ISO/IEC 38500:2015(E) Information technology — Governance of IT for the organization

ISO/IEC 38500:2015(E) Information technology — Governance of IT for the organization 1 Scope This International Standard provides guiding principles for members of governing bodies oforganizations(which can comprise owners, directors, partners, executive managers, or similar) on theeffective, efficient, and acceptable use of information technology (IT) within their organizations. lt also provides guidance to those advising, informing, or assisting governing bodies.They includethe following: executive managers; members of groups monitoring the resources within the organization; external business ortechnical specialists, such as legal or accounting specialists,retail or industrialassociations,or professional bodies; internal and external service providers (including consultants);-auditors. This International Standard applies to the governance of the organization's current and future use ofITincluding management processes and decisions related to the current and future use of IT.Theseprocesses can be controlled by IT specialists within the organization, external service providers, orbusiness units within the organization. This International Standard defines the governance of lT as a subset or domain of organizationalgovernance, or in the case of a corporation, corporate governance. This International Standard is applicable to all organizations, including public and private companies,government entities, and not-for-profit organizations. This International Standard is applicable toorganizations of all sizes from the smallest to the largest, regardless of the extent of their use of lT.The purpose of this International Standard is to promote effective,efficient, and acceptable use of lT inall organizations by assuring stakeholders that, if the principles and practices proposed by the standard are followed,they can have confidence in the organization's governance of Ii, informing and guiding governing bodies in governing the use of lT in their organization, andestablishing a vocabulary for the governance of IT.