Iso38500

INTERNATIONAL STANDARD

ISO/IEC 38500
First edition 2008-06-01

Corporate governance of information technology
Gouvernance des technologies de l'information par l'entreprise

Reference number ISO/IEC 38500:2008(E)

© ISO/IEC 2008

ISO/IEC 38500:2008(E)

PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may beprinted or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the softwareproducts used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.

COPYRIGHT PROTECTED DOCUMENT© ISO/IEC 2008 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body in the country of the requester. ISO copyright office Case postale 56  CH-1211 Geneva 20 Tel. +41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyright@iso.org Web www.iso.org Published in Switzerland

ii

© ISO/IEC 2008 – All rights reserved

ISO/IEC 38500:2008(E)

Contents
1 1.1 1.2 1.3 1.4 1.5 1.6 2 2.1 2.2 3 3.1 3.2 3.3 3.4 3.5 3.6 3.7

Page

SCOPE, APPLICATION AND OBJECTIVES ................................................1 Scope...........................................................................................1 Application ....................................................................................1 Objectives .....................................................................................1 Benefits of Using This Standard ......................................................1 Referenced Documents..................................................................3 Definitions.....................................................................................3 Principles ......................................................................................6 Model ...........................................................................................7General.........................................................................................9 Principle 1: Responsibility ...............................................................9 Principle 2: Strategy ....................................................................11 Principle 3: Acquisition .................................................................12 Principle 4: Performance ..............................................................13 Principle 5:Conformance..............................................................14 Principle 6: Human Behaviour .......................................................15

FRAMEWORK FOR GOOD CORPORATE GOVERNANCE OF IT .....................6

GUIDANCE FOR THE CORPORATE GOVERNANCE of IT ............................9

© ISO/IEC 2008 – All rights reserved

iii

ISO/IEC 38500:2008(E)

Foreword
ISO(the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity....