International standards in the ISO/IEC 19770 family of standards for IT asset management address both the processes and technology for managing software assets and related IT assets. Broadly speaking, the standard family belongs to the set of Software Asset Management (or SAM) standards and is integrated with other Management System Standards.
ISO/IEC 19770-1: Processes
ISO/IEC 19770-1 is a framework of ITAM processes to enable an organization to prove that it is performing software asset management that meets corporate governance standards. ISO/IEC 19770-1:2017 specifies the requirements for the establishment, implementation, maintenance and improvement of a management system for IT asset management (ITAM), referred to as an “IT asset management system” (ITAMS).
While ISO 55001:2014 specifies the requirements for the establishment, implementation, maintenance and improvement of a management system for asset management, referred to as an “asset management system”, it is primarily focused on physical assets with little provision for the management of software assets. There are a number of characteristics of IT assets which create additional or more detailed requirements. As a result of these characteristics of IT assets, the 19770-1 management system for IT assets has explicit additional requirements dealing with:
controls over software modification, duplication and distribution, with particular emphasis on access and integrity controls; audit trails of authorizations and of changes made to IT assets; controls over licensing, underlicensing, overlicensing, and compliance with licensing terms and conditions; controls over situations involving mixed ownership and responsibilities, such as in cloud computing and with ‘Bring-Your-Own-Device’ (BYOD) practices; and reconciliation of IT asset management data with data in other information systems when justified by business value, in particular with financial information systems recording assets and expenses.
Updates to 19770-1
The first generation was published in 2006.
The second generation was published in 2012. It retained the original content (with only minor changes) but splits the standard up into four tiers which can be attained sequentially. These tiers are:
Tier 1: Trustworthy Data
Tier 2: Practical Management
Tier 3: Operational Integration
Tier 4: Full ISO/IEC ITAM Conformance
ISO 19770-1 Edition 3 (current version)
The most recent version, known as ISO 19770-1:2017 and published in December 2017, specifies the requirements for the establishment, implementation, maintenance, and improvement of a management system for IT asset management (ITAM), referred to as an IT asset management system. ISO 19770-1:2017 was a major update and rewrote the standard to conform to the ISO Management System Standards (MSS) format. The tiered structure from 197701:2012 was moved to an appendix within the updated standard.
ISO/IEC 19770-2: software identification tag
ISO/IEC 19770-2 provides an ITAM data standard for software identification (SWID) tags. Software ID tags provide authoritative identifying information for installed software or other licensable item (such as fonts or copyrighted papers).
Overview of SWID tags in use
Providing accurate software identification data improves organizational security, and lowers the cost and increases the capability of many IT processes such as patch management, desktop management, help desk management, software policy compliance, etc.
Discovery tools, or processes that utilize SWID tag data to determine the normalized names and values that are associated with a software application and ensure that all tools and processes used by an organization refer to software products with the same exact names and values.
Standards development information
This standard was first published in November 2009. A revision of this standard was published in October 2015.
Steve Klos is the editor of 19770-2 and works for 1E, Inc as a SAM Subject Matter Expert.
ISO/IEC 19770-3: software entitlement schema (ENT) This part of ISO/IEC 19770 does not provide requirements or recommendations for processes related to software asset management or ENTs. The software asset management processes are in the scope of ISO/IEC 19770-1.
Standards development information
The ISO/IEC 19770-3 Other Working Group ("OWG") was convened by teleconference call on 9 September 2008.