Blue Shield · IT Services

ISO/IEC 38500 IT Governance

Make sure technology decisions serve the business. We use ISO/IEC 38500 to help boards and executives direct, evaluate and monitor IT, with clear decision rights and reporting.

What ISO/IEC 38500 Is

ISO/IEC 38500 is the international standard for the governance of IT. It gives boards and executives principles for using IT effectively, efficiently and acceptably, and a simple model: evaluate, direct and monitor.

It is a guidance standard, not a certifiable management system. Organizations use it to clarify who decides what about technology, how IT investments are approved and tracked, and how leadership knows whether IT is delivering.

Who Needs This

  • Boards and executive teams overseeing significant IT spending.
  • Organizations going through digital transformation.
  • IT leaders who need clear decision rights and leadership support.

Our Methodology

Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.

  1. Governance review. Under a signed Non-Disclosure Agreement, we review how IT decisions are made, approved and monitored today.
  2. Principles and decision rights. We set out the IT governance principles and who decides what, aligned to ISO/IEC 38500.
  3. Investment oversight. A practical process for approving, prioritizing and tracking IT investments.
  4. Performance reporting. Measures and reporting that tell leadership whether IT is delivering.
  5. Board briefing. A briefing for the board and executives, in Arabic and English.

What You Receive

  • IT governance review with findings.
  • IT governance principles and decision-rights matrix.
  • IT investment oversight process.
  • Leadership reporting framework.
  • Board briefing, in Arabic and English.

Standards & References

Findings are anchored to recognized frameworks so they are defensible and cross-mappable.

  • ISO/IEC 38500
  • COBIT
  • ISO/IEC 20000-1

Official Sources and References

The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.

Engagement & Investment

Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.

Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.

Frequently Asked Questions

Can we be certified to ISO/IEC 38500?

No. It is a guidance standard for governance. Organizations align with it to improve how IT is directed and overseen.

How is this different from IT management?

Governance is about direction and oversight by leadership; management is about running IT day to day.

Does this cover cybersecurity governance?

It covers IT governance broadly, and we link it to your cybersecurity governance under the NCA controls.

Will the report be available in Arabic?

Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.

Related Services

Often Engaged Alongside

IT Consulting

Technology strategy, architecture review, and roadmaps that connect IT investment to business outcomes.

Learn more

ISO/IEC 20000-1

A certifiable IT service management system, from service levels to change control.

Learn more

ISO/IEC 27001

Implementation and certification readiness for an Information Security Management System recognised by partners and clients worldwide.

Learn more

Request a Proposal for IT Governance

Tell us how IT decisions are made today and we will return a written proposal within five business days. NDA first, always.