ISO/IEC JTC 1/SC 40 IT Service Management and IT Governance is a standardization subcommittee of the Joint Technical Committee ISO/IEC JTC 1 of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). ISO/IEC JTC 1/SC 40 develops and facilitates the development of international standards, technical reports, and technical specifications within the fields of IT service management and IT governance, with a focus in IT activity such as audit, digital forensics, governance, risk management, outsourcing, service operations and service maintenance. The international secretariat of ISO/IEC JTC 1/SC 40 is Standards Australia (SA), located in Australia.
History ISO/IEC JTC 1/SC 40 was formed at the November 2013, 28th JTC 1 Plenary held in Perros-Guirec, France. The subcommittee was established via Resolution 21 from this meeting, and its scope, secretariat, and possible liaisons determined. The new subcommittee combines the work of ISO/IEC JTC 1/WG 8 Governance of IT, ISO/IEC JTC 1/SC 7/WG 25 IT service management, and ISO/IEC JTC 1/SC 7/WG 27 IT enabled services/BPO (ITES/BPO).
Scope The scope of ISO/IEC JTC 1/SC 40 is:
"Standardization of IT Service Management and IT Governance"
Develop standards, tools, frameworks, best practices and related documents for IT Service Management and IT Governance, including areas of IT activity such as audit, digital forensics, governance, risk management, outsourcing, service operations and service maintenance, but excluding subject matter covered under the scope and existing work programs of JTC 1/SC 27 and JTC 1/SC 38.
The work will initially cover:
Governance of IT, including the development of the ISO/IEC 38500 series standards and related documents. Operational aspects of Governance of IT, including ISO/IEC 30121 Information Technology — Governance of digital forensic risk framework, and interfaces with the management of IT as well as the role of governance in the area of business innovation. All aspects relating to IT service management, including the development of the ISO/IEC 20000 series standards and related documents. All aspects relating to IT-Enabled Services — Business Process Outsourcing, including the development of the ISO/IEC 30105 series standards and related documents.
Structure ISO/IEC JTC 1/SC 40 is made up of three working groups (WGs), three study groups (SGs), and one advisory group (AG), each of which carries out specific tasks in standards development within the field of IT Service Management and IT Governance. The focus of each working group is described in the group’s terms of reference. The working groups, study groups, and advisory group of ISO/IEC JTC 1/SC 40 are: Working Group Title ISO/IEC JTC 1/SC 40/WG 1 Governance of Information Technology ISO/IEC JTC 1/SC 40/WG 2 IT Service Management ISO/IEC JTC 1/SC 40/WG 3 IT Enabled Services - Business Process Outsourcing ISO/IEC JTC 1/SC 40/SG 1 General Study Group on Future Work ISO/IEC JTC 1/SC 40/SG 2 Study Group on Service Maintenance (complete) ISO/IEC JTC 1/SC 40/SG 3 Study Group on the governance and service management of IT and IT-enabled business services provided by multiple service providers ISO/IEC JTC 1/SC 40/CAG 1 Chairman Advisory Group
Collaborations ISO/IEC JTC 1/SC 40 works in close collaboration with a number of other organizations or subcommittees, both internal and external to ISO or IEC, in order to avoid conflicting or duplicative work. Organizations internal to ISO or IEC that collaborate with or are in liaison to ISO/IEC JTC 1/SC 40 include: ISO/IEC JTC 1/SC 7, Software and systems engineering ISO/IEC JTC 1/SC 27, IT security techniques ISO/IEC JTC 1/SC 38, Distributed application platforms and services (DAPS) ISO/TC 171, Document management applications ISO/TC 258, Project, programme and portfolio management ISO/PC 259, Outsourcing
Organizations external to ISO or IEC that collaborate with or are in liaison to ISO/IEC JTC 1/SC 40 include: Institute of Electrical and Electronics Engineers (IEEE) Information Systems Audit and Control Association (ISACA) Organization for the Advancement of Structured Information Standards (OASIS) The IT Service Management Forum International Limited (itSMFI) International Accreditation Forum (IAF)
Member countries Countries pay a fee to ISO to be members of subcommittees.
The 28 "P" (participating) members of ISO/IEC JTC 1/SC 40 are: Australia, Brazil, Canada, China, Côte d'Ivoire, Denmark, Finland, France, Germany, India, Italy, Japan, Republic of Korea, Luxembourg, Netherlands, New Zealand, Peru, Poland, Portugal, Romania, Russian Federation, Rwanda, Singapore, South Africa, Spain, Sweden, United Kingdom, and United States of America
The 10 "O" (observing) members of ISO/IEC JTC 1/SC 40 are: Argentina, Austria, Belgium, Czech Republic, Hong Kong, Islamic Republic of Iran, Ireland, Kenya, Switzerland, and Uruguay.
Standards ISO/IEC JTC 1/SC 40 currently has 11 published standards, as well as various other standards or technical reports under development within the field of IT service-management and IT governance. These include: ISO/IEC Standard Title Status Description ISO/IEC 20000-1 Information technology – Service management – Part 1: Service management system requirements Published (2011) Specifies the requirements for the service provider to plan, establish, implement, operate, monitor, review, maintain, and improve a service management system (SMS) ISO/IEC 20000-2 Information technology – Service management – Part 2: Guidance on the application of service management systems Published (2012) Provides guidance on the application of SMS based on the requirements of ISO/IEC 20000-1 ISO/IEC 20000-3 Information technology – Service management – Part 3: Guidance on scope definition and applicability of ISO/IEC 20000-1 Published (2012) Provides guidance on scope definition, applicability and demonstration of conformity to the requirements in ISO/IEC 20000-1. Guidance on the different types of conformity assessment and assessment standards is included. ISO/IEC TR 20000-4 Information technology – Service management – Part 4: Process reference model Published (2010) The purpose of ISO/IEC TR 20000-4:2010 is to facilitate the development of a process assessment model according to ISO/IEC 15504 process assessment principles. ISO/IEC TR 20000-5 Information technology – Service management – Part 5: Exemplar implementation plan for ISO/IEC 20000-1 Published (2013) Provides guidance on how to implement an SMS to fulfill the requirements of ISO/IEC 20000-1 ISO/IEC 20000-6 Information Technology -- Service Management -- Part 6: Requirements for bodies providing audit and certification of service management systems Under Development Part 6: Requirements for bodies providing audit and certification of service management systems ISO/IEC 20000-8 Information technology -- Service management -- Part 8: Guidance on the application of service management systems for smaller organizations Under Development Part 8: Guidance on the application of service management systems for smaller organizations ISO/IEC TR 20000-9 Information technology – Service management – Part 9: Guidance on the application of ISO/IEC 20000-1 to cloud services Published (2015) Provides guidance on the use of ISO/IEC 20000‑1:2011 for service providers delivering cloud services ISO/IEC TR 20000-10 Information technology – Service management – Part 10: Concepts and terminology Published (2013) Provides an overview of the concepts and terminology of ISO/IEC 20000 and establishes a common framework for helping organizations understand the purpose of the parts of ISO/IEC 20000 and the relationships between the parts ISO/IEC TR 20000-11 Information technology -- Service management -- Part 11: Guidance on the relationship between ISO/IEC 20000-1:2011 and service management frameworks Under Development Part 11: Guidance on the relationship between ISO/IEC 20000-1:2011 and service management frameworks ISO/IEC TR 20000-12 Information technology -- IT Service management -- Part 12: Guidance on the relationship between ISO/IEC 20000-1:2011 and service management frameworks: CMMI-SVC Under Development Part 12: Guidance on the relationship between ISO/IEC 20000-1:2011 and service management frameworks: CMMI-SVC ISO/IEC 30105-1 IT Enabled Services / Business Process Outsourcing Lifecycle Processes ITESBPO Standard Published (2016) Part 1: Process Reference Model (PRM) ISO/IEC 30105-2 IT Enabled Services / Business Process Outsourcing Lifecycle Processes ITESBPO Standard Published (2016) Part 2: Process Assessment Model ISO/IEC 30105-3 IT Enabled Services / Business Process Outsourcing Lifecycle Processes ITESBPO Standard Published (2016) Part 3: Process measurement framework and organization maturity model ISO/IEC 30105-4 IT Enabled Services / Business Process Outsourcing Lifecycle Processes ITESBPO Standard Published (2016) Part 4: Terms and concepts ISO/IEC 30105-5 IT Enabled Services / Business Process Outsourcing Lifecycle Processes ITESBPO Standard Published (2016) Part 5: Guidelines ISO/IEC 30121 System and software engineering – Information technology – Governance of digital forensic risk framework Published (2015) Provides a framework for governing bodies of organizations on the best way to prepare an organization for digital investigations, before they occur ISO/IEC 38500 Information Technology – governance of IT – For the Organization Published (2015) Provides guiding principles for members of governing bodies of organizations on the effective, efficient, and acceptable use of information technology (IT) within their organizations ISO/IEC TS 38501 Information Technology – Corporate Governance of IT Implementation Guide Published (2015) Provides guidance on how to implement arrangements for effective governance of IT within an organization ISO/IEC TR 38502 Information technology – Governance of IT – Framework and model Published (2014) provides guidance on the nature and mechanisms of governance and management together with the relationships between them, in the context of IT within an organization ISO/IEC 38505-1 Information Technology -- Governance of IT -- Part 1: The application of ISO/IEC 38500 to the governance of data Under Development Part 1: The application of ISO/IEC 38500 to the governance of data ISO/IEC TR 38503 Information technology -- governance of IT -- Guidance on the audit of the governance of IT Under Development ISO/IEC TR 38504 Information technology -- The structure of principles-based standards in the governance of IT Under Development
See also ISO/IEC JTC 1 List of ISO standards Standards Australia International Organization for Standardization International Electrotechnical Commission
References
External links ISO/IEC JTC 1/SC 40 page at ISO