International (ISO/IEC)

ISO/IEC 38500:2024

38 controls. 301 other frameworks in our corpus share controls with it. Here is all of it, and how much of it you are already doing.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

38 controls 301 frameworks share controls with it International (ISO/IEC) held in the corpus

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

ISO/IEC 38500:2024 Governance of IT Evidence & Implementation Kit

38 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you runShared controls
ISO/IEC 38500:20248measure it →
SSAE 184measure it →
FedRAMP Rev 53measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)3measure it →
IEEE 70003measure it →
ISO 20400:20173measure it →
ISO 37000:20213measure it →
ISO/IEC 23894:20233measure it →
ISO/IEC 27557:20223measure it →
ISO/IEC 238373measure it →
Japan AI Guidelines3measure it →
NIST Privacy Framework3measure it →

Every control

CodeControlAlso in
38500-3.1Principle 1: Responsibility0
38500-3.10Information Security Governance0
38500-3.11Data Governance0
38500-3.12Third-Party and Supply Chain Governance0
38500-3.13Innovation and Emerging Technology0
38500-3.14Sustainability and ESG of IT0
38500-3.15Resilience and Continuity0
38500-3.16Value and Benefits Realisation0
38500-3.17Stakeholder Engagement and Transparency1
38500-3.18Governance Review and Continuous Improvement0
38500-3.2Principle 2: Strategy0
38500-3.3Principle 3: Acquisition0
38500-3.4Principle 4: Performance0
38500-3.5Principle 5: Conformance0
38500-3.6Principle 6: Human Behaviour0
38500-3.7Evaluate Task0
38500-3.8Direct Task0
38500-3.9Monitor Task0
38500-4.1Governance model overview0
38500-4.2Evaluate0
38500-4.3Direct0
38500-4.4Monitor0
38500-5.10Social responsibility133
38500-5.11Viability and performance over time56
38500-5.12Ethical behaviour1
38500-5.2Value generation1
38500-5.3Strategy0
38500-5.4Oversight0
38500-5.5Accountability0
38500-5.6Stakeholder engagement1
38500-5.7Leadership0
38500-5.8Data and decisions1
38500-5.9Risk governance92
38500-6.1Responsibility principle application169
38500-6.2Acquisition principle application0
38500-6.3Performance principle application0
38500-6.4Conformance principle application0
38500-6.5Human behaviour principle application0

Tell me when ISO/IEC 38500:2024 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for ISO/IEC 38500:2024, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition