Common Framework Mappings

ISO/IEC 19770-1:2017 is commonly mapped to the management system standards and IT frameworks below so that asset data and controls can evidence security, service management and governance requirements at the same time.

Mapped frameworks include:

ISO/IEC 19770-5:2015

ISO 55001

ISO/IEC 20000-1

ISO 27001:2022

ISO 27002:2022

ISO 9001:2026

ITIL 4

COBIT 2019

ISO/IEC 27036