IT Asset Management Consultants in Dubai, Abu Dhabi & Saudi Arabia
Nathan ISO Consulting implements and certifies ISO/IEC 19770-1 IT Asset Management Systems for enterprises, government entities, managed service providers and technology-intensive organisations across the UAE, Saudi Arabia and the wider GCC.
Most organisations discover they have an IT asset management problem in one of two ways: a software vendor audit arrives with a licensing shortfall claim, or a security incident traces back to a device or application nobody knew was on the network. Both are expensive, and both stem from the same root cause — no reliable record of what technology the organisation actually owns, runs and is licensed for.
What Is ISO/IEC 19770?
ISO/IEC 19770 is a family of standards for IT asset management. ISO/IEC 19770-1 is the certifiable management system standard specifying requirements for an IT Asset Management System, covering hardware, software, cloud services and the associated licensing and contractual entitlements.
Other parts of the family serve different purposes. Part 2 defines a software identification tag format allowing software to be recognised automatically. Part 3 addresses software entitlement schemas. Part 4 covers resource utilisation measurement. Part 5 provides an overview and vocabulary. You certify against Part 1; the others support automated discovery and entitlement management.
The standard follows the Annex SL high-level structure shared with ISO 9001, ISO 27001 and ISO 20000, so integration is straightforward for organisations already certified.
| Requirement area | What it covers |
|---|---|
| Asset identification and inventory | Complete, maintained record of hardware, software, cloud subscriptions and associated entitlements |
| Lifecycle management | Acquisition, deployment, maintenance, redeployment, retirement and disposal of IT assets |
| Licence and entitlement management | Reconciliation of what is deployed against what is licensed, with evidence of entitlement retained |
| Financial management | Cost visibility, budgeting, and the link between asset decisions and financial outcomes |
| Risk and compliance | Licensing compliance risk, security exposure from unmanaged assets, and contractual obligations |
| Vendor and contract management | Supplier agreements, renewal management and negotiation position supported by accurate data |
| Disposal and data sanitisation | Secure disposal of assets including verified data destruction before equipment leaves the organisation |
| Performance evaluation and improvement | Measurement, internal audit, management review and continual improvement |
Three gaps recur. Software licence reconciliation is the most expensive — deployed instances counted against entitlements held, with the difference either a compliance liability or wasted spend. Cloud subscription sprawl is the fastest growing, since SaaS purchased on departmental cards rarely reaches central IT records at all. And disposal is the most quietly dangerous, because equipment leaving an organisation without verified data sanitisation carries both security and data protection consequences that surface long after the asset has gone.
Why ISO 19770 Certification Matters in the UAE and GCC
Major software vendors conduct licence compliance audits routinely, and a shortfall claim can run into substantial sums with limited negotiating room if your own records cannot substantiate what you are entitled to. Organisations with a certified ITAM system respond from evidence rather than scrambling to reconstruct entitlement history under a deadline.
You cannot secure what you do not know exists. Unmanaged devices, unpatched software and forgotten cloud instances are consistently among the most common root causes in security incidents. ISO 27001 requires an inventory of assets; ISO 19770 provides the discipline that keeps it accurate.
Subscription-based software and cloud services shifted IT spend from capital to operating budgets, and made it far easier for spend to grow without visibility. Organisations implementing ITAM properly commonly find unused licences, duplicated tools and forgotten subscriptions worth a meaningful share of the programme cost in the first year.
Government entities and large enterprises across the UAE and Saudi Arabia face increasing scrutiny of technology expenditure and asset stewardship. Demonstrable asset management supports both audit response and budget justification.
UAE and Saudi data protection law makes secure disposal a compliance obligation rather than good housekeeping. Equipment leaving the organisation with recoverable personal data creates breach exposure that a documented sanitisation process prevents.
Nathan ISO Consulting’s ISO 19770 Services
An honest review of current asset records, discovery capability, licence position and process discipline, distinguishing what exists from what is actually accurate.
Hardware, software, cloud and entitlement inventory structures, with discovery and reconciliation arrangements that keep records current rather than accurate only at the point of implementation.
Reconciliation of deployed software against held entitlements, identifying both compliance exposure and over-licensing. For most organisations this is the single highest-value early output.
Bringing SaaS subscriptions, cloud service commitments and departmental purchases into the asset record, including the shadow procurement that rarely reaches central IT.
Acquisition approval, deployment recording, change and redeployment tracking, and retirement processes that keep the inventory accurate as assets move through the organisation.
Contract repository, renewal calendars, entitlement documentation retention and the negotiation position that accurate deployment data provides at renewal.
Secure disposal processes with verified data destruction, certificates of destruction where appropriate, and the audit trail required under data protection obligations.
We configure around discovery and asset management tooling you already run rather than forcing replacement, and help specify a proportionate solution where asset management currently runs on spreadsheets.
ITAM process owner training, awareness for procurement and technology staff, and internal auditor qualification for your nominated staff.
Full ITAM system audit, properly minuted management review, certification body selection, Stage 1 and Stage 2 attendance, and nonconformity closure.
Our ISO 19770 Certification Process
Consultation and fixed proposal. Discussion of your estate size, current tooling, licensing exposure and objectives, followed by a fixed written quotation.
Maturity assessment. Current asset records, discovery capability and process discipline reviewed with a written findings report.
Scope definition. Which asset categories, business units and locations the system covers.
Baseline inventory build. Hardware, software, cloud and entitlement records established or remediated.
Licence position reconciliation. Deployed against entitled, with exposure and over-licensing identified.
Lifecycle process design. Acquisition through disposal, with recording points that keep the inventory accurate.
Toolset configuration. Discovery and asset management tooling aligned to produce required evidence.
Vendor and contract framework. Repository, renewal management and entitlement documentation retention.
Disposal procedures. Secure disposal and data sanitisation with verification and audit trail.
Training rollout. Process owner and procurement training plus internal auditor qualification.
Internal audit and management review. Full audit cycle with genuine findings, then a properly minuted review.
Stage 1 and Stage 2 audits, then support. Documentation review, implementation audit with our consultant present, and surveillance support.
Why Choose Nathan ISO Consulting
Licence position first. The reconciliation of deployed against entitled is usually where the immediate financial value sits, so we do it early rather than at the end of a documentation programme.
Accuracy over completeness. An inventory covering eighty percent of assets accurately is more useful than one claiming full coverage that nobody trusts. We design a scope you can genuinely maintain.
Cloud and shadow procurement addressed. SaaS bought on departmental cards is where subscription spend hides. We build the discovery to find it rather than assuming central IT records are complete.
Disposal treated as a compliance obligation. Verified data sanitisation, not just equipment collection — which matters under UAE and Saudi data protection law.
Toolset-agnostic. Configured around what you already run, with proportionate recommendations where tooling is genuinely absent.
Integration with ISO 27001 and ISO 20000. Asset inventory serves the ISMS, and configuration data serves service management. We build one dataset rather than three competing ones.
Vendor negotiation support. Accurate deployment data materially changes your position at renewal, and we make sure the data is defensible before the conversation.
One dedicated lead consultant throughout. Continuity from maturity assessment through surveillance audits.
Fixed written pricing. Agreed upfront with audit attendance included.
Independent of certification bodies. Certification is issued independently under ISO/IEC 17021.
Industries We Serve
Government and semi-government entities. Large distributed estates with public expenditure scrutiny and audit obligations.
Banking and financial services. Regulated environments where unmanaged software creates both licensing and security exposure.
Managed service providers. Assets managed on behalf of multiple clients with contractual stewardship obligations.
Healthcare. Clinical and administrative systems, medical device software and patient data on disposable equipment.
Oil, gas and utilities. Large distributed estates spanning corporate IT and operational technology environments.
Education. Campus-wide device fleets, academic software licensing and student-facing systems.
Telecommunications. High-volume infrastructure and software estates with rapid refresh cycles.
Retail and hospitality. Distributed point-of-sale estates and multi-site device management.
Construction and engineering. Specialist design and engineering software with high per-seat cost and complex licensing models.
Locations We Serve
ISO 19770 consultants across Dubai — Business Bay, Deira, Jebel Ali, Dubai Investment Park and Dubai South — plus Dubai Internet City, Dubai Silicon Oasis, Dubai Media City, DMCC, JAFZA, DAFZA and DIFC.
Abu Dhabi city, Mussafah, ICAD, KEZAD, Masdar City, Abu Dhabi Global Market, Hub71 and Al Ain — including government technology functions and ADNOC group organisations.
Sharjah city, Sharjah Publishing City, Hamriyah Free Zone and SAIF Zone; Ajman and Ajman Free Zone; Ras Al Khaimah and RAKEZ; Umm Al Quwain Free Trade Zone; Fujairah and Fujairah Free Zone.
Riyadh, Jeddah, Dammam, Al Khobar, Dhahran, Jubail, Mecca, Medina and Tabuk — including MODON industrial cities, King Abdullah Economic City, NEOM, and government and Aramco-linked technology functions.
Qatar — Doha, Lusail, Qatar Free Zones and the Qatar Financial Centre. Kuwait — Kuwait City, Shuwaikh and Salmiya. Oman — Muscat, Knowledge Oasis, Sohar and Salalah. Bahrain — Manama, Seef and Bahrain Bay.
What Determines the Cost of ISO 19770 Certification?
Certification body audit fees follow mandatory audit-day tables based on headcount, number of sites and estate complexity. Our consultancy fee is separate and fixed in writing before engagement.
Cost is driven by the size and geographic spread of the IT estate, the number of software publishers and licensing models in scope, whether discovery tooling exists or must be implemented, the state of existing entitlement documentation, and whether you are implementing alongside ISO 27001 or ISO 20000. Reconstructing entitlement history where purchase records are incomplete is usually the activity that extends a programme beyond initial expectation.
Get Started with ISO 19770 Certification
For ISO/IEC 19770-1 IT asset management certification in Dubai, Abu Dhabi, Sharjah, Saudi Arabia, Qatar, Kuwait, Oman or Bahrain, call +971 50 258 5024, email info@nathanisoconsulting.com, or visit our contact page for an ITAM maturity assessment and a fixed written proposal.
Frequently Asked Questions About ISO 19770 Certification
ISO/IEC 19770-1 is the certifiable management system standard. Part 2 defines a software identification tag format for automated recognition. Part 3 addresses entitlement schemas. Part 4 covers resource utilisation measurement. Part 5 provides overview and vocabulary. You certify against Part 1.
Software asset management, or SAM, is a component of IT asset management. ISO 19770-1 covers the broader discipline including hardware, cloud services and entitlements alongside software. Many organisations start with the software licensing problem because it carries the most immediate financial exposure, then extend to the full estate.
It does not prevent an audit, and no standard can. What it provides is the ability to respond from maintained records rather than reconstructing entitlement history under deadline pressure. Organisations with accurate reconciliation typically resolve vendor audits faster and on better terms, because their position is evidenced rather than asserted.
ISO 27001 requires an inventory of assets and management of them as a security control. ISO 19770 provides the discipline that keeps that inventory accurate and extends it into lifecycle, licensing and financial management. Organisations holding ISO 27001 usually find the asset inventory requirement is the weakest part of their ISMS, which ISO 19770 addresses directly.
They overlap substantially. Configuration management under ISO 20000 supports service management decisions; asset management under ISO 19770 supports lifecycle, licensing and financial decisions. The underlying data is largely the same, and we build one dataset serving both rather than parallel records that inevitably diverge.
Four to nine months depending on estate size and the state of existing records. Building or remediating the baseline inventory is usually the longest activity, particularly where entitlement documentation is incomplete or discovery tooling is absent.
For any meaningful estate size, practically yes — maintaining an accurate inventory manually across hundreds or thousands of assets is not sustainable, and auditors examine whether records are current rather than merely present. Where tooling is absent we help specify something proportionate rather than over-specified.
This is common and needs addressing honestly. Options include locating records with the vendor or reseller, obtaining entitlement confirmation from the publisher, or where entitlement genuinely cannot be established, treating the deployment as unlicensed and remediating through purchase or removal. Documenting the position is better than leaving an unexamined gap that surfaces during a vendor audit.
Yes, and this is increasingly where the value lies. Subscription services purchased outside central IT are the fastest-growing category of unmanaged spend in most organisations. The standard requires them within the asset scope, which forces the discovery work that surfaces them.
Documented disposal processes including verified data sanitisation before equipment leaves the organisation, retention of destruction evidence where appropriate, and inventory records updated to reflect retirement. Under UAE and Saudi data protection law, disposal without verified sanitisation creates genuine breach exposure.
Yes, scope can be defined by asset category, business unit or location. Many organisations start with software licensing because the financial exposure is most immediate, then extend scope in later cycles. Scope wording should accurately reflect what is covered.
By answering the questions that arise first in an incident — what is this device, who owns it, what software runs on it, when was it last patched, what does it connect to. Organisations without reliable asset records lose critical time in incident response establishing basic facts that should already be documented.
Commonly identified savings include unused licences reclaimed, duplicated tooling consolidated, forgotten subscriptions cancelled, and improved renewal negotiation from accurate deployment data. The scale varies considerably by estate, but for organisations with significant software spend and no prior ITAM discipline, the first-year identification frequently offsets a meaningful share of programme cost.
It spans IT, procurement and finance, which is why ownership matters. Placing it purely in IT operations tends to under-serve the financial and contractual dimensions; placing it purely in procurement under-serves technical accuracy. A defined ITAM function or manager with authority across all three is the arrangement that works most reliably.
It can, where those assets fall within scope. OT environments carry particular complexity — long asset lives, vendor-controlled software, limited discovery tooling compatibility — so scope decisions need care. Where OT is included, we design discovery and recording approaches appropriate to those constraints.
Look for accreditation from a recognised IAF member — EIAC, ENAS, GAC in Saudi Arabia, UKAS or ANAB — with ISO/IEC 19770-1 in the accreditation scope. Because this is a less commonly requested standard, scope availability is narrower, and we confirm it during scoping.
Through the same lifecycle processes, with recording at issue, periodic verification, and defined return procedures on role change or exit. Remote working expanded this population significantly, and unreturned equipment from departed staff is a recurring gap we find in inventory reconciliation.
Considerably. Accurate records of what exists, its age, its support status and its cost provide the basis for refresh planning and budget forecasting. Organisations without this data typically budget reactively, which produces both unexpected costs and equipment retained past the point where support and security become problematic.
Yes. Process owner training, licence management workshops and internal auditor qualification are included in our implementation programmes and available standalone. Licence management capability in particular is worth holding in-house given how frequently vendor licensing models change.
By keeping discovery running and reconciling regularly, recording acquisitions and disposals as they happen rather than retrospectively, maintaining entitlement documentation, reviewing subscription renewals against actual usage, running the internal audit programme, and holding management review on schedule. An inventory accurate at certification and unmaintained afterwards is the most common surveillance finding.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving