ISO/IEC TR TECHNICAL REPORT 38504 First edition 2016-09-15 Governance of information technology Guidance for principles- based standards in the governance of information technology Gouvernance des technologies de I'information - Lignes directrices pour des normes fondees sur des principes relatives a la gouvernance des technologies de l'information Reference number IS0/IEC TR 38504:2016(E) ISO IEC @IS0/IEC2016 IS0/IEC TR38504:2016(E) COPYRIGHT PROTECTED DOCUMENT @ IS0/IEC 2016, Published in Switzerland All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO's member body in the country of the requester. ISO copyright office Ch. de Blandonnet 8. CP 401 CH-1214 Vernier, Geneva, Switzerland Tel. +41 22 749 01 11 Fax +4122 749 09 47 [email protected] www.iso.org IS0/IEC2016-Allrightsreserved IS0/IECTR38504:2016(E) Contents Page Foreword ..iv Introduction. V 1 Scope. 2 Normative references ..1 3 Terms and definitions ..1 4 Governance standards for information technology .1 4.1 Purpose and focus of governance standards for information technology ..1 4.2 General recommendations for governance standards for information technology .2 5 Principles-based guidance for governance of information technology .2 5.1 Use of principles-based standards. .2 5.2 System of governance. .2 5.3 Set ofprinciples .2 5.4 Relationship between the adoption of principles and business outcomes. .2 6 Information required for each governance principle .4 6.1 Information elements 4 6.2 Name of the principle 4 6.3 The statement of the principle .4 6.4 Rationale for the principle .5 6.5 Relationship with other principles 5 6.6 Implications 5 6.7 Desired outcomes. .5 6.8 Governance behaviours .6 Bibliography 8 Copyight Intemational OrgzISR6Ean- All rights reserved iii