ISO/IEC 38500:2024
Good governance of IT – ISO/IEC 38500:2024

ISO/IEC 38500:2024 4.2: Principles, model and framework

Three tools are offered to the governing body and to the governance and management practices around it: the principles (clause 5), the model (clause 6) and the framework (clause 7), with a table setting out for each what it is, how it is used and what it brings. The principles are foundational truths and assumptions that underpin beliefs, behaviour and reasoning; applied in tasks, interactions and framework elements they speed up and align decision-making, above all where no clear rule exists yet (new markets, business rules or technologies), and they lead to a more agile, adaptive, responsible and strategic use of IT in support of the organization's objectives. The model sets out the main governance tasks and how they interact across the organization, which makes decision rights and responsibilities clear for every aspect of IT use. The framework names the building blocks by which the organization's arrangements for governing IT operate, so that the essential governance actions are actually considered and applied to IT use.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 14 controls across 6 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO/IEC 23894:2023 · 7 controls

ISO/IEC TR 24028:2020 · 3 controls

  • 8.1 General: vulnerabilities, threats and challenges
  • 8.3.1 AI specific privacy threats: general
  • 8.4 Bias

Brazil AI Framework · 1 control

  • 4.2 Availability

ISO/IEC 42001:2023 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Good governance of IT – ISO/IEC 38500:2024

Query this from an agent

The graph holds this control, the 14 it maps to, and the evidence behind each claim, over MCP and REST.