Achieving ISO/IEC 19770-1:2017 certification marks a significant milestone in a company’s journey toward robust and standardized IT asset management (ITAM) practices. This standard provides a framework that not only supports compliance and risk mitigation but also drives cost optimization, service quality, and transparency. Yet, many organizations struggle with where to start, especially if they are starting from zero: no established ITAM processes, no dedicated tools, and limited in-house expertise.
This guide provides a step-by-step roadmap on how to go from an ad-hoc asset management approach to a mature, audit-ready ITAM ecosystem that meets the stringent requirements of ISO/IEC 19770-1:2017. By following these practices, organizations can reduce complexity and shorten the time to certification.
Introduction to ISO/IEC 19770-1:2017
Understanding the standard
ISO/IEC 19770-1:2017 is the foundational standard for IT asset management, providing a governance framework that outlines requirements for establishing, implementing, maintaining, and continuously improving an ITAM system.[1] Achieving certification demonstrates that an organization meets globally recognized standards for managing IT assets, software licensing, compliance, and auditing.
Why aim for certification?
- Cost Savings & Optimization: Proper ITAM ensures you’re paying only for what you need and use.
- Compliance & Reduced Audit Risk: A certified system reduces exposure to software audit risks and non-compliance penalties.
- Operational Efficiency: Enhanced tracking, reporting, and lifecycle management leads to better decision-making and streamlined processes.
- Market Differentiation: ISO certification establishes credibility and trust among clients, partners, and investors.
Step-by-step roadmap to certification
Step 1: Gain executive buy-in and define objectives
What’s needed:
- Executive Sponsorship: Having C-level support (like the CEO, CIO, or CFO) ensures proper resource allocation and the authority to drive organizational change.
- Clearly Defined Goals: Are you pursuing certification primarily to enhance compliance, reduce risk, optimize costs, or improve governance? Clarify success metrics upfront.
Actionable tip: Create a business case for certification that ties ITAM improvements to strategic objectives. For example, highlight potential cost savings in software licensing or the reputational value of certification for winning enterprise deals.
Step 2: Assemble a cross-functional ITAM team
What’s needed:
- Core ITAM Roles: These may include an ITAM Manager, Licensing Specialist, Procurement Officer, Software Asset Manager, and other IT professionals.
- Involving Multiple Stakeholders: Involve finance, procurement, legal, HR, and business units to ensure holistic policy development and accountability.
Actionable tip: Consider training internal resources or tapping into external consultants or platforms to build competence. Modular solutions can guide your teams in areas such as data normalization, license reconciliation, and audit reporting.
Step 3: Conduct a gap analysis
What’s needed:
- Current State Assessment: Evaluate your existing processes, policies, and tools. Are you using spreadsheets, or do you have partial tooling for software discovery and inventory?
- ISO Requirements Mapping: Match your current practices against ISO/IEC 19770-1:2017 requirements to identify gaps.
Actionable tip: Use a standardized checklist aligned to the standard to identify gaps.
Step 4: Establish ITAM policies and governance
What’s needed:
- ITAM Policy Documentation: Develop policies that specify roles, responsibilities, objectives, and performance indicators.
- Governance Framework: Define escalation paths, approvals, and regular reviews.
Actionable tip: Keep policies lean but robust. Focus on clarity and usability. Your team should be able to reference these policies easily, and they should be integrated into daily workflows.
Step 5: Implement scalable tooling and automation
What’s needed:
- Comprehensive Asset Discovery & Inventory Tools: Ensure continuous, automated discovery of hardware and software assets.
- Lifecycle Management Tools: Implement solutions for license optimization, contract management, and reporting.
Actionable tip: Start small and scale up. Begin with the highest-risk areas, and gradually integrate with existing IT Service Management (ITSM) or Enterprise Resource Planning (ERP) systems. This approach reduces upfront complexity and helps you quickly realize incremental improvements.
Step 6: Define clear metrics and KPIs
What’s needed:
- Performance Indicators Aligned with ISO Requirements: Metrics such as software compliance rate, audit response time, and percentage of unused licenses reclaimed.
- Continuous Improvement Loop: Integrate these KPIs into a PDCA (Plan-Do-Check-Act) cycle to drive ongoing enhancement.
Actionable tip: Make KPIs visible throughout the organization. Regular reports and dashboards can help maintain accountability and motivation, driving the continuous improvement ethos that ISO standards promote.
Step 7: Training and awareness
What’s needed:
- Organization-Wide Education: Make sure everyone understands why ITAM matters and how they contribute.
- Role-Based Training: Tailor training to specific roles. For example, procurement might focus on vendor negotiation best practices, while IT staff learn to use the inventory tools effectively.
Actionable tip: Short video modules or micro-learning sessions keep engagement high. Reinforce learning with quizzes, gamification, and periodic refreshers to maintain a compliance-oriented culture.
Step 8: Documentation and record-keeping
What’s needed:
- Comprehensive Documentation: Maintain evidence of all policies, procedures, asset inventories, and audit trails.
- Version Control & Audit Trails: Ensure all changes are traceable, so you can provide evidence during the ISO assessment.
Actionable tip: Leverage document management systems or integrated ITAM solutions to ensure version control. Automated record-keeping tools can save time and reduce manual errors.
Step 9: Pre-audit assessments
What’s needed:
- Internal Audits & Mock Assessments: Conduct regular internal reviews to gauge readiness.
- Remediation Plans: Address non-conformities quickly and learn from them.
Actionable tip: Engage third-party consultants or use specialized apps to run a pre-audit check. These can simulate external audits and highlight areas that need refinement before the official assessment.
Step 10: Certification audit and beyond
What’s needed:
- Independent Certification Body: Select a reputable ISO certification body familiar with ISO/IEC 19770-1:2017.
- Continual Improvement Post-Certification: Achieving certification is not the end goal; maintaining and improving standards is an ongoing process.
Actionable tip: After certification, schedule periodic management reviews to discuss ITAM performance, recent improvements, and upcoming initiatives. Use these reviews to ensure that continuous improvement stays front-and-center.
Challenges and how to overcome them
| Challenge | How to overcome it |
|---|---|
| Cultural Resistance | Change is always hard. Mitigate resistance by demonstrating the value of ITAM through pilot projects and quick wins. |
| Data Quality Issues | Many organizations struggle with incomplete or inaccurate asset data. Overcome this by investing in automated discovery tools, implementing validation rules, and conducting periodic data cleansing exercises. |
| Complex Licensing Models | Software licensing complexities, especially for vendors like Oracle, IBM, or Microsoft, can be intimidating. Build in-house expertise on the vendor rules that matter most and document how each is counted. |
| Resource Constraints | Smaller teams or limited budgets can slow progress. Phasing the program and prioritizing high-risk vendors can keep the effort resource-efficient. |
Conclusion
Achieving ISO/IEC 19770-1:2017 certification from scratch is a transformative process that delivers long-term strategic value. By taking a structured, step-by-step approach (starting from executive buy-in and gap analysis, moving through policy development and tooling implementation, and ending with continuous improvement), your organization can build a best-in-class ITAM program.
Not only will certification demonstrate your commitment to world-class asset management, but it will also yield tangible benefits like cost savings, reduced audit risk, and improved governance. With the right tools, team, and mindset, you can confidently navigate your organization’s ITAM maturity journey and emerge as an industry leader.