National foreword

This British Standard is the UK implementation of ISO/IEC 38501‑1:2026.

The UK participation in its preparation was entrusted to Technical Committee IST/60/1, Governance of Information Technology.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 October 2026.

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).

ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 40, Service management and IT governance.

This first edition of ISO/IEC 38501‑1, together with the first edition of ISO/IEC TS 38501‑2, cancels and replaces the first edition of ISO/IEC TS 38501:2015, which has been technically revised.

The main changes are as follows:

the content has been aligned to take updates to ISO/IEC 38500:2024 into account;
Annex A (assessment scheme) and Annex B (sample characteristics by principle) have been moved to ISO/IEC TS 38501‑2 to facilitate alignment and use with ISO/IEC 38503.

A list of all parts in the ISO/IEC 38501 series can be found on the ISO and IEC websites.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-committees.

Introduction

Information technology (IT) is now pervasive in supporting, enabling and transforming the strategy and business opportunities of organizations. The extensive use of data, coupled with the rapid adoption of digital capabilities and powerful emerging technologies, such as cloud computing, the internet of things (IoT) and artificial intelligence (AI), can substantially improve organizational outcomes, thereby enabling organizations to meet the needs and expectations of their various stakeholders.

However, the deployment and use of information technology is not without challenges, including the increasing prevalence of cybersecurity threats, stringent legislative and regulatory environments, failure to achieve planned benefits from IT investments, and the potential for financial and reputational damage associated with the above risks.

Governing bodies are increasingly aware of the need for effective and efficient governance of IT to ensure the appropriate and responsible use of IT in the organization. However, they are sometimes uncertain of their responsibilities in this regard, or of what arrangements they need to have in place.

This document has therefore been developed to provide guidance on the implementation of the governance of IT within organizations, in accordance with ISO/IEC 38500, to support the key organizational governance outcomes (as defined in ISO/IEC 38500:2024, 4.1) of:

effective performance;
responsible stewardship; and
ethical behaviour.

This document provides guidance on a method for implementing principles-based governance of IT, which uses the principles, model and framework described in ISO/IEC 38500, and the assessment scheme for the governance of IT described in ISO/IEC TS 38501‑2.

1 Scope

This document provides guidance on the implementation of effective governance of IT in an organization, in accordance with ISO/IEC 38500.

It identifies the key activities that an organization can undertake and provides guidance on the design and establishment of the supporting and enabling arrangements for the governance of IT, clarifying the roles and responsibilities of key organizational stakeholders.

This document can be used by individuals responsible for governance of IT in an organization, as well as individuals supporting the governance of IT in organizations, and is applicable to organizations of all sizes and types.

2 Normative references

3 Terms and definitions

4 Implementation approach

5 Sponsorship

6 Enabling mechanisms

6.1 General

6.2 Framework for the governance of IT

6.3 Governance support group

6.4 Committees of the governing body

7 Governance tasks

7.1 Engage stakeholders

7.2 Evaluate

7.3 Direct

7.4 Monitor

8 Continual review

Bibliography