ISO/IEC 19770 Series: ISO/IEC 19770 Series – Tutorial (about 60 minutes)

The ISO/IEC 19770 series is the international family of standards for IT asset management (ITAM): the discipline of knowing which hardware, software and related services an organisation owns or uses, what it is entitled to use, what those assets cost and what risk they carry, from the moment they are requested until they are retired. IT asset managers, software licence specialists, procurement and finance teams, service managers, security engineers and auditors use the series, as do tool vendors who build discovery and licence management products. After this tutorial you will be able to explain what each part of the family is for, describe the management system that Part 1 requires, read the purpose of the software, hardware, entitlement and usage data standards, plan a first implementation and judge what conformance or certification would involve.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The family is published jointly by ISO and IEC and maintained by joint technical committee ISO/IEC JTC 1, subcommittee SC 7 (Software and systems engineering). As verified on 2026-10-29 in the ISO catalogue, the core document is ISO/IEC 19770-1:2017, IT asset management — Part 1: IT asset management systems — Requirements, the third edition, published in December 2017, last reviewed and confirmed in 2024 and supplemented by Amendment 1:2024 (climate action changes). The other published parts are Part 2:2015 (software identification tag, second edition), Part 3:2016 (entitlement schema), Part 4:2017 (resource utilization measurement), Part 5:2015 (overview and vocabulary), Part 6:2024 (hardware identification tag), Part 8:2020 (mapping of industry practices, confirmed in 2026), Part 11:2021 (requirements for certification bodies), and two Technical Specifications: ISO/IEC TS 19770-10:2025 (guidance for implementing ITAM) and ISO/IEC TS 19770-13:2026 (sustainability aspects). Two revisions are in progress: a third edition of Part 5, retitled Vocabulary, had reached the "under publication" stage in October 2026 with publication expected in November 2026, and Part 11 has been marked "to be revised" with a new working draft registered. No revision of Part 1 was listed. This tutorial teaches the editions that are current today and flags where a change is coming.

Who it is for: IT asset and software asset managers, licence and procurement specialists, service management and configuration management staff, security and vulnerability teams who depend on an accurate inventory, finance and FinOps practitioners, internal auditors, and engineers who build or package software and want to understand software identification tags.

Prerequisites: none. It helps to know roughly what a software licence is and what an inventory or configuration management database (CMDB) does, but every term is explained when it first appears.

By the end of the course:

You will be able to explain why the family exists and name the purpose of each of its published parts.
You will be able to define the core vocabulary of ITAM, including IT asset, entitlement, software identification tag and IT asset management system.
You will be able to describe how ISO/IEC 19770-1 uses the common management system structure and how it extends ISO 55001.
You will be able to explain how identification, entitlement and usage data combine to show whether an organisation is correctly licensed.
You will be able to outline the practical steps, roles and records of a first ITAM implementation.
You will be able to distinguish self-assessment, vendor licence reviews and accredited certification of an IT asset management system.
You will be able to relate the family to ISO 55001, ISO/IEC 20000-1, ISO/IEC 27001, ITIL, the NIST Cybersecurity Framework and the CIS Controls.

Lesson 1 – Origins, purpose and scope

Why organisations needed a standard

Every organisation that uses computers holds a large and constantly changing collection of IT assets: laptops, servers, network devices, phones, installed applications, cloud subscriptions, software-as-a-service accounts, licence keys and support contracts. Without a disciplined way of managing them, three kinds of problem appear. The first is financial: the organisation pays for licences nobody uses, renews contracts it forgot about, or buys hardware that is already sitting in a store room. The second is legal and contractual: software publishers have the right to check whether customers use their products within the licence terms, and a shortfall discovered in such a review can lead to large unplanned payments. The third is security and operational risk: you cannot patch, protect or recover what you do not know you have, and unmanaged software is a common entry point for attackers.

Software asset management (SAM) grew in the 1990s and 2000s as a practice for the second problem in particular, and early guidance came from industry groups, software publishers and national bodies. The difficulty was that every source used different vocabulary, different maturity models and different expectations, so a customer could not easily show a publisher, an auditor or its own board that its practice was sound. The international committee responsible for software engineering standards took up the work, and the first edition of Part 1, focused on SAM processes, was published in 2006.

From software to all IT assets

The series has grown in two directions since then. First, its scope widened from software to all IT assets, so the series title changed from software asset management to IT asset management. The 2012 second edition of Part 1 kept most of the earlier process content and introduced a staged path of four tiers (trustworthy data, practical management, operational integration and full conformance) so that organisations could improve step by step. The 2017 third edition was a major rewrite: it adopted the common structure used by all ISO management system standards and became a set of requirements for an IT asset management system, defined as an extension of the general asset management system standard ISO 55001.

Second, the family added data standards that let tools exchange reliable information automatically. Software identification tags came first in 2009 and were revised in 2015; an entitlement schema followed in 2016, a structure for usage measurements in 2017 and hardware identification tags in 2024. These parts are written mainly for software publishers, hardware makers and tool vendors, but the organisation that consumes the data benefits most, because the quality of its inventory and licence position depends on them.

What is in and out of scope

Part 1 applies to any type or size of organisation and to all types of IT asset. The organisation itself decides which asset types and which parts of the organisation are inside the scope of its system; a common first scope is software from a few high-spend publishers plus end-user hardware, widened later. Part 1 is aimed primarily at IT assets but can also be applied to other asset types; it adds that it may suit embedded software and firmware in whole or in part, although that use has not yet been settled. It does not manage information assets as such (the data held in systems is not the asset it manages, although data about the assets is). It also does not prescribe financial accounting rules or technical requirements for particular asset types. Those limits matter when you explain the standard to colleagues: it is about running a reliable management system for IT assets, not about how to depreciate a server or which database to buy.

A useful way to state the purpose is this: the family helps an organisation reach and maintain a state in which its information about IT assets is trustworthy, decisions about those assets are made deliberately, and the assets deliver value at acceptable cost and risk across their whole life.

Lesson 2 – Key concepts and vocabulary

The vocabulary of the family is set out in Part 5. The definitions below are explained in plain words for this course; they are not the official wording, which you should read in the standard itself.

Asset – anything that has potential or actual value to an organisation. The idea comes from the ISO 55000 asset management family, which the ITAM standards build on.
IT asset – an asset that is part of information technology: hardware, software, and the related licences, rights, subscriptions and services. Whether a given item counts depends on the scope the organisation sets.
IT asset management (ITAM) – the coordinated activity of an organisation to obtain value from its IT assets across their life cycle while controlling cost and risk.
Software asset management (SAM) – the part of ITAM that deals with software and the rights to use it; historically the starting point of the family.
IT asset management system (ITAMS) – the set of interrelated elements (policy, objectives, roles, processes, records, reviews) that an organisation uses to direct and control its ITAM. It is what Part 1 specifies requirements for.
Entitlement – the rights to use software that an organisation actually holds, such as how many users, devices or processor cores it may license, for how long and under which restrictions. It is the usage-rights portion of a licence agreement.
Licence metric – the unit by which use is counted for an entitlement, for example per installation, per named user, per concurrent user, per device or per core.
Software identification tag (SWID tag) – a small structured document, defined in Part 2, that identifies a piece of installed or installable software: its name, version, the organisation that created it and other identifying details.
Hardware identification tag (HWID tag) – the hardware counterpart defined in Part 6: structured data that identifies a device or component in a consistent way.
Entitlement schema (ENT) – the structure in Part 3 for recording entitlements digitally so that they can be exchanged between publishers, resellers and the customer's tools.
Resource utilization measurement (RUM) – the structure in Part 4 for recording how much of a resource has been consumed, such as user sessions or processing time, so that usage can be compared with metric-based entitlements.
Tag producer and tag consumer – the producer creates tags (a software publisher, platform provider or tagging tool); the consumer reads them (the customer, a discovery tool or a security scanner).
Trustworthy data – asset information that is complete, accurate and current enough to base decisions on. It was the first tier in the 2012 edition and remains the foundation of every ITAM programme.
IT asset life cycle – the stages an asset passes through, from specifying the need through acquisition, deployment and operation to retirement and disposal.
Licence position – the comparison of what the organisation uses against what it is entitled to use, showing surplus or shortfall per product. Practitioners often call this the effective licence position; that is industry language rather than a term you must use.

Two distinctions are worth fixing early. The first is between identification and entitlement. A SWID tag tells you that version 12 of a product is installed on a server; it does not tell you whether you are allowed to run it there. That second question is answered by entitlement data. The second distinction is between installation and use. Many modern licences are counted by consumption or by users rather than by copies, so a complete picture also needs usage measurement. Much of the value of the family lies in combining these three kinds of data reliably.

Lesson 3 – Structure of the family

The family is easiest to understand in three groups: the management system requirements and the rules for certifying them, the supporting guidance, and the data standards that tools use to exchange information. Figure 1 shows the groups and the published parts in each.

Figure 1 – The ISO/IEC 19770 family grouped into management system requirements, supporting guidance and data standards.

Management system documents

Part 1 is the heart of the family. It states what an organisation must do to have a conforming IT asset management system, using the clause structure shared by all ISO management system standards (explained below). It describes itself as a discipline-specific extension of ISO 55001:2014, the general asset management system standard: it adds requirements particular to IT on top of the general ones. Conforming to Part 1 does not by itself mean conforming to ISO 55001; an organisation that wants both must meet both. Amendment 1:2024 adds the climate change wording that ISO inserted across its management system standards in 2024: when you analyse your context you must decide whether climate change is a relevant issue, and you must consider that interested parties may have climate-related requirements.

Part 11 is not for the organisation that runs ITAM but for certification bodies that audit and certify such systems. It sets requirements on top of ISO/IEC 17021-1, the general standard for bodies certifying any management system, covering topics such as auditor competence and audit planning for ITAM. Accreditation bodies can use it when accrediting certification bodies. It is marked for revision.

Guidance documents

Part 5 gives an overview of the family and the common vocabulary. The current 2015 edition is titled Overview and vocabulary; the coming edition is titled simply Vocabulary, so check which edition your organisation references when it is published.

Part 8 gives guidelines for producing a mapping between an industry practice (for example, a publisher's or tool vendor's own ITAM framework, or a service management framework) and the family. Its first edition only covers mappings to and from the 2012 and 2017 editions of Part 1. It helps an organisation that already follows another framework to see what it would need to add to meet Part 1.

ISO/IEC TS 19770-10:2025, a Technical Specification, gives practical guidance on implementing ITAM. It organises processes in three groups: management system processes (context, leadership, planning, support, operation, evaluation and improvement), functional management processes that cut across the life cycle (for example change, data, licence, security, relationship and contract, financial and service level management) and life cycle processes (specification, development, acquisition, release, deployment, operation and retirement). Lesson 4 uses this grouping.

ISO/IEC TS 19770-13:2026 gives guidance on building sustainability aspects into an ITAM system, within the scope set under Part 1, and on deciding which sustainability topics matter to the organisation and its stakeholders. Typical examples are extending device life, reuse and responsible disposal.

Data standards

Part 2 specifies the software identification tag. A SWID tag is an XML document stored with, or delivered alongside, a software component. It carries the product name and version, a unique tag identifier, the organisation that created the tag and the roles of other organisations (such as the software creator or licensor), and can list the files the software consists of so that a scanner can check the installation. There are four tag types: a primary tag for an installed product, a patch tag for an update, a corpus tag describing an installation package before it is installed, and a supplemental tag that lets another party add information without changing the original. Part 2 addresses producers and consumers of tags; it does not prescribe ITAM processes.

Part 3 specifies a schema for entitlements: the terms used to talk about usage rights and a format for capturing an entitlement digitally, including its metrics. The goal is that proof of ownership, cost optimisation and compliance become easier when the purchase record can be read by a machine. The licence agreement itself remains the legally binding document; the entitlement record is a structured representation of it.

Part 4 specifies an information structure for resource utilization measurement data, for example how many users ran an application, how many concurrent sessions occurred or how many processor hours were consumed in a period.

Part 6 specifies the hardware identification tag, the hardware equivalent of the SWID tag, so that devices and components can be identified consistently by discovery tools. Like Part 2, it deals only with identification and leaves processes to Part 1.

The clause structure of Part 1

Because Part 1 follows the common management system structure (often called the Harmonized Structure, and formerly Annex SL or the High Level Structure), its requirements sit in clauses 4 to 10, preceded by scope, normative references and terms. Figure 2 shows how these clauses form a Plan-Do-Check-Act cycle.

Figure 2 – The clauses of ISO/IEC 19770-1 follow the common management system structure, forming a Plan-Do-Check-Act cycle.

In ITAM terms the clauses ask for the following, paraphrased:

Clause 4 – Context: understand internal and external issues (publishers' licensing models, cloud adoption, regulation, climate), identify interested parties and their requirements, and define the scope of the ITAM system and which asset types it covers.
Clause 5 – Leadership: top management shows commitment, sets an ITAM policy aligned with the organisation's objectives, and assigns roles, responsibilities and authorities.
Clause 6 – Planning: address risks and opportunities (for example audit exposure or security gaps), set measurable ITAM objectives and plan how to achieve them.
Clause 7 – Support: provide resources, competent people, awareness, communication and controlled documented information, including the asset records themselves.
Clause 8 – Operation: plan and control the ITAM processes, including those for asset data, life cycle stages and interfaces with other processes, and control outsourced activities.
Clause 9 – Performance evaluation: monitor and measure, run internal audits and hold management reviews.
Clause 10 – Improvement: handle nonconformities with corrective action and improve the system continually.

If your organisation already runs ISO 9001, ISO/IEC 27001 or ISO/IEC 20000-1, this structure will look familiar, and many elements such as document control, internal audit and management review can be shared across systems.

Lesson 4 – How it works in practice

Three layers of processes

A working ITAM system has three layers. The management system layer, described by clauses 4 to 10, decides scope, policy, objectives and how performance is reviewed. The functional layer contains processes that apply to all assets whatever their life stage: managing the asset data, managing licences and contracts, linking ITAM to change management, security and finance, and managing relationships with publishers and suppliers. The life cycle layer moves each asset through its stages. Technical Specification 19770-10 uses exactly this grouping, which is a practical template for a process catalogue.

Figure 3 – The IT asset life cycle, with cross-cutting functional processes supporting every stage.

The life cycle in everyday terms

During specification someone describes a need, and ITAM checks whether an existing asset or licence can meet it before anything is bought. Acquisition covers buying or subscribing, and the key ITAM task is to capture the entitlement and proof of purchase at that moment rather than searching for it years later. Development applies when the organisation builds software itself and must track the open source and third-party components it uses. Release and deployment put the asset into the live environment; this is where a record links the asset to its owner, location or user and its entitlement. Operation is the long middle phase in which usage is measured, changes are controlled, and the asset is maintained and patched. Retirement removes the asset, recovers licences for reuse, cancels subscriptions and ensures hardware is wiped and disposed of responsibly.

Roles

The standard asks for responsibilities to be assigned; it does not prescribe job titles. Typical roles are:

an executive sponsor who owns the ITAM policy and objectives and chairs or attends management review;
an ITAM manager who runs the system day to day and reports on performance;
licence specialists for complex publishers, who interpret contract terms and metrics;
asset owners in the business who approve requests and accept costs;
procurement, finance, service desk, change management and security staff, whose processes exchange data with ITAM.

Records and artefacts

Typical documented information includes the scope statement, the ITAM policy, objectives and plans, process descriptions, the asset register (often within a CMDB or a dedicated ITAM tool), the entitlement repository with proofs of purchase, licence position reports, usage reports, risk assessments, internal audit reports, management review minutes and corrective action records. The standard expects documented information to be controlled, which for asset data means clear sources, update rules and checks of accuracy.

How the data standards fit together

The reason for the data parts becomes clear when you look at the central ITAM question: are we using what we have paid for, and only that? Figure 4 shows the reconciliation.

Figure 4 – Identification, entitlement and usage data are reconciled to produce a licence position and actions.

Discovery tools scan devices and cloud accounts. Where a publisher ships SWID tags, the tool can read an authoritative product name and version instead of guessing from file names or registry entries, which removes a large source of error. The entitlement records describe what was bought, with which metric. Usage measurements show actual consumption where the metric depends on it. The reconciliation compares the three and produces a position per product: a surplus that can be reharvested or dropped at renewal, a shortfall that must be fixed by buying, removing or renegotiating, and unrecognised items that need investigation. In practice many products still ship without tags, so organisations combine tags with recognition libraries in their tools; the more tagged software they have, the less manual effort the reconciliation needs.

The same identification data supports security. When a vulnerability is announced for a particular product version, an accurate inventory lets the security team find every affected installation in minutes. NIST has published guidance on creating interoperable SWID tags for this reason, and the IETF has standardised a compact binary encoding of the same information model, called CoSWID, for devices with limited resources.

Implementation steps

A first implementation usually follows these steps:

Gain sponsorship by quantifying the problem: spend, audit exposure, security gaps.
Analyse context and set a realistic initial scope, for example the top five software publishers by spend plus laptops and servers.
Write a short ITAM policy, assign roles and set a few measurable objectives.
Build trustworthy data: choose authoritative sources for each data element, run discovery, collect entitlements and proofs of purchase, and agree reconciliation rules.
Define and run the life cycle and functional processes for the scoped assets, with interfaces to procurement, change, service desk and security.
Measure performance, audit internally and hold management reviews; correct problems and widen the scope step by step.

Lesson 5 – Assessment, certification and compliance

What can be assessed

Only Part 1 contains requirements an organisation can be audited against as a management system. The data standards define formats; a tag or entitlement record can be checked against its schema, and tools can claim support for a format, but that is product conformance, not certification of an organisation. The guidance parts (Part 5, Part 8, and the Technical Specifications 10 and 13) do not contain auditable requirements. Part 11 contains requirements for certification bodies, so it is the basis for accrediting those bodies, not for certifying a user organisation.

Three ways to assess an ITAM system

First-party assessment – the organisation checks itself, through internal audits required by clause 9 and through gap analyses against Part 1. This is where every programme should start.
Second-party assessment – a customer, parent company or business partner assesses the organisation against Part 1 or against its own requirements. A managed service provider may be asked by a client to show how it manages the client's licences.
Third-party certification – an independent certification body audits the system and, if it conforms, issues a certificate for a defined scope. To be credible the body should be accredited by a national accreditation body for this standard, and it must meet ISO/IEC 17021-1 plus the ITAM-specific requirements of Part 11.

Accredited certification to Part 1 is possible but much less common than certification to ISO 9001 or ISO/IEC 27001, and its availability varies by country. If you plan to seek it, confirm that the certification body's accreditation scope actually includes ISO/IEC 19770-1 rather than relying on marketing claims. Many organisations use Part 1 as a benchmark without certifying.

The certification audit

Figure 5 – A typical third-party certification path for an IT asset management system under ISO/IEC 17021-1 and Part 11.

The general pattern comes from ISO/IEC 17021-1 and is the same as for other management system standards. A first stage reviews the scope, documentation and readiness; a second stage checks on site or remotely that the system is implemented and effective, by sampling records, interviewing staff and tracing assets through processes. Nonconformities must be corrected before a certificate is issued. Surveillance audits follow during the certificate cycle, and the whole system is re-audited for recertification. In an ITAM audit, auditors typically sample individual assets and ask the organisation to show the record, the entitlement, the owner and the evidence that the life cycle processes were followed.

Licence reviews by publishers are something else

Software publishers often have contractual rights to verify a customer's use of their products, carried out by the publisher or by a firm it appoints. Such a review checks compliance with one publisher's contract terms. It is not an assessment against Part 1 and does not lead to any ISO certificate. A mature ITAM system makes these reviews faster and less risky, because the organisation can produce its own licence position and evidence, but passing a publisher's review does not prove that the ITAM system conforms to the standard, and holding a Part 1 certificate does not remove the publisher's right to check.

The 2012 tiers today

The four tiers of the 2012 edition are still referred to by practitioners as a way to plan improvement in stages, starting with trustworthy data. The 2017 edition rebuilt its requirements as one management system in clauses 4 to 10. Commentaries on the 2017 text report that the tiered idea was not dropped but moved out of the main requirements into an annex, in revised form, as an aid to staged implementation. If you meet a consultant or tool vendor who talks about "tier compliance", ask which edition and which part of the document they mean, and check exactly which requirements and scope a certificate would cover.

Lesson 6 – Worked example

This fictional example ties the lessons together. Harbourline Logistics is a freight company with about 2,400 employees in six countries. It runs a mix of data-centre servers and public cloud, about 3,000 laptops, and several hundred software products. Two events push it to act: a large database publisher announces a licence review, and the security team admits during an incident that it could not list every server running an affected product.

Step 1 – Context and scope

The chief information officer sponsors a programme and asks for a scope that can show results within a year. The team analyses its context: the main issues are three publishers that account for most software spend, frequent cloud migrations that change licence rules, growing pressure from customers on sustainability, and the security inventory gap. Interested parties include the publishers, finance, the security team, the board's audit committee and customers who ask about responsible hardware disposal. They decide whether climate change is relevant, as the amendment requires, and conclude that it is, mainly through the energy use and disposal of hardware. The initial scope is the products of the three largest publishers in all countries, plus all laptops and servers. Cloud subscriptions from other vendors are excluded for now, and the exclusion is recorded with a plan to add them in year two.

Step 2 – Leadership, policy and roles

Top management approves a two-page ITAM policy: every in-scope asset has an owner and a record, nothing is bought without checking existing entitlements, proof of purchase is captured at acquisition, and retired assets are recovered and disposed of responsibly. An ITAM manager is appointed, with one licence specialist for the database publisher, and asset owner duties are written into the job descriptions of department heads.

Step 3 – Planning and objectives

Risks are recorded in the corporate risk register: audit exposure, security blind spots and unused spend. The objectives for year one are measurable: at least 98 % of in-scope devices reporting to discovery within 30 days; a licence position for each of the three publishers refreshed every quarter; and a reduction of at least 10 % in unused licences at renewal. These figures are Harbourline's own choices; the standard does not set targets.

Step 4 – Building trustworthy data

The team chooses an authoritative source for each data element: the HR system for users, procurement for purchases, the discovery tool for installations, and the identity platform for named-user access. Discovery agents are rolled out to all laptops and servers. Where installed products carry SWID tags, the tool reads names and versions directly; for the rest it relies on its recognition library. Contracts and invoices are collected and entered as entitlement records with their metrics. For the database publisher, whose licences are counted by processor core, the team configures usage and configuration measurement on every server running the product and records the results in a consistent structure.

Step 5 – Operation and the first licence position

The first reconciliation shows a surplus of desktop suite licences, because accounts of people who had left were never released, and a shortfall on the database product: two virtual clusters were configured in a way the contract counts as using every physical core in the cluster. Harbourline reharvests the surplus licences, reconfigures one cluster and buys additional licences for the other before the publisher's review starts. During the review it presents its own position with evidence, and the review closes with a small settlement instead of the large figure the publisher had first estimated.

Life cycle processes are defined: a request process that checks the pool of free licences first; a deployment process that links each laptop to a user and each server to an owning service; and a retirement process that recovers licences, cancels subscriptions and sends devices to a certified recycler with a data-wiping certificate. The ITAM tool is linked to change management so that a new server or a cluster change triggers a licence check.

Step 6 – Evaluation and improvement

After six months, an internal auditor samples 40 assets and traces each from purchase to current state. Six records lack proof of purchase, and two retired laptops still hold active licences. Both findings become corrective actions with root-cause analysis: the purchase-capture step was skipped for credit-card purchases, so the policy is changed to route those through procurement. At the management review, the sponsor sees the objectives, the audit results and the cost savings, and approves widening the scope to cloud subscriptions in year two. Harbourline decides to keep using Part 1 as an internal benchmark for another year and to consider accredited certification once its scope covers most spend.

Notice how each element of the family appeared: Part 1 gave the management system, Part 5 the shared vocabulary, the tag and usage standards improved data quality, the entitlement concepts structured the purchase records, TS 19770-10 shaped the process catalogue, and TS 19770-13 informed the sustainability side of retirement.

Lesson 7 – Relationship to other standards and frameworks

ITAM touches many other disciplines, so the family is designed to work alongside other standards rather than replace them. The table compares the most common neighbours.

Standard or framework	What it covers	Relationship to ISO/IEC 19770
ISO 55001 (asset management system)	Requirements for managing physical and other assets of any kind across their life	Part 1 is written as an IT-specific extension of the 2014 edition; conforming to Part 1 does not imply conforming to ISO 55001
ISO/IEC 20000-1 (service management system)	Requirements for planning and delivering IT services	Service management relies on accurate configuration and asset data; ITAM supplies it and shares the same management system structure
ISO/IEC 27001 (information security management)	Requirements for an information security management system with a set of reference controls	Its controls include keeping an inventory of information and associated assets; an ITAM system provides much of the evidence
ITIL 4	A service management framework with defined practices	Includes an IT asset management practice; Part 8 explains how to map such frameworks to the family
NIST Cybersecurity Framework 2.0	Outcomes for managing cybersecurity risk	Its asset management category under the Identify function depends on the same inventories
CIS Critical Security Controls v8.1	Prioritised technical security safeguards	Controls 1 and 2 require inventory and control of enterprise and software assets
FinOps Framework	Practices for managing the cost and value of cloud use	Overlaps with ITAM for cloud subscriptions; many organisations run both in close cooperation
IETF RFC 9393 (CoSWID)	A compact binary encoding of software identification data	Aligned with the information model of Part 2 SWID tags, for constrained devices and supply chain use

Three relationships deserve a closer look. With ISO 55001, the parent relationship explains why Part 1 talks about value, life cycle and asset management objectives, not only about licences. Note that ISO 55001 itself was revised in 2024, while Part 1 still references the 2014 edition; an organisation integrating both should check how the newer edition affects its system. With ISO/IEC 20000-1 and ITIL, the boundary is often debated: configuration management focuses on the components that make up services and how they relate, while asset management focuses on financial, contractual and life cycle aspects. In practice they share tools and data, and it is good design to agree which process owns each data element. With security frameworks, ITAM is a foundation: the first controls in CIS and the Identify function in the NIST framework both assume an accurate inventory, which is exactly what trustworthy ITAM data delivers.

The family also connects to software supply chain work. Software bills of materials (SBOMs) list the components inside a product, while SWID and CoSWID tags identify the product itself; the two are complementary, and some SBOM practices reference tag identifiers.

Common pitfalls and best practices

Common pitfalls

Buying a tool and calling it ITAM. Discovery and licence tools are necessary but produce little value without policy, owners, processes and data rules.
Starting with an unlimited scope. Trying to cover every asset type at once delays results and exhausts sponsorship; a narrow scope with clear exclusions works better.
Treating installation counts as the licence position. Without entitlement data and, for metric-based licences, usage measurement, a count of installations says little about compliance.
Losing proof of purchase. Entitlements that are not captured at acquisition are often impossible to prove later, so the organisation pays twice.
Ignoring retirement. Licences stay assigned to people who have left, subscriptions keep billing, and old devices leave the building with data on them.
Confusing a publisher's licence review with conformance. Passing one review proves compliance with one contract at one moment, not a working management system.
Running ITAM in isolation. Without links to procurement, change, service desk, security and finance, the asset data drifts out of date within months.

Best practices

Start with trustworthy data. Define the authoritative source for each data element and measure data quality before building reports on it.
Choose scope by risk and spend. Begin with the publishers and asset types that carry the greatest cost or audit exposure, record exclusions and widen in stages.
Capture entitlements at the point of purchase. Make proof of purchase and metric details a mandatory step in procurement.
Prefer tagged software and ask suppliers for tags. Include support for identification tags in procurement criteria and in your own software packaging.
Integrate with existing management systems. Reuse document control, internal audit and management review from ISO 9001, ISO/IEC 27001 or ISO/IEC 20000-1 where they exist.
Use the licence position as a regular management report. Refresh it on a schedule and act on surpluses and shortfalls, not only when a review is announced.
Plan the end of life. Build licence recovery, subscription cancellation, data wiping and responsible disposal into the retirement process.

Summary and key takeaways

The ISO/IEC 19770 family is the international set of standards for IT asset management, maintained by ISO/IEC JTC 1/SC 7.
Part 1:2017 (with Amendment 1:2024) is the only part with requirements for an organisation's management system; it extends ISO 55001 for IT and uses the common clause 4–10 structure.
Parts 2, 3, 4 and 6 define data: software identification tags, entitlements, usage measurements and hardware identification tags, so that tools can exchange reliable information.
Part 5 provides the vocabulary, Part 8 explains mapping other practices, TS 19770-10 guides implementation and TS 19770-13 adds sustainability; a new edition of Part 5 is about to be published.
The licence position comes from reconciling what is deployed, what the organisation is entitled to and what is consumed.
A practical implementation starts with sponsorship, a limited scope and trustworthy data, then adds life cycle processes, measurement, audit and improvement.
Accredited certification to Part 1 exists through bodies meeting ISO/IEC 17021-1 and Part 11, but it is less common than for other management system standards; publisher licence reviews are a separate matter.
ITAM data underpins service management, information security and cloud cost management, so the family works best integrated with ISO/IEC 20000-1, ISO/IEC 27001, ITIL, the NIST framework and the CIS Controls.

Reflection questions

Which three IT asset types or publishers would you put in the first scope of an ITAM system in your organisation, and what evidence about spend or risk supports that choice?
For one important software product you use, where would you find the entitlement, the installation data and the usage data today, and which of the three is weakest?
Which existing processes in your organisation (procurement, change, onboarding and leaving, security) would need to send information to ITAM, and who owns each of them?
If a publisher announced a licence review next month, what could you show them, and what would you need to rebuild from scratch?
Would third-party certification to Part 1 add value for your organisation or its customers, or would an internal benchmark be enough? Explain your reasoning.