ISO 19770-1: The guide to efficient IT asset management

ISO/IEC 19770-1:2017 is the international standard that defines the requirements for establishing, implementing, maintaining, and improving an IT asset management system (ITAM). Published in December 2017 by ISO in conjunction with IEC, it adopts the Management System Standard (MSS) format—with a Plan-Do-Check-Act (PDCA) cycle—and applies to any type of IT asset: hardware, software, services, and data, in organizations of any size.

The standard is a disciplinary extension of ISO 55001:2014 (physical asset management), with additional requirements specific to IT assets. Compliance with ISO 19770-1 does not imply compliance with ISO 55001 — the two standards are complementary, not equivalent. ISO 19770-1 was designed to also integrate with ISO/IEC 27001 (information security) and ISO/IEC 20000-1 (IT service management), allowing mature organizations to operate aligned management systems.

What is ISO 19770-1?

ISO 19770-1 specifies requirements for an IT asset management system (ITAMS). The current edition is the third: ISO/IEC 19770-1:2017. It was prepared by the ISO/IEC JTC 1 Technical Committee, Subcommittee SC 7 (Software and System Engineering), with participation from groups SC 27 (Information Security) and SC 40 (IT Service Management and IT Governance).

The standard covers any type of IT asset — executable and non-executable software, physical and virtual hardware, media, licenses, contracts, ITAM systems and tools — and applies equally to legacy environments, virtualization, cloud computing (SaaS, PaaS, IaaS), and BYOD (Bring Your Own Device) practices. Since 2023, the ITAM Forum has maintained a formal certification scheme for organizations that wish to demonstrate compliance externally.

Standard structure: the ten clauses of the management system

ISO/IEC 19770-1:2017 follows the high-level structure (Annex SL) common to ISO management system standards, organized into ten clauses:

• Clause 4 — Organizational context: Identifying relevant internal and external issues, understanding stakeholder needs (including software licensors), defining the scope of ITAMS and the portfolio of IT assets covered.
• Clause 5 — Leadership: Commitment from senior management, establishment of ITAM policy, and formal definition of roles, responsibilities, and authorities.
• Clause 6 — Planning: IT asset risk assessment and treatment (aligned with the ISO/IEC 27001 approach), definition of ITAM objectives by process, and development of strategic and operational plans.
• Clause 7 — Support: Resources, skills, awareness, communication, information requirements, and control of documented information — including traceability of ownership and audit trails of authorizations.
• Clause 8 — Operation: execution of ITAM processes, including the four mandatory functional processes (8.2 to 8.5) and the additional processes defined by Annex A.
• Clause 9 — Performance evaluation: Monitoring and measurement, internal audit and management review.
• Clause 10 — Improvement: Nonconformity handling, corrective actions, preventive actions, and continuous improvement.

The four mandatory functional processes (Clause 8)

The standard establishes four operational processes that must always be present in ITAMS — regardless of the scope or size of the organization:

• Change management (8.2): Risk assessment associated with any planned change before its implementation, as well as review of the consequences of unplanned changes.
• Central data management (8.3): Ensuring that data from all key IT assets — hardware, software, IT asset services, and, where within scope, digital information content assets — is accurately recorded throughout the entire lifecycle.
• License management (8.4): Accurate record keeping of licenses, entitlements, and usage in relation to those entitlements; periodic reconciliations between requirements, usage, and rights; documented verification.
• Security management (8.5): Effective security management across all ITAM activities, including access and integrity controls, for all IT assets within the scope.

ITAM Processes: Lifecycle and Functional Aspects (Annex A)

Annex A of the standard—which is normative in nature—specifies the operational processes that the organization must consider for inclusion in ITAMS. These are divided into two types:

Life cycle processes They cover the phases that assets go through: Specification, Acquisition, Development, Release, Deployment, Operation, and Retirement. For each phase, the standard defines a specific process objective—for example, ensuring that acquisition occurs in a controlled and documented manner, or that disposal includes controls for data, software, and electronic waste disposal in accordance with local regulations.

Functional processes These principles apply across multiple phases of the lifecycle. In addition to the four mandatory ones (change management, central data, licenses, and security), Annex A includes: Relationship and Contract Management, Financial Management, Service Level Management, and Other Risk Management. Statement of Applicability The Statement of Applicability should document which processes were included or excluded—and the rationale for each decision.

The three levels of ITAM maturity (Tiers — Appendix B)

Appendix B of the standard—which is informative—defines three cumulative maturity levels, designed especially for organizations that cannot implement all processes at once:

• Tier 1 — Trustworthy Data: The entry level. This means knowing what the organization possesses and having reasonable assurance of license compliance. It includes the four mandatory processes of Clause 8. The standard defines "trusted data" as data that is accurate, complete, relevant, understandable, and available to the authorized users who need it.
• Tier 2 — Life Cycle Integration: It integrates the seven lifecycle processes of Annex A, generating greater efficiency and cost reduction throughout the entire life of the assets.
• Tier 3 — Optimization: It incorporates advanced functional processes — financial management, contract and relationship management, service level management, and other risk management — to maximize efficiency and cross-functional effectiveness.

The tiers are cumulative: those seeking Tier 2 must first meet Tier 1; those seeking Tier 3 must meet the two previous ones. For most organizations, Tier 1 already represents a significant leap in maturity and compliance.

Why do IT assets require their own standard?

Annex C of ISO 19770-1 describes the characteristics of IT assets that justify additional requirements compared to the management of conventional physical assets. These include: the ease of modifying, duplicating, and distributing software without adequate tracking; technological complexity (versioning, location flexibility, virtualization); licensing compliance requirements—which do not exist on the same scale for physical assets—; mixed ownership scenarios (BYOD, cloud, outsourcing); and the specific controls needed during the disposal phase, both to protect data and to comply with e-waste regulations.

These factors make IT asset management significantly more complex than physical asset management — and it is precisely this complexity that ISO 19770-1 was designed to address rigorously and systematically.

Benefits of implementing ISO 19770-1

• Strengthened IT governance: Processes aligned with business strategy, with traceability of decisions and documented audit trails.
• Reliable data on the asset portfolio: basis for financial, security and strategic planning decisions.
• Cost reduction: Elimination of underutilized or excess licenses; greater efficiency in the asset lifecycle.
• Risk mitigation: Documented control of licenses, BYOD, cloud, and outsourcing — reducing exposure to fines and regulatory non-compliance.
• Integration with other management systems: Native compatibility with ISO/IEC 27001 (security) and ISO/IEC 20000-1 (IT services), facilitating integrated audits.
• Operational credibility: Internationally recognized standard, with a formal certification scheme available since 2023.

How to implement ISO 19770-1 in practice

1. Initial diagnosis and mapping: Assess the current state of assets, processes, and governance. Identify gaps in relation to clauses 4 to 10 of the standard. Define which tier is the realistic target for the first cycle.
2. Scope definition and policies: Determine which IT assets and which business units will be included in ITAMS. Establish the ITAM policy, formal roles, and a Strategic IT Asset Management Plan.
3. Inventory and reliable data (Tier 1): Implement continuous inventory and reconcile it with finance and operations. Central data management (8.3) and license management (8.4) are the processes with the greatest immediate impact. Without reliable data, no subsequent step is sustainable. A IT asset management Structured on reliable data, it is the foundation of the entire standard.
4. Lifecycle processes (Tier 2): Structure processes for acquisition, deployment, operation, and disposal. Include controls for software modification, copying, and distribution. software asset management (SAM) It is a critical component of this phase.
5. Statement of Applicability: Document which processes from Appendix A were included or excluded, with formal justifications — a mandatory document for any audit or certification.
6. Integration and continuous improvement (Tier 3): Integrate ITAM with finance, ITSM, safety, and risk management. Conduct periodic internal audits (Clause 9.2) and management reviews (9.3). Implement documented corrective and preventive actions (Clause 10).
7. Certification preparation: If the organization wishes to obtain formal certification under the ITAM Forum scheme (available since 2023), consolidate evidence, audit trails, and reports for senior management as required by the standard.

When and to whom does the standard apply?

ISO 19770-1 is designed for any organization—of any size and sector—that wants to improve the management of its IT assets. The standard can be applied to hardware, software, services, licenses, and contracts. The organization defines the scope: there is no requirement for full coverage in the first implementation, and starting with the most critical areas is a recommended strategy.

Key areas of attention and common challenges

1. Resistance to change: New processes require active leadership involvement and the development of an organizational culture — an explicit requirement in Clause 5 of the standard.
2. Inadequate inventory or incomplete data: Without true visibility into assets, it is impossible to meet the reliable data requirements of Tier 1.
3. Integration between areas: The standard requires alignment between IT, finance, and operations. Information silos compromise the data reconciliation required by Clause 7.5.
4. Control of mixed environments: BYOD, cloud computing, and outsourcing create shared responsibilities that the standard addresses in Clauses 8.7 and 8.8—and which require explicitly documented controls.
5. Continuous maintenance: The standard requires constant improvement—implementation without review is not enough. The PDCA cycle is structural, not optional.
6. Well-defined scope: An overly broad scope can hinder progress. It is preferable to start with the most critical areas and gradually expand to the next tiers.