ISO/IEC 38500 IT Governance: Board Guide (2024)

Most boards are accountable for how their organisation uses technology, yet few have a clear model for what they should decide themselves, what they delegate and how they know delegation is working. ISO/IEC 38500 is the international standard that answers that question for IT: it gives principles and a governance model for governing bodies, not a control catalogue for IT teams. This guide explains what the 2024 edition says, how it changed from 2015, how the evaluate, direct and monitor model works in practice, how it relates to COBIT 2019, ISO/IEC 27014 and the NIST CSF 2.0 Govern function, and how to turn it into board reporting, including oversight of machine identities and AI agents. It is written for directors, company secretaries, CIOs, CISOs and governance, risk and compliance leads.

Key takeaways

It is a board standard. ISO/IEC 38500:2024 addresses governing body members and those who support them, and applies to organisations of every type and size.
The 2024 edition aligned with ISO 37000. According to the ISO/IEC JTC 1/SC 40 committee, it moved from six IT-specific principles to the eleven principles of ISO 37000 and treats IT governance as part of organisational governance.
Evaluate, direct, monitor still frames the work. The governing body evaluates IT use, sets direction through strategy and policy, monitors performance and conformance, and the 2024 model adds stakeholder engagement.
COBIT sits underneath, not beside. ISO/IEC 38500 says what the board must do; COBIT 2019, ISO/IEC 27001 and the NIST CSF supply the objectives and controls management uses to deliver it.
Machine identities and AI agents are now governance questions. Delegation of authority to software, accountability for automated decisions and visibility of non-human access belong in board reporting.

What it is and who it applies to

ISO/IEC 38500:2024, Information technology: Governance of IT for the organization, is the third edition, published in February 2024 by ISO/IEC JTC 1/SC 40. ISO describes it as guiding principles for members of governing bodies, and those who support them, on the effective, efficient and acceptable use of IT. It covers governance of the organisation's current and future use of IT, and governance of IT as a domain of organisational governance.

Governing body: the board of directors, trustees, partners, owners or the equivalent group accountable for the whole organisation. SC 40 describes the audience as owners, directors, partners and executive managers.
Those who support them: company secretaries, CIOs, CISOs, chief risk officers, internal audit and advisers who prepare board papers and assurance.
All sectors and sizes: it is guidance, not a certifiable management system standard. Organisations claim alignment, and assess governance with ISO/IEC 38503:2022, rather than being certified to ISO/IEC 38500.

The 38500 family

Document	Title (short)	Use it for
ISO/IEC 38500:2024	Governance of IT for the organization	The principles and governance model
ISO/IEC TS 38501:2015	Implementation guide	Putting governance of IT in place
ISO/IEC TR 38502:2017	Framework and model	Separating governance from management responsibilities
ISO/IEC 38503:2022	Assessment of the governance of IT	Independent assessment of how well governance works
ISO/IEC 38505-1:2017 and parts 2 and 3	Governance of data	Applying the principles to data, including classification
ISO/IEC 38506:2020	IT-enabled investments	Board decisions on technology investment
ISO/IEC 38507:2022	Governance implications of AI	Board oversight of AI use

SC 40 Working Group 1, set up in June 2013, maintains the family. It notes that stakeholders increasingly expect IT to be trustworthy, secure, private, safe and ethical, which is why security and AI questions now sit inside IT governance rather than beside it.

Structure and key requirements

From six principles to eleven

The 2015 edition set out six principles: responsibility, strategy, acquisition, performance, conformance and human behaviour. SC 40's white paper on the differences explains that the 2024 edition replaced them with the eleven principles of ISO 37000:2021 Governance of organizations, with guidance on applying each to IT. ISO 37000's principles are purpose, value generation, strategy, oversight, accountability, stakeholder engagement, leadership, data and decisions, risk governance, social responsibility, and viability and performance over time. If your policies still cite the 2015 six, they are out of date but not wrong in spirit: each maps onto one or more of the eleven.

2015 principle	Closest 2024 (ISO 37000) principles	What the board should see
Responsibility	Accountability, leadership	Named owners for IT risk and outcomes; documented delegations
Strategy	Purpose, strategy, value generation	Technology plans tied to organisational purpose and strategy
Acquisition	Value generation, risk governance	Investment cases with benefits, risks and exit options
Performance	Oversight, viability and performance over time	Service, resilience and benefit metrics against plan
Conformance	Oversight, risk governance, data and decisions	Compliance status against law, policy and contracts
Human behaviour	Social responsibility, stakeholder engagement	Impact of IT decisions on staff, customers and society

Outcomes and framework elements

The 2024 edition adopts ISO 37000's three governance outcomes: effective performance, responsible stewardship and ethical behaviour. It uses ISO 37000's definition of an organisational governance framework (the strategies, policies, decision-making structures and accountabilities through which governance operates) and sets out six framework elements: direction, capability, policy, delegation, performance and accountability.

The governance model: evaluate, direct, monitor, engage

Evaluate: assess current and future use of IT against strategy, stakeholder needs, regulation, technology change and risk. Board evidence: horizon scans, risk assessments, investment cases.
Direct: set direction through strategy, policy, risk appetite, delegations and resource decisions. Board evidence: approved strategy, policies and delegated authority schedules.
Monitor: check performance and conformance against what was directed. Board evidence: KPI and key risk indicator reporting, internal audit and assurance results.
Engage stakeholders: the SC 40 white paper identifies this as the main addition to the model. Governance is exercised throughout the organisation, with management working inside a framework the governing body sets.

ISO/IEC 27014:2020 applies the same pattern to information security, with evaluate, direct, monitor and communicate. See the ISO/IEC 27014 Governance of Information Security Guide.

Identity and NHI requirements

ISO/IEC 38500 contains no identity controls. Its relevance is that delegation, accountability and data and decisions are governance principles, and in most organisations a large share of delegated authority is now held by software: service accounts, API keys, workload identities, automation pipelines and AI agents. A board that cannot see how that authority is granted and reviewed cannot claim effective oversight.

Governance principle or element	Identity and NHI question for the board	Evidence management should provide
Delegation	Which decisions and access have we delegated to automated systems and AI agents, and under what limits?	Inventory of non-human identities with owner, purpose and privilege tier
Accountability	Who is accountable when an automated identity is misused?	Named human owner for every service account, key and agent
Risk governance	Is machine identity risk inside our stated risk appetite?	Key risk indicators: unowned identities, secrets older than policy, standing privileged access
Data and decisions	Can we trace an automated action back to an identity and an approval?	Logging coverage and audit trail tests
Oversight	How do we know reviews and rotations actually happen?	Access review completion and secret rotation metrics, audit findings

For AI specifically, ISO/IEC 38507:2022 extends the same principles to the use of AI. Breaches such as the Internet Archive breach, where an exposed GitLab token led to a user database and Zendesk API tokens that had not been rotated were later used to send emails from the Archive's own support account, show how a management-level hygiene failure becomes a governance failure when nobody at board level asks for the metric. See the Non-Human Identity (NHI) Guide and the NHI Governance Maturity Model.

Implementation steps

Agree the scope and sponsor: the chair or a board committee (audit, risk or technology) adopts ISO/IEC 38500 as the reference for governance of IT. Record the decision.
Map the current state: list board and committee terms of reference, delegated authority schedules, IT strategy and policies. Mark which of the eleven principles each covers. ISO/IEC TS 38501 and TR 38502 help structure this.
Write the governance framework: set out direction, capability, policy, delegation, performance and accountability for IT, including the risk appetite for technology, cyber and AI. See the Cyber Risk Appetite Statement Template.
Separate governance from management: decide which decisions stay with the board (strategy, appetite, major investments, material outsourcing) and which are delegated, then choose a management framework such as COBIT 2019 or ISO/IEC 27001 to deliver them.
Design board reporting: a short pack each quarter covering strategy progress, top technology risks against appetite, major incidents, assurance results and decisions required. See the Board Cyber Risk Reporting Guide.
Engage stakeholders: build customer, regulator, staff and supplier views into evaluation, as the 2024 model requires.
Pilot for two cycles: run the new reporting for two quarters alongside existing papers, collect director feedback, then retire the old format. If the pilot overloads the board, revert to the previous pack and cut metrics, not principles.
Assess: after a year, commission an assessment against ISO/IEC 38503 by internal audit or an independent party.

Small versus large organisations: a small organisation can cover all of this in a single annual board session plus a two-page quarterly IT and cyber update owned by one executive. A large or regulated organisation usually needs a technology or risk committee, a formal delegated authority schedule and a three lines model with internal audit assurance.

Evidence and assessment

ISO/IEC 38503:2022 provides the assessment approach for governance of IT. Whatever method you use, assessors look for evidence that each part of the model operates, not just that documents exist.

Model activity	Evidence that it operates	Useful measure
Evaluate	Board minutes showing technology risks and options discussed before decisions	Share of major IT investments with a board-reviewed risk and benefit case
Direct	Approved IT strategy, policies, risk appetite and delegations, reviewed on schedule	Policies past review date
Monitor	Quarterly KPI and key risk indicator reports, assurance and audit follow-up	Overdue high-risk audit actions; key risk indicators outside appetite
Engage stakeholders	Records of stakeholder input into technology decisions	Number of decisions with documented stakeholder input
Accountability	Named owners for each technology risk and system, including non-human identities	Percentage of critical systems and machine identities with a current owner

Keep the board pack's metrics to five or six. A practical set: strategy milestones on track, top risks against appetite, critical incidents and time to recover, audit actions overdue, access and identity hygiene (including owned and rotated machine credentials), and major supplier risk changes.

Mapping to other frameworks

ISO/IEC 38500 is the governing body layer. Other frameworks fill in management objectives and controls. The table shows how they fit; NIST identifiers were checked against the CSF 2.0 and SP 800-53 Rev. 5 catalogues.

ISO/IEC 38500 concept	COBIT 2019	ISO/IEC 27014:2020	NIST CSF 2.0 Govern	NIST SP 800-53 Rev. 5
Purpose and strategy	EDM02 Ensured benefits delivery	Direct	GV.OC-01 mission informs risk management	PM-1 Information Security Program Plan
Governance framework and delegation	EDM01 Ensured governance framework setting and maintenance	Direct	GV.RR-02 roles, responsibilities and authorities	PM-2 Information Security Program Leadership Role
Accountability and leadership	EDM01	Evaluate, direct	GV.RR-01 leadership responsible and accountable	PM-2
Risk governance	EDM03 Ensured risk optimisation	Evaluate	GV.RM-01 risk management objectives agreed	PM-9 Risk Management Strategy
Policy	APO01 (management)	Direct	GV.PO-01 cybersecurity risk policy	PM-1
Oversight	EDM01 to EDM05 monitoring	Monitor	GV.OV-01 strategy outcomes reviewed	PM-9
Stakeholder engagement	EDM05 Ensured stakeholder engagement	Communicate	GV.OC-02 stakeholder needs understood	PM-1
Value generation and resources	EDM04 Ensured resource optimisation	Direct	GV.SC-01 supply chain risk programme	PM-9

COBIT 2019: ISACA's framework has 40 governance and management objectives; its Evaluate, Direct and Monitor domain reflects the ISO/IEC 38500 model. Use COBIT when you need management objectives and capability levels. See the COBIT 2019 Guide.
NIST CSF 2.0 Govern: the Govern function gives cyber-specific outcomes for context, risk strategy, roles, policy, oversight and supply chain. See the NIST CSF 2.0 Govern Function Guide.
UK board expectations: the Financial Reporting Council's 2024 UK Corporate Governance Code applies to financial years beginning on or after 1 January 2025, with Provision 29 (the board's declaration on the effectiveness of material internal controls) applying from financial years beginning on or after 1 January 2026. The government's Cyber Governance Code of Practice, published on 8 April 2025 with the NCSC, is voluntary guidance for directors. Both are easier to meet when ISO/IEC 38500 already defines what the board evaluates, directs and monitors.
Risk management: see the ISO 31000 Risk Management Guide for the risk process the board oversees.

Common pitfalls

Treating it as an IT department standard: handing ISO/IEC 38500 to the CIO to "implement" defeats its purpose; the governing body owns it.
Citing the 2015 principles: policies and audit programmes still quoting six principles miss the 2024 alignment with ISO 37000 and stakeholder engagement.
Confusing governance with management: board papers full of project status and patch counts, with no decisions requested, show the board is managing rather than governing.
Delegation without limits: authority delegated to teams, suppliers and automated systems with no documented limits or review, including service accounts and AI agents with standing privileged access.
Metrics without appetite: reporting numbers without thresholds the board has approved, so nobody can tell whether a figure is acceptable.
No assessment: claiming alignment for years without testing it against ISO/IEC 38503 or an internal audit review.

Practitioner checklist

Confirm the governing body has formally adopted ISO/IEC 38500:2024 as its reference for governance of IT.
Update policy and audit references from the 2015 six principles to the 2024 eleven principles and three outcomes.
Document the IT governance framework covering direction, capability, policy, delegation, performance and accountability.
Publish a delegated authority schedule that includes delegation to suppliers, automation and AI agents.
Set an approved risk appetite for technology, cyber and AI with measurable thresholds.
Limit the quarterly board pack to five or six metrics, each with an owner and a threshold.
Include machine identity ownership and credential rotation in board-level key risk indicators.
Map management frameworks (COBIT 2019, ISO/IEC 27001, NIST CSF 2.0) to the governance model so nothing is duplicated.
Schedule an assessment against ISO/IEC 38503 within 12 months of adoption.

Standards and references

Related NHI Mgmt Group resources: COBIT 2019 Guide · ISO/IEC 27014 Governance of Information Security Guide · NIST CSF 2.0 Govern Function Guide · Board Cyber Risk Reporting Guide. This guide summarises ISO/IEC 38500:2024 and related governance guidance and is not legal advice.

ISO/IEC 38500 IT Governance: Board Principles, Model and Practical Reporting