ISO/IEC 38500 · Governance of IT for the organisation
ISO 38500 IT governance and requirements, so the board directs technology, not just funds it.
ISO/IEC 38500 gives directors and the people who advise them a set of principles, a model and a framework for governing the use of IT. It is guidance written for governing bodies, so there is no certificate to hold. Sterling's expert and experienced consultants turn it into board decisions, delegations, policies and reporting that your directors actually use. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced IT governance consultants, working with boards, IT leaders and management systems since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; ISO/IEC 38500 has no certificate, and where one is needed for a related standard, an accredited body audits and decides
8,100+ client engagements in 60+ countries.
IT governance client experience
What it is
What is ISO 38500 and what is it used for?
ISO/IEC 38500 is the international guidance on governance of IT for the organisation, published jointly by ISO and IEC. Its audience is the governing body: the board, the owners, the trustees or the council that is ultimately answerable for how the organisation uses technology.
The standard separates two jobs that are often blurred. Management runs IT: projects, operations, suppliers, service levels. Governance sets the direction for that work, decides what is acceptable and checks that the results arrive. ISO/IEC 38500 describes how directors engage stakeholders, evaluate, direct and monitor, and which principles should shape those decisions. Organisations use it to structure board agendas on technology, set decision rights, judge investments and show owners and regulators that IT is governed, not merely managed.
Current edition. ISO/IEC 38500:2024, the third edition, published on 23 February 2024, replaced ISO/IEC 38500:2015. The revision elaborated the principles and aligned them with the governance principles of ISO 37000, added "engage stakeholders" to the model, and brought in an updated framework for the governance of IT drawn from ISO/IEC TR 38502. Because it is guidance, there is no certificate and no transition deadline; organisations with governance built on the 2015 edition can update at their own pace. How ISO/IEC 38500 relates to ISO 37000 and ISO/IEC 20000-1
Who it is for
Who needs ISO 38500 IT governance?
No law or accredited scheme requires ISO/IEC 38500 by name. Organisations adopt it when technology decisions have become too large, too risky or too scattered to leave below board level. The request usually arrives from one of four directions:
- Customers want to see who is in charge of technology. Enterprise buyers and outsourcing partners ask how the board oversees IT risk, investment and service performance.
- A tender or funding round asks about governance. Public-sector bids, lenders and investors may ask for a described approach to governing IT, with named responsibilities and reporting, before they commit.
- A regulator or auditor has raised board oversight of IT. ISO/IEC 38500 gives evidence of directors directing and monitoring technology risk a recognised shape. Sterling works alongside your legal advisers on what any rule actually obliges.
- Group companies govern IT in different ways. Subsidiaries approve spending and risk to different thresholds; one framework gives the group consistent delegations and comparable reporting.
Requirements
What are the main ISO 38500 requirements?
Strictly, ISO/IEC 38500 contains guidance rather than auditable requirements: principles directors should apply, a model for how they act and a framework that makes the model operate. After scope, references and definitions, the 2024 edition is organised as follows; your programme is mapped against the edition itself, principle by principle, during the gap analysis.
- Clause 4 Good governance of IT: the outcomes governance should deliver, namely effective performance, responsible stewardship and ethical behaviour, and how principles, model and framework fit together.
- Clause 5 Principles, part one: purpose, value generation, strategy and oversight, each with its implications for the use of IT and the outcomes expected.
- Clause 5 Principles, part two: accountability, stakeholder engagement, leadership and data and decisions.
- Clause 5 Principles, part three: risk governance, social responsibility, and viability and performance over time.
- Clause 6 Model for the governance of IT: the governing body engages stakeholders, evaluates, directs and monitors, while management of IT carries out the work under that direction.
- Clause 7 Framework for the governance of IT: the elements that make governance work in practice, namely direction, capability, policy, delegation, performance and accountability.
What does useful ISO/IEC 38500 evidence look like?
Board minutes that show technology options being evaluated and decided, a written delegation of authority for IT spending and risk acceptance, an IT strategy approved against the organisation's purpose, policies with named owners, a regular performance and risk report the directors question, and records of stakeholder input. Most of it exists in part already; the work is to make it deliberate, consistent and traceable, and Effivity holds it from the first workshop.
Putting it into practice
How do you implement ISO 38500?
There is no certification audit at the end of an ISO/IEC 38500 programme. The route is adoption, evidence and periodic assessment, with certification to a related standard added only where a customer or regulator needs an independent certificate.
- 01Agree what the governing body will govern.Confirm the entities, IT functions, outsourced services and decisions in scope, and who sits on the governing body for each.
- 02Gap analysis: compare current practice with the principles.Interviews with directors and IT leaders, a review of papers, delegations and reports, and a prioritised list of actions with owners and dates.
- 03Design the framework.Direction, capability, policy, delegation, performance and accountability written for your organisation, with a board reporting pack that fits your meeting cycle.
- 04Run the engage, evaluate, direct and monitor cycle.Directors use the framework at real meetings; decisions, exceptions and actions are recorded so the practice produces its own evidence.
- 05Assess and sustain.A periodic assessment using the ISO/IEC 38503 approach, including its maturity method, reported to the board; improvements follow, and any related certification proceeds with an accredited body.
Check the route before you sign. ISO/IEC 38500 is guidance, so an offer of an "ISO 38500 certificate" is not an accredited certification. If a customer needs a certificate, ask which certifiable standard it covers, such as ISO/IEC 27001 or ISO/IEC 20000-1, then confirm the certification body's accreditation with an accreditation body recognised under the Global ACI arrangement. The certification buyer's checklist
Cost
How much does ISO 38500 implementation cost?
With no certification body involved, the cost of an ISO/IEC 38500 programme is mainly consulting time and the time of your directors and IT leaders. A Sterling proposal states everything that is included for an agreed scope and shows every component.
| Cost component | What affects it |
|---|---|
| Consulting and framework design | Number of entities and governing bodies, existing governance documents, the depth of board reporting required, and whether your team works under Design™ or Drive™ |
| Independent assessment or certification | None for ISO/IEC 38500 itself; certification-body fees arise only if a related standard such as ISO/IEC 27001 is certified in the same programme |
| Internal resources | Director and executive time for interviews and workshops, policy approval cycles and the preparation of board papers |
| Software and learning | Included in a Sterling engagement: Effivity for registers, policies and reporting, and Sterling Academy access, with users and access period stated in the proposal |
| Continued support | Periodic assessments, framework reviews after restructuring, and updates when the ISO/IEC 38500 family is revised, under Sustain™ |
Timeline
How long does ISO 38500 implementation take?
Writing a framework takes weeks; the pace is set by the board calendar, because governance only exists once directors have used it at several meetings. Approval of delegations and policies can add a cycle or two. As an estimate, a first framework in operation typically takes three to six months, longer for groups with several governing bodies.
| Phase | What sets the pace |
|---|---|
| Scope and gap analysis | Access to directors, IT leaders, board papers and existing delegations |
| Framework design | Agreement on decision rights, thresholds and reporting format |
| Operation at the board | The number of meetings needed to show the cycle working |
| Assessment and improvement | Availability of the governing body to review findings and decide actions |
Your engagement
What your ISO 38500 engagement includes
Sterling OS™ structures the work, and each phase has a governance meaning. Sterling does not certify, attest or validate: ISO/IEC 38500 has no certificate, and where a related standard is certified, the accredited certification body audits and decides.
Design™: guided support
Your company secretary or governance lead drafts the framework, delegations and reporting pack; a Sterling consultant sets the method, interprets the principles and reviews each draft.
Drive™: managed support
The alternative to Design™ when the team lacks capacity: Sterling drafts the framework with your executives, prepares the first board papers and facilitates the director workshops.
Sustain™: after adoption or certification
Periodic assessments using the ISO/IEC 38503 approach, framework reviews after mergers or restructuring, and support for any related surveillance audits.
Automate™: Effivity
Policies, risks, decisions, actions and performance reporting held in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Certification decisions for any related standard remain with the independent certification body.
Often combined with
Standards organisations pair with ISO/IEC 38500
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · IT governance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO/IEC 38500:2024.
Every Sterling ISO/IEC 38500 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up a governance workspace within the agreed scope, so policies, delegations, risks, decisions, actions, assessments and the performance figures the board reviews sit in one place, with owners and dates. Directors see a live picture instead of a pack assembled the night before, and the evidence of governance accumulates as a by-product of meetings. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope, entities and stakeholders
The entities, IT functions and outsourced services in scope, and the stakeholders whose views the board seeks, recorded once and reviewed on a set schedule.
Purpose, strategy and value
The approved IT strategy and the objectives that link it to the organisation's purpose, each with measures, owners and target dates the board can follow.
Risk governance
A technology risk register with appetite, owners, treatments and review dates, escalated to the governing body when agreed thresholds are crossed.
Evaluate, direct and monitor
Board decisions on technology captured with their rationale, the direction given and the follow-up actions, so the cycle can be traced from paper to result.
Policy and delegation
IT policies with versions, approvals and owners, and a delegation register showing who may approve spending, contracts and risk acceptance, and up to what level.
Capability and competence
Skills and training records for directors, executives and IT staff, linked to Sterling Academy, so capability gaps are visible before they become decisions nobody can judge.
Performance and accountability
KPI dashboards for service, projects, security and cost; assessments, findings and corrective actions tracked to closure with evidence attached.
Your own processes, forms and reports
Board packs, forms, workflows and reports shaped to your governance calendar without code, and integrated with any ISO/IEC 27001 or ISO/IEC 20000-1 system you run.
What this means at the assessment
An assessor using the ISO/IEC 38503 approach asks how the board evaluates proposals, what it has delegated, how it monitors performance and risk, and whether stakeholder views reach it. In Effivity each answer is a screen with dates, owners and documents behind it. Under Sustain™ the same workspace carries the next assessment, so progress is measured against the last one rather than started again.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing policies, registers and reports migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, ITSM, BCMS and more when you add certifiable standards
Sterling Academy · IT governance e-learning
Give directors and managers a shared language for governing IT.
Sterling Academy provides e-learning for the people who govern and run technology: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness of the governance principles for directors, executives and IT managers
- Learning on risk, information security and service management for the people who report to the board
- Internal auditor training for the people who will review the framework, as applicable to your standard, as part of the engagement
- Learner progress by team, recorded as evidence of capability
- New directors and managers trained as they join
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about ISO/IEC 38500
Why Sterling
Why choose Sterling for ISO 38500?
Governance of IT sits between the boardroom and the server room, and it fails when it belongs to only one of them. Sterling works with both sides: directors who need decisions framed clearly, and IT leaders who need direction they can act on. Where the programme also needs a certifiable system, the same team builds it on the same evidence.
Governance and systems in 60+ countries since 2003
Programmes delivered for groups, public bodies and service businesses across every region we serve, with one engagement team accountable for every entity in scope.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any certification-body fees for related standards identified separately. No surprises, ever.
Built for the board calendar
Short papers, clear decision requests and reporting that fits your meetings, so directors govern technology without drowning in detail.
Expert and experienced consultants
Consultants who understand governance, IT service management, information security and continuity, and who connect ISO/IEC 38500 to the certifiable standards your customers ask for.
The Sterling Promise
What our ISO/IEC 38500 success guarantee means
We stay with you until your agreed ISO/IEC 38500 outcome is achieved: a framework adopted by your governing body, operating at its meetings and assessed against the principles. Clear explanations, practical delivery, included software and learning turn the investment into lasting capability rather than a document on a shelf.
The engagement identifies the guidance, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed framework into use. ISO/IEC 38500 carries no certificate; for any related standard, the independent certification body assesses conformity and retains its decision. Our commitment concerns the agreed support, not a promise of every future tender award or error-free delivery.
FAQs
Frequently asked questions about ISO 38500
Can you get ISO 38500 certified?
No. ISO/IEC 38500 provides guiding principles for governing bodies and has no accredited certification scheme. You can adopt it, assess your governance against it using the ISO/IEC 38503 approach and describe that alignment accurately; if a customer needs a certificate, it will be for a related standard such as ISO/IEC 27001 or ISO/IEC 20000-1.
Does ISO 38500 replace our IT management frameworks?
No. The standard deliberately separates governance of IT from management of IT. Your service management, security and project methods stay in place; ISO/IEC 38500 shapes how the governing body directs them, what it delegates and how it monitors the results they produce.
How does ISO 38500 relate to ISO 37000?
ISO 37000 is guidance on governing the whole organisation; ISO/IEC 38500:2024 applies that thinking to technology. The 2024 edition aligned its principles with those of ISO 37000, which helps boards treat IT governance as part of their general governance duties rather than a separate topic delegated to the IT department.
Is ISO 38500 only for large companies?
No. The standard applies to organisations of all types and sizes, public or private. A small firm's governing body may be two owners meeting monthly; the principles still help them decide which technology risks they accept, who may commit spending and what they should see each quarter.
Who should lead ISO 38500 adoption inside the organisation?
The governing body should own it, usually through its chair, a board committee or the company secretary. The chief information officer or IT head supports the work but should not own it alone, because the standard is about how directors direct and monitor the people who manage IT.
Keep exploring
More on ISO/IEC 38500 and related standards
More in Information security, cyber & cloud
Talk to a consultant
Put ISO/IEC 38500 IT governance into practice with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice