ISO IEC TR 38505-2-2018 PDF

Full title and description

Information technology — Governance of IT — Governance of data — Part 2: Implications of ISO/IEC 38505-1 for data management. A technical report providing guidance to governing bodies and executive management on how the principles and constructs in ISO/IEC 38505-1 translate into data-management implications across an organisation.

Abstract

This technical report explains the implications of ISO/IEC 38505-1 for data management, including the data accountability map and associated matrix of considerations. It is intended to enable informed dialogue between governing bodies and senior/executive management so that data use and related activities align with the organisation’s strategic direction; it also highlights the types of information and measurement capabilities a governing body needs to evaluate and direct data strategies and policies.

General information

• Status: Published / confirmed.
• Publication date: June 2018 (Edition 1, 2018-06).
• Publisher: International Organization for Standardization (ISO) and International Electrotechnical Commission (joint ISO/IEC publication).
• ICS / categories: 35.020 — Information technology (IT) in general.
• Edition / version: Edition 1 (Technical Report, 2018).
• Number of pages: 36 pages (official ISO listing). Note: some national/adopted copies and publisher variants show a different page count due to national forewords and formatting.

Scope

This technical report provides guidance to members of governing bodies and their executive managers on the implications of ISO/IEC 38505-1 for data management. It assumes familiarity with ISO/IEC 38500 principles and the constructs presented in ISO/IEC 38505-1 (including the data accountability map and matrix of considerations). The document focuses on identifying the information a governing body needs to evaluate and direct data strategies and on the measurement systems and capabilities that can monitor data performance and data use across an organisation.

Key topics and requirements

• Interpretation of ISO/IEC 38505-1 principles in terms of concrete data-management implications for organisations.
• Data accountability map and the matrix of considerations — roles, responsibilities and decision points affecting data lifecycle actions (collect, store, report, decide, distribute, dispose).
• Types of information and reports governing bodies require to direct and evaluate data strategy and governance.
• Guidance on measurement systems and metrics that can be used to monitor data quality, performance and the value derived from data uses.
• Recommendations for structured dialogue between the board/governing body and senior management to ensure alignment of data use with organisational objectives.

Typical use and users

Primary users are members of governing bodies (boards, owners, executive committees) and senior/executive management who need to translate governance principles into data-management oversight. Secondary users include CIOs, CDOs, data governance teams, risk and compliance officers, auditors, consultants and legal advisors involved in data strategy, accountability and policy. The report is used to inform board-level reporting, to design governance dashboards and to shape data-governance frameworks that align with corporate strategy.

Related standards

Part of the ISO/IEC 38505 series and related to: ISO/IEC 38505-1:2017 (Part 1 — Application of ISO/IEC 38500 to the governance of data), ISO/IEC TS 38505-3:2021 (Part 3 — Guidelines for data classification) and other governance publications such as ISO/IEC 38500 (governance of IT). The series is produced by ISO/IEC JTC 1/SC 40 (IT service management and IT governance).

Keywords

data governance, governance of IT, data management, data accountability, governing body, metrics, data strategy, ISO/IEC 38505, board reporting, executive oversight.

FAQ

Q: What is this standard?

A: ISO/IEC TR 38505-2:2018 is a technical report that explains the implications of ISO/IEC 38505-1 for data management and offers guidance to governing bodies and senior management on how to govern and oversee data-related activities.

Q: What does it cover?

A: It covers how governance principles map to data-management responsibilities, the information and metrics governing bodies need, the data accountability constructs, and considerations for monitoring data performance and alignment with strategy.

Q: Who typically uses it?

A: Boards, senior executives, CIOs/CDOs, data-governance teams, risk/compliance officers, auditors and consultants use it to inform governance frameworks, board reporting and data-policy decisions.

Q: Is it current or superseded?

A: The publication is the 2018 technical report (Edition 1) and is listed as published/confirmed by ISO. Users should check official national-adoption or ISO listings for the latest review status or national reprints.

Q: Is it part of a series?

A: Yes — it is Part 2 of the ISO/IEC 38505 series. Part 1 (ISO/IEC 38505-1:2017) defines application of ISO/IEC 38500 to governance of data, and Part 3 (ISO/IEC TS 38505-3:2021) provides guidelines for data classification.

Q: What are the key keywords?

A: Data governance, governance of IT, accountability, board oversight, data strategy, metrics, data classification, ISO/IEC 38505.