ISO/IEC 19770-1:2017 – Information technology – IT asset management – Part 1: IT asset management systems – Requirements

Why it Matters

Software licensing exposure, unmanaged cloud subscriptions, and unknown hardware are among the most common sources of cost overruns and security gaps in IT. ISO/IEC 19770-1:2017 gives organizations a certifiable management system for IT assets that starts with trustworthy data and integrates with the ISO management systems they already run.

Key benefits include:

• Control license and subscription cost

Requirements for entitlement records, reconciliation, and controls over duplication and distribution reduce under-licensing penalties and over-licensing waste.

• Improve security through asset knowledge

Accurate, current IT asset data supports vulnerability management, patching, and the asset controls in ISO/IEC 27001 and ISO/IEC 27002.

• Integrate with other management systems

The harmonized structure lets the ITAMS share context, leadership, planning, support, and improvement clauses with ISO/IEC 27001, ISO/IEC 20000-1, and ISO 9001.

• Implement in stages

Three tiers, trustworthy data, life cycle integration, and optimization, give a defined path from basic inventory to optimized asset value.

• Demonstrate conformance

Organizations can be assessed and certified against the standard, giving customers, auditors, and software publishers assurance of licensing compliance.

How it Works

ISO/IEC 19770-1:2017 follows the harmonized management system structure. Clause 1 gives the purpose, field of application, and limitations, Clauses 2 and 3 the normative references and terms, and Clauses 4 to 10 the requirements: context of the organization and ITAMS scope, leadership and policy, planning including IT asset risk assessment and treatment and ITAM objectives, support, operation, performance evaluation, and improvement. Annex A specifies the ITAM process areas, Annex B describes the optional tiers, and Annex C explains the characteristics of IT assets that drive the additional requirements beyond ISO 55001.

Implementation typically begins with a scope statement covering the asset types, locations, and organizational units in the ITAMS, followed by ITAM policy, roles, and objectives approved by leadership. Teams then build trustworthy data through discovery, inventory, and entitlement reconciliation, define processes for each Annex A area such as acquisition, deployment, license management, and disposal, assess and treat IT asset risks, measure performance, run internal audits and management review, and correct nonconformities, before seeking certification by an accredited body.

Within SmartSuite, teams hold the Clause 4 to 10 requirements and the Annex A process areas as a control library, keep the IT asset register, entitlements, and reconciliations as linked records, and run risk treatment, internal audits, and corrective actions with owners and due dates. Dashboards show tier progress, license position, and audit readiness for management review and certification.

Key Elements

• Context and scope of the ITAMS

Determination of internal and external issues, stakeholder needs, and the IT assets, locations, and units the system covers.

• Leadership, policy, and roles

Top management commitment, an ITAM policy, and defined responsibilities and authorities for IT asset management.

• Planning and IT asset risk

IT asset risk assessment and treatment, ITAM objectives, operation process specifications, and plans to achieve them.

• IT-specific controls beyond ISO 55001

Controls over software modification, duplication, and distribution, audit trails, licensing compliance, mixed ownership such as cloud and BYOD, and reconciliation with financial systems.

• Support, operation, evaluation, and improvement

Resources, competence, awareness, communication, documented information, operational control, monitoring, internal audit, management review, and corrective action.

• Annex A process areas

The ITAM process areas the organization is expected to operate, from acquisition through deployment, management, and retirement.

• Annex B tiers

Optional groupings of process objectives into trustworthy data, life cycle integration, and optimization for staged implementation and assessment.

Framework Scope

ISO/IEC 19770-1:2017 applies to all types of IT assets, including hardware, executable software such as applications and operating systems, and non-executable software such as fonts and configuration information, across all technological environments from on-premises to virtualized and software-as-a-service. It can be adopted by organizations of any type and size and can be used by internal and external parties to assess an organization's ability to meet its own ITAM requirements. It does not specify financial, accounting, or technical requirements for particular asset types, does not detail process methods or procedures, and is not intended for managing information assets independent of hardware and software.

Framework Objectives

The standard aims to give organizations a management system that establishes, maintains, and improves control over their IT assets throughout the asset life cycle.

Specify requirements for an IT asset management system within the context of the organization.

Extend ISO 55001 with the additional requirements that software and other IT assets demand.

Ensure trustworthy data on IT assets as the foundation for licensing, security, and financial control.

Integrate IT asset management with the organization's other management systems and life cycle processes.

Manage IT asset risks and licensing compliance through defined objectives, processes, and audit trails.

Enable staged implementation and assessment through defined tiers and support certification.

Framework in Context

ISO/IEC 19770-1:2017 is the management system standard of the ISO/IEC 19770 series, whose vocabulary is defined in ISO/IEC 19770-5:2015 and whose data standards include software identification tags (ISO/IEC 19770-2) and entitlement schemas (ISO/IEC 19770-3). It extends ISO 55001:2014 and shares the harmonized structure of ISO/IEC 27001:2022, ISO/IEC 20000-1, and ISO 9001, with which it is designed to be implemented jointly. Its asset inventory and licensing controls support the asset management controls of ISO/IEC 27002:2022, the IT asset management practice of ITIL 4, the managed assets objective of COBIT 2019, and supplier controls in ISO/IEC 27036.

Common Framework Mappings

ISO/IEC 19770-1:2017 is commonly mapped to the management system standards and IT frameworks with which an ITAMS is integrated, so that asset data and controls can evidence security, service management, and governance requirements at the same time.

Mapped frameworks include:

ISO/IEC 19770-5:2015

ISO 55001

ISO/IEC 20000-1

ISO 27001:2022

ISO 27002:2022

ISO 9001:2026

ITIL 4

COBIT 2019

ISO/IEC 27036