// Standards & Frameworks

The Frameworks
Behind the Work

Twenty-three standards and frameworks that govern IT asset management, and what each one actually covers. Every engagement here is grounded in these rather than in a proprietary methodology invented to sound impressive.

Why this page exists

A great deal of asset management advice rests on frameworks nobody names, or on statistics that do not survive being traced to a source. Everything below is a published standard you can read yourself and hold this practice against. Where a standard has been superseded — as NIST SP 800-88 Revision 1 was in September 2025 — that is noted, because a significant amount of guidance still in circulation cites the withdrawn version.

01

IT Asset Management

The core discipline. These define what an ITAM system must do, and how software identifies and licenses itself.

ISO/IEC 19770-1

IT asset management systems — requirements

The governing standard for an ITAM management system: tiered requirements, governance, and the processes an auditable program has to demonstrate.

ISO/IEC 19770-2

Software identification (SWID) tags

A standardised way for software to declare exactly what it is — version, edition, patch level — so discovery tools stop guessing from filenames.

ISO/IEC 19770-3

Software entitlement schema

The other half of the reconciliation: a structured description of usage rights, limits, and metrics. Part 2 says what is installed; Part 3 says what you are entitled to.

International Association of IT Asset Managers

The certifying body for this profession — CSAM, CITAM, and the ITAK journal.

Practitioner community and research

Independent community producing practitioner research, including joint work on Java licensing migration.

Reference site for the 19770 family

Plain-language explanations of each part of the 19770 series, maintained for practitioners.

02

Service Management & Governance

Where asset data goes to be useful. ITAM feeds these; these give ITAM its operating context.

IT service management framework

Configuration and asset management sit inside service management. If your CMDB and your asset register disagree, this is the framework that says which wins.

Governance of enterprise IT — ISACA

The control framework auditors reach for. Asset management appears as a managed process with defined maturity levels.

ISO/IEC 20000-1

Service management system requirements

The certifiable service management standard. Asset and configuration management are named requirements within it.

03

Security & Risk

Every security framework starts with the same instruction: know what you have. That instruction is an ITAM deliverable.

CIS Critical Security Controls 1 & 2

Inventory of enterprise assets and software

Controls 1 and 2 — before firewalls, before patching, before anything. The most direct statement anywhere that security depends on asset management.

NIST Cybersecurity Framework 2.0

Govern, Identify, Protect, Detect, Respond, Recover

The Identify function is asset management by another name, and the 2.0 addition of Govern moved accountability to the front.

Information security management systems

Annex A opens with asset management controls: inventory, ownership, acceptable use, and return of assets on termination.

Security and privacy controls

The federal control catalogue. The CM family covers configuration and component inventory in considerable detail.

04

Disposal, Sanitization & ITAD

The end of the lifecycle, where a device stops being an asset and becomes a liability with a serial number.

NIST SP 800-88 Rev. 2

Guidelines for media sanitization

The current standard, published September 2025. Revision 1 was withdrawn the same day — much of the ITAD guidance still circulating cites the withdrawn version.

Standard for sanitizing storage

Where NIST Revision 2 now defers the technique-level detail. If your policy needs a specific method for specific media, it lives here.

Responsible recycling certification

Certifies the recycling and reuse process, including downstream accountability. Verify the facility, not just the vendor.

Certified recycler directory

Certification with a stronger environmental and export-control emphasis. Use the directory to confirm a vendor's status independently.

i-SIGMA NAID AAA

Data destruction certification

Certifies the destruction process itself. Different scope from R2v3 or e-Stewards — knowing which is which is the difference between a defensible vendor selection and a hopeful one.

05

Cloud, Financial & AI Governance

The newest layer, and the one where asset management is still establishing its claim.

FinOps Framework

Cloud financial management

The operating model for cloud spend accountability. Its overlap with ITAM is substantial and under-exploited by both disciplines.

NIST AI Risk Management Framework

Govern, Map, Measure, Manage

The reference framework for AI risk. Useful for classifying where each AI tool in your estate currently sits.

AI management systems

The certifiable AI management standard — the AI equivalent of what 27001 does for information security.

FinOps Open Cost and Usage Specification

The FinOps Foundation's open specification for billing data, so cloud, SaaS, and AI invoices can be read in one format. Version 1.4, ratified June 2026, adds invoice reconciliation — the discipline consumption pricing demands.

Regulation (EU) 2024/1689

The first regulation attached to an asset class at birth. Article 50 transparency obligations apply from 2 August 2026; the Article 26 high-risk deployer obligations were deferred to 2 December 2027. Every obligation presupposes an inventory.