Introduction

This document specifies the requirements for the establishment, implementation, maintenance and improvement of a management system for IT asset management (ITAM), referred to as an “IT asset management system” (ITAMS).

This document provides additional requirements to ISO 55001:2014 which specifies the requirements for the establishment, implementation, maintenance and improvement of a management system for asset management, referred to as an “asset management system”. This document includes additional or more detailed requirements which are considered necessary for the management of IT assets. The primary differentiator is the need to manage software assets, with their specific characteristics. Although ISO 55001:2014 can be used to manage software assets if organizations define their scope and relevant requirements appropriately, it is primarily focused on physical assets with little provision for the management of software assets.

There are a number of characteristics of IT assets which create these additional or more detailed requirements. These are described in Annex C. As a result of these characteristics of IT assets, a management system for IT assets will consequently have explicit requirements additional to those in ISO 55001:2014 dealing with:

— controls over software modification, duplication and distribution, with particular emphasis on access and integrity controls;
— audit trails of authorizations and of changes made to IT assets;
— controls over licensing, underlicensing, overlicensing, and compliance with licensing terms and conditions;
— controls over situations involving mixed ownership and responsibilities, such as in cloud computing and with ‘Bring-Your-Own-Device’ (BYOD) practices; and
— reconciliation of IT asset management data with data in other information systems when justified by business value, in particular with financial information systems recording assets and expenses.

Furthermore, because information associated with IT assets is typically voluminous, highly complex and fast-changing, it is likely that organizations with such information will need to make use of automated information systems.

Another difference between ISO 55001:2014 and this document is that this document provides optionally for multiple explicit groupings of process objectives (or 'tiers'). The most important of these is the basic tier called 'trustworthy data', which is the most important to most end-user organizations and also software publishers. Tier two is for ‘life cycle integration’, and tier three is for ‘optimization’. More information about the tiers and their respective groupings of objectives is given in Annex B.

Since major physical assets increasingly incorporate or depend on software, it is likely that the additional requirements of this document will be relevant in such situations. It is likely that most organizations with major physical assets will need management systems meeting a mixture of 'pure' ISO 55001:2014 requirements and also of the additional requirements from this document.

IT assets encompass a wide variety of asset types. Figure 1 indicates the principal IT asset types diagrammatically.

Figure 1 — Principal types of IT assets

This document can be used by any organization and can be applied to all types of IT assets. The organization determines to which of its IT assets this document applies.

This document is primarily intended for use by:

— those involved in the establishment, implementation, maintenance, and improvement of an IT asset management system;
— those involved in delivering IT asset management activities, including service providers;
— internal and external parties to assess the organization’s ability to meet legal, regulatory and contractual requirements and the organization’s own requirements.

The order in which requirements are presented in this document does not reflect their importance or imply the order in which they are to be implemented.

Further guidance regarding the application of the requirements within this document shared with ISO 55001:2014 is provided in ISO 55002.

General information on asset management and on IT asset management, and information on the terminology applicable to this document, is provided in ISO 55000 and in ISO/IEC 19770‑5. Organizations can find that these documents will assist in the development of IT asset management in their organization.

This document applies the definition of "risk" given in ISO 31000:2009 and ISO/IEC Guide 73:2009. In addition, it uses the term “stakeholder” rather than “interested party”.

This document is designed to enable an organization to align and integrate its IT asset management system with related management system requirements, for example those specified by ISO/IEC 27001 and ISO/IEC 20000‑1.

This document is not intended to be in conflict with any organization's policies, procedures and standards. Any such conflict should be resolved before using this document.

BS ISO/IEC 19770-1:2017

Information technology. IT asset management - IT asset management systems. Requirements

Current, Under Review

Published:

31 Dec 2017