openskills.info
← Chief Information Officer career guide

Executive and leadership

Chief Information Officer timeline

How the field of a Chief Information Officer got here: the sourced milestones from every published course of this career, on one axis.

1947 to 2025

296 milestones across 31 courses

  • Core
  • Supporting
  • Specialization

The axis stretches toward recent years, where most milestones fall. Bars count milestones per year; dots are single milestones.

Before 1990

12 milestones

  2. 1981

    FIPS 87 addresses ADP contingency planning

    NIST's history records FIPS 87 as an early guideline for automatic data processing contingency planning. It established continuity planning as a defined concern for computerized operations.

  3. 1981

    NIST publishes FIPS 87

    NIST published Guidelines for ADP Contingency Planning. It established federal guidance for planning recovery of automatic data processing systems.

  5. 1985

    First large-scale software audit lawsuits

    Software publishers began pursuing organizations for unlicensed use, creating the legal and financial pressure that made systematic software asset tracking a board-level concern rather than an IT convenience.

  7. 1987

    Zachman publishes a framework for information systems architecture

    Zachman's framework organized architecture descriptions by perspectives and interrogatives. It established the need for coordinated enterprise views.

  8. 1989

    First ITIL book is published

    The first ITIL book established the published guidance that later editions consolidated and reorganized.

  10. 1989

    First ITIL publications appear

    The first ITIL guidance was published for managing government IT operations. It established a reusable body of service-management guidance that later editions broadened.

  11. 1989 Jul

    Kodak announces major IT service partnerships

    Kodak assigned data-center, telecommunications, and desktop responsibilities to several providers. The arrangement became a prominent example of outsourcing as a strategic operating-model choice.

1990s

15 milestones

  1. 1990 Jul

    Business process reengineering challenges automation-first change

    Michael Hammer argued that organizations should redesign obsolete work rather than use information technology to accelerate it. This established an early distinction between process transformation and technology installation.

  3. 1992 Jan

    Balanced Scorecard introduced in Harvard Business Review

    Kaplan and Norton presented a framework that balanced financial measures with customer, internal-process, and learning perspectives. Executive reporting gained a broader structure than financial results alone.

  4. 1994

    ITIL v1 published by the UK government

    The IT Infrastructure Library introduced a process-oriented view of IT service management. Configuration management and asset management emerged as linked but distinct disciplines, a relationship this course defines and preserves.

  5. 1994 Apr

    WTO Government Procurement Agreement adopted

    The Agreement established international rules for covered government procurement. It made procurement transparency and non-discrimination part of a multilateral framework.

  6. 1995

    Service management code of practice published

    British service-management standards work produced a code of practice. This created a standards path alongside the growing ITIL guidance.

  8. 1995 Feb

    BS 7799-1 published by BSI

    The British Standards Institution published BS 7799-1, a code of practice for information security management. It gave practitioners a shared vocabulary for security controls, which later fed the international standard.

  11. 1996

    ISACA releases the first COBIT edition

    COBIT began as control objectives for IT auditors. Its later editions expanded into a framework for governance and management of enterprise information and technology.

  14. 1999

    BlackBerry Enterprise Server launches

    Research In Motion shipped the first server built specifically to manage a fleet of BlackBerry devices, pushing email and calendar data from Microsoft Exchange and later supporting remote wipe and policy enforcement. It gave enterprises the first practical console for managing mobile devices centrally.

  15. 1999

    Federal Enterprise Architecture Framework is published

    FEAF gave US federal agencies a common construct for architecture descriptions across business, data, applications, and technology.

2000s

59 milestones

  1. 2000

    BS 15000 specification published

    BS 15000 introduced a specification that organizations could use for service-management certification audits. Incident management sat within a defined set of service-management processes.

  2. 2000

    BS 7799-2 published

    The British standard for information security management included asset inventory as a foundational control, establishing the link between knowing what you have and securing it.

  3. 2000

    ITIL v2 organizes Service Delivery and Service Support

    ITIL v2 concentrated the guidance around service delivery and support, making service management the organizing concern.

  5. 2000 Dec

    ISO/IEC 17799:2000 published

    The first international edition of the code of practice, ISO/IEC 17799:2000, made the BS 7799 approach available globally. It established the control-catalog tradition that became Annex A.

  6. 2001

    ISO 15489 first published

    ISO published its first international records-management standard. It established a common framework for policies, responsibilities, systems, and recordkeeping practices that ECM designs can apply to business content.

  7. 2001

    ITIL version 2 completes its service support focus

    ITIL version 2 organized guidance around service delivery and service support. Incident management was treated as an operational practice connected to the service desk and other support processes.

  9. 2001 Feb

    Agile Manifesto agreed at Snowbird

    Seventeen practitioners published values favoring individuals, working software, customer collaboration, and response to change. These values challenged heavyweight, plan-driven delivery models.

  11. 2002

    NIST SP 800-34 is published

    NIST published its Contingency Planning Guide for Information Technology Systems. The guide brought business impact analysis, contingency strategies, plan development, testing, and maintenance into one IT planning process.

  14. 2002 Feb

    SyncML Device Management 1.1 objects are specified

    SyncML defined standard management objects and a device-management tree so servers and devices could exchange management data through shared structures.

  15. 2002 Jun

    NIST SP 800-34 addresses IT contingency planning

    NIST published the Contingency Planning Guide for Information Technology Systems. The guide covered a contingency-planning process and technical considerations for IT systems.

  16. 2003

    AirWatch is founded

    AirWatch was founded as a dedicated mobile device management vendor years before the smartphone boom that would make MDM a mainstream enterprise purchase. It became one of the specialist vendors that defined the category before later consolidation.

  17. 2003

    Exchange ActiveSync direct push and mailbox policies ship

    Exchange Server 2003 Service Pack 2 added Direct Push, letting a device hold an open connection and sync the moment new mail arrived, along with global mobile device policies such as required PINs and remote wipe. This extended centralized mobile management to any ActiveSync-capable phone, not only BlackBerry devices.

  22. 2003 Dec

    OMA publishes SyncML Device Management 1.1.2

    The Open Mobile Alliance published a formal device-management protocol release, continuing the interoperable SyncML control model used by later management implementations.

  23. 2004 Mar

    EU public procurement directive adopted

    Directive 2004/18/EC consolidated rules for public works, supply, and service contracts. It gave European public buyers a common procedural baseline.

  25. 2005

    ISO/IEC 27001 first edition published

    ISO published the first ISO/IEC 27001 edition, establishing an information security management system standard. It made risk-based management and continual improvement a formal management-system path for information security.

  26. 2005

    ISO/IEC 27001 published

    The international information security standard carried forward asset inventory requirements. Annex A control A.8.1 made asset identification and ownership a mandatory security practice, giving ITAM a regulatory hook beyond cost control.

  27. 2005

    NIST SP 800-53 introduces a federal control catalog

    NIST published the first SP 800-53 control catalog. It placed contingency planning among the recommended security outcomes that organizations could tailor to system risk.

  28. 2005 Jun

    ISO/IEC 17799:2005 revised

    A revised edition updated the code of practice, tightening the control set and its presentation. It remained the reference for implementing information security management controls.

  29. 2005 Oct

    ISO/IEC 27001 receives its first edition

    ISO/IEC 27001:2005 became the requirements standard for a certifiable information security management system, paired with the 17799 code of practice for control implementation.

  30. 2005 Dec

    ISO IEC 20000 launches

    BS 15000 was superseded when the first two parts of ISO IEC 20000 were published. Service incident management gained an international management-system context.

  33. 2006

    Information Dashboard Design published

    Stephen Few's book formalized dashboard design around rapid monitoring and effective visual communication. It gave practitioners a focused reference for reducing clutter and strengthening comparisons.

  34. 2006

    ISO 23081 metadata principles published

    ISO 23081-1 set out principles for records-management metadata. It made metadata a formal concern for creating, managing, and using records rather than a repository convenience.

  35. 2006

    NIST SP 800-100 published

    NIST published Information Security Handbook: A Guide for Managers. It connected information-security program governance with management roles, controls, and performance measures.

  36. 2006

    NIST SP 800-84 formalizes IT plan testing

    NIST SP 800-84 provided guidance on testing, training, and exercising IT plans and capabilities. It distinguished preparation activities from evidence that a plan can operate.

  39. 2006 May

    First ISO software asset management process standard

    ISO/IEC 19770-1 established a standards-based process framework for software asset management. License controls gained a defined organizational process context beyond isolated inventory reports.

  40. 2006 May

    ISO/IEC 19770-1 first edition published

    The first international standard for software asset management processes established a common vocabulary and framework, giving organizations a way to prove SAM maturity to auditors and corporate governance.

  41. 2006 Aug

    Amazon EC2 enters public beta

    Amazon announced on-demand compute capacity through a web service. Infrastructure could increasingly be provisioned as a variable service rather than only through owned data-center investment.

  42. 2006 Aug 24

    Amazon EC2 beta announced

    Amazon introduced resizable compute capacity as a web service. It made obtaining and configuring compute capacity a cloud service concern rather than a data-center procurement task.

  43. 2007

    ITIL v3 introduces the Service Lifecycle

    ITIL v3 reorganized the framework around a service lifecycle rather than the v2 delivery and support structure.

  44. 2007

    ITIL version 3 adopts service lifecycle guidance

    ITIL version 3 reorganized the framework around the service lifecycle. Incident work was placed within service operation while remaining connected to design, transition, and improvement.

  45. 2007

    ITIL version 3 published

    ITIL version 3 reorganized the guidance around a service lifecycle. Strategy, design, transition, operation, and continual improvement became the main organizing structure.

  46. 2007

    NIST SP 800-100 final update

    NIST issued the final update to SP 800-100. Its handbook framing kept governance and management distinct from operational security work.

  47. 2007 Jan

    Apple introduces the iPhone

    Apple combined a phone, internet communications, and a touch interface in one device. Mobile access raised expectations for integrated digital products and services across channels.

  48. 2007 Aug

    The 17799 series is renumbered into the 27000 family

    ISO/IEC 17799:2005 and its Corrigendum changed the reference number to ISO/IEC 27002:2005, aligning the code of practice's numbering with the 27000 family that 27001 had started.

  49. 2008 Apr

    Google App Engine launched to early developers

    Google made a managed application platform available to early developers. Migration choices could now include moving an application to a managed runtime rather than only moving virtual machines.

  50. 2008 Nov

    NIST publishes SP 800-124

    NIST issued enterprise guidance for centrally managing and securing mobile devices, making lifecycle and security controls part of documented fleet practice.

  51. 2008 Dec 11

    WCAG 2.0 becomes a W3C Recommendation

    WCAG 2.0 established durable web accessibility requirements that also apply to browser-delivered reports, controls, charts, and status cues.

  52. 2009

    PagerDuty launches an on-call alerting service

    PagerDuty launched with monitoring integrations, rotations, alert states, and escalation levels. The product marked the growing automation of urgent responder notification for digital services.

  53. 2009

    TOGAF 9 introduces the Content Metamodel

    TOGAF 9 added a formal Content Metamodel linking ADM artifacts, an architecture repository, and the Enterprise Continuum, moving the framework from guidance toward a structured method.

  56. 2009 Oct

    First Devopsdays held in Ghent

    The first Devopsdays brought development and operations concerns into one practitioner forum. It marked the spread of an operating approach centered on collaboration and delivery flow.

  57. 2009 Nov

    ISO/IEC 19770-2 introduced SWID tags

    The first SWID standard defined machine-readable tags for identifying software. Identification became a standardized input to inventory rather than a vendor-specific name-matching problem alone.

  58. 2009 Nov

    ISO/IEC 19770-2 software identification tags

    Defined SWID tags, a machine-readable XML schema that lets discovery tools identify software precisely by publisher, product, edition, and version, replacing fragile file-name-based detection.

  59. 2009 Nov

    SWID tags standardized software identification

    ISO/IEC 19770-2 defined machine-readable software identification tags. It standardized an inventory input while explicitly leaving entitlement reconciliation to other processes.

2010s

135 milestones

  1. 2010

    CMIS 1.0 became an OASIS standard

    Content Management Interoperability Services version 1.0 was approved as an OASIS standard. It defined a common interface for generic content-management capabilities across repositories.

  2. 2010

    ISO 16175 parts 1–3 published

    ISO published the first ISO 16175 suite for digital records. It supplied guidance on functional requirements for systems that create and manage digital records.

  3. 2010

    NIST updates SP 800-34 as Revision 1

    Revision 1 updated the federal contingency planning guide and described its relationship to related security and emergency management plans. It retained a system-focused process for determining requirements and priorities.

  4. 2010 Feb 1

    Windows Azure reached general availability

    Microsoft announced production availability of Windows Azure and SQL Azure in 21 countries. Public cloud became a production destination for application and database workloads across another major platform.

  5. 2010 Apr

    Apple previews native MDM in iPhone OS 4

    Apple announced a service that third-party servers could use to configure, query, lock, and wipe managed iPhones wirelessly.

  6. 2010 Jun

    AWS publishes backup and disaster-recovery guidance

    AWS described backup and disaster-recovery use cases for cloud storage and service providers. Cloud storage changed how teams could obtain off-site recovery capacity.

  7. 2010 Nov

    NIST SP 800-34 Revision 1 updates the guide

    Revision 1 updated the contingency-planning guide with practical guidance on plan development, requirements, priorities, resilience, and the system development life cycle.

  8. 2010 Nov 4

    Commission outlines a comprehensive reform

    The Commission presented its comprehensive approach to personal-data protection, beginning the policy path toward a new regulation.

  9. 2011

    Industrie 4.0 enters public discussion

    The German initiative connected digital networks, cyber-physical systems, and production. Digital transformation leadership expanded beyond online channels into operating technology and industrial processes.

  10. 2011

    ITIL 2011 edition updates the lifecycle guidance

    The 2011 edition revised the version 3 publications while retaining their lifecycle structure. Practitioners received updated guidance without a new framework generation.

  11. 2011

    ITIL 2011 strengthens business alignment

    The 2011 revision clarified the v3 guidance and emphasized alignment between services and business needs.

  12. 2011

    ITIL 2011 update emphasizes business alignment

    The 2011 ITIL update refined the version 3 lifecycle guidance and its alignment with business needs. Incident restoration continued to operate within connected service-management practices.

  16. 2011 Mar

    Government ICT Strategy published

    The strategy set a central direction for government ICT and its implementation over the following two years. It made technology purchasing and reuse a cross-government management concern.

  17. 2011 Apr

    ISO IEC 20000 second edition published

    The second edition updated service-management-system requirements for planning, operation, monitoring, review, maintenance, and improvement. Incident work remained governed as part of an integrated management system.

  18. 2011 Apr

    ISO/IEC 20000-1 second edition published

    ISO published the second edition and withdrew the 2005 edition. The international SMS requirements continued as a revision-managed standard distinct from ITIL guidance.

  19. 2011 Jun 28

    Office 365 becomes globally available

    Microsoft launched Office 365 as a subscription cloud service combining Office with Exchange Online, SharePoint Online, and Lync Online. Administration shifted toward a continuously operated tenant and online services.

  20. 2011 Oct

    UK Government publishes its cloud strategy

    The strategy treated on-demand cloud resources as a route to a more flexible and cost-effective public-sector technology estate.

  21. 2011 Nov

    RIM launches BlackBerry Mobile Fusion

    RIM introduced Mobile Fusion, its entry into the multi-platform MDM market, extending management beyond BlackBerry devices to Android and iOS smartphones and tablets from one console. This marked BlackBerry's own admission that single-platform management was no longer enough.

  22. 2012

    COBIT 5 broadens enterprise governance

    COBIT 5 consolidated governance guidance and linked enterprise and IT strategy through a comprehensive set of practices, tools, and models.

  23. 2012

    ISO 22301:2012 is published

    ISO 22301:2012 became the earlier published edition identified in ISO's lifecycle for the business continuity management-system standard. It framed continuity as an organization-wide management system.

  24. 2012

    ISO/IEC 19770-1 second edition introduces tiers

    Rewrote the standard as a cumulative four-tier model — Trustworthy Data, Practical Management, Operational Integration, Full Conformance — making incremental adoption and independent certification possible for the first time.

  27. 2012 Feb

    First G-Cloud supplier framework went live

    The framework introduced an online route for public-sector organizations to buy commodity IT services. Shorter, catalog-based cloud purchases changed the supplier arrangements contract managers had to operate.

  28. 2012 Feb

    G-Cloud framework opens to UK public buyers

    G-Cloud created a route for public bodies to buy cloud services. It shifted attention toward reusable frameworks and digital service marketplaces.

  29. 2012 Jun

    ISO/IEC 19770-1 added tiered conformance

    The second edition organized an integrated SAM process baseline into tiers. Organizations could implement and assess capability incrementally across software types and platforms.

  30. 2012 Jun

    SAM processes organized into implementation tiers

    The second edition of ISO/IEC 19770-1 divided the integrated SAM baseline into tiers. Organizations could assess and implement license-management capability incrementally across platforms.

  31. 2012 Jun 28

    Google Compute Engine launched

    Google announced general-purpose virtual machines alongside its managed application platform. A migration could preserve a VM-oriented operating model when a managed runtime was not suitable.

  32. 2012 Aug 21

    AWS introduces cost allocation reports

    AWS made it possible to organize and track charges with resource tags used as business dimensions. Tag-based attribution became a practical cloud-billing pattern.

  33. 2013

    CMIS 1.1 added browser binding support

    OASIS approved CMIS 1.1, including a browser JSON binding. The standard continued to position interoperability as a layer over existing content-management systems rather than a replacement for their full capabilities.

  34. 2013 Jan

    Citrix completes its acquisition of Zenprise

    Citrix closed its purchase of Zenprise, a standalone mobile device management vendor, and folded it into its XenMobile product line. It was one of the first large platform vendors to acquire its way into the MDM market rather than build the capability from scratch.

  35. 2013 Feb

    Executive Order 13636 directs a cybersecurity framework

    The order directed development of a voluntary, risk-based framework for critical infrastructure cybersecurity. It created the policy origin for the NIST Cybersecurity Framework.

  36. 2013 Feb

    NIST requests input for a cybersecurity framework

    NIST published a request for information after Executive Order 13636. Public input and workshops began the Framework development process.

  37. 2013 Feb 27

    A new Office 365 service generation launches

    Microsoft released an updated Office 365 service alongside the new Office. The cloud subscription model became the continuing delivery path rather than a fixed server release cycle.

  38. 2013 May

    UK Government adopts Cloud First

    Central-government technology decisions gained a default preference for public cloud, with departures requiring evidence and a value-for-money case.

  39. 2013 Jun

    NIST SP 800-124 Revision 1 includes BYOD

    The revision explicitly covered both organization-provided and personally owned devices, reflecting ownership boundaries in centralized management.

  40. 2013 Jul

    Preliminary Cybersecurity Framework released

    NIST released a preliminary Framework based on the request for information and public workshops. It gave stakeholders a concrete draft to discuss before the first release.

  41. 2013 Jul 8

    Microsoft details Power BI for Office 365

    Microsoft described browser and mobile access to reports built from Excel-based modeling and visualization components. Cloud distribution became part of the mainstream BI design path.

  42. 2013 Oct

    ISO/IEC 27001:2013 second edition

    The 2013 edition reorganized the ISMS requirements around the common management-system structure and strengthened the risk-based approach, making the standard easier to align with other management systems.

  43. 2013 Oct

    ISO/IEC 27002:2013 second edition

    The companion controls standard was revised alongside 27001, keeping 114 controls as the reference for implementing information security management controls.

  44. 2013 Nov

    ISO/IEC 19770-5 defined family vocabulary

    The first overview and vocabulary edition introduced SAM foundation principles and common terms for the standards family.

  45. 2014 Jan

    VMware acquires AirWatch for $1.54 billion

    VMware bought AirWatch, then the largest independent MDM vendor with more than 10,000 customers, to build its end-user computing portfolio. The deal set the template other infrastructure vendors would follow: buy a specialist rather than build one.

  46. 2014 Feb

    CSF 1.0 released

    NIST released Framework Version 1.0 for improving critical-infrastructure cybersecurity. Organizations, regulators, and customers could use its structure to guide and assess programs.

  47. 2014 Feb

    NIST releases Cybersecurity Framework 1.0

    NIST released CSF 1.0 with the Core, Tiers, Profiles, and five original Functions. These constructs gave organizations a common way to communicate cybersecurity outcomes and risk-management posture.

  48. 2014 Mar

    Directive 2014/24/EU adopted

    The directive replaced the 2004 EU public-procurement directive. It updated the legal framework for public purchasing and procurement procedures.

  49. 2014 Apr

    Revised WTO procurement agreement enters into force

    The revised Agreement entered into force for the parties that accepted it. It updated the international procurement framework and expanded its coverage.

  50. 2014 Apr 8

    AWS launches Cost Explorer

    AWS introduced interactive historical-spend analysis in its billing console. Cost analysis became a provider console workflow rather than a manually assembled report.

  51. 2014 Jul

    OECD adopts its Digital Government Strategies recommendation

    The recommendation framed digital government as strategic use of technology and data to create public value. It emphasized whole-of-government coordination rather than transferring analog processes to online channels.

  53. 2014 Oct

    Android 5.0 adds work profiles and device owner

    Android 5.0 introduced managed work profiles for personal devices and device-owner control for organization-owned devices.

  54. 2014 Nov

    ISO 37500 is published

    The international standard supplied a cross-sector outsourcing life cycle and governance framework covering strategy, selection, transition, value delivery, and exit.

  55. 2014 Dec

    Cybersecurity Enhancement Act reinforces NIST's role

    The Act directed NIST to facilitate and support voluntary, consensus-based approaches to reducing cyber risk. It gave the Framework work an ongoing statutory basis.

  56. 2015

    Government Commercial Function formed

    The Government Commercial Function brought commercial roles into a cross-government function. It established a central capability for commercial standards and improvement.

  57. 2015 Feb

    ESFA records digital procurement lessons

    A UK government digital team documented a move away from a single large IT contract toward component suppliers, market engagement, and supplier trials. It made procurement design part of delivery transformation.

  58. 2015 Jun 22

    Amazon Glacier adds tags for cost allocation

    AWS extended tag-based cost breakdowns to Glacier vaults. Allocation coverage increasingly depended on which services exposed usable metadata.

  59. 2015 Jun 29

    AWS launches budgets and forecasts

    AWS added cost budgets, forecasts, and notifications for actual or forecasted budget thresholds. Practitioners could compare expected cost with a defined limit in the same service.

  60. 2015 Jul

    Windows 10 unifies MDM across device classes

    Windows 10 extended OMA device-management capabilities across PCs, laptops, tablets, and phones, with corporate and personal enrollment scenarios.

  61. 2015 Jul 24

    The new Power BI service reaches general availability

    Microsoft released the redesigned service and Power BI Desktop for general use. Reports, dashboards, semantic models, and custom visuals formed a broadly available reporting stack.

  62. 2015 Aug

    ISO/IEC 19770-5 expanded from SAM to ITAM

    The second overview edition placed software asset management within the wider IT asset management family and refreshed its shared vocabulary.

  63. 2015 Aug

    ITAM and SAM vocabulary consolidated

    ISO/IEC 19770-5 supplied an overview, foundation principles, and consistent vocabulary for the standards family. License-management records could use shared definitions across processes and tools.

  64. 2015 Sep

    New Office 365 admin center enters preview

    Microsoft began previewing a redesigned admin center focused on common tasks, search, and reporting. The preview established the interface that later replaced the older administration experience.

  65. 2015 Oct

    ISO/IEC 19770-2 revised SWID tags

    The second SWID edition refined the software identification structure and clarified producer, platform, tool, and consumer roles.

  66. 2015 Oct

    ISO/IEC 19770-5 overview and vocabulary

    Published a freely available overview of the 19770 family, expanding visibility beyond SAM practitioners and establishing ITAM as the umbrella discipline covering hardware, software, and services.

  67. 2015 Oct

    SWID roles and exchange refined

    The second edition of ISO/IEC 19770-2 clarified tag producers and consumers and refined software identification for management tools. It retained the boundary between identification and reconciliation.

  68. 2015 Nov 24

    ISO approves a knowledge management systems project

    ISO approved the project that became ISO 30401. Knowledge management entered a formal international management-system development path.

  69. 2015 Dec

    NIST asks for views on Framework use

    NIST requested information on organizations' experience with the Framework. The feedback informed the update process after Version 1.0.

  70. 2016

    Google publishes the SRE book

    Google published its engineering approach to operating reliable services across the full software lifecycle. The book made service levels, error budgets, toil, automation, and production ownership available as an operating vocabulary.

  71. 2016

    Guiding principles enter ITIL guidance

    Guiding principles provided broadly applicable recommendations for decisions beyond a single process or lifecycle stage.

  72. 2016

    ITIL guiding principles enter the framework's evolution

    PeopleCert's official history identifies the guiding principles as a 2016 milestone. The principles prepared the shift from a fixed process view toward adaptable practice guidance.

  73. 2016 Jan

    World Bank publishes Digital Dividends

    The report found that technology adoption did not automatically produce broad benefits. Skills, accountable institutions, regulation, and access were identified as necessary complements.

  74. 2016 Feb

    VMware introduces the Workspace ONE brand

    VMware merged AirWatch, Identity Manager, and Horizon into a single platform branded Workspace ONE, combining enrollment and policy management with identity and access in one product line. It set the pattern later UEM platforms followed of pairing device management with an identity layer.

  75. 2016 Mar

    Google publishes Site Reliability Engineering

    Google's SRE book documented incident command, operations, planning, communications, handoffs, and shared state for large production incidents. These patterns made role separation explicit for digital-service response.

  76. 2016 Mar 15

    AWS Database Migration Service became generally available

    AWS made its database migration service available to all customers. Replication and schema conversion became dedicated capabilities in migration planning rather than entirely custom work.

  77. 2016 Apr

    Entitlement schema standardized

    ISO/IEC 19770-3 introduced common entitlement terms, associated metrics, and a transport format. It also kept original license documentation authoritative for legal interpretation.

  79. 2016 Apr

    ISO 15489-1 second edition published

    ISO released the revised records-management concepts and principles standard. The revision addressed records across changing digital and collaborative environments while retaining technology-neutral guidance.

  80. 2016 Apr

    ISO/IEC 19770-3 entitlement tags

    Defined machine-readable representations of licensing terms, rights, and limitations, bridging the gap between installed software and purchased entitlements at an industry standard level.

  81. 2016 Apr

    ISO/IEC 19770-3 standardized entitlement records

    The entitlement schema introduced common terms and a transport format for usage rights and their metrics. It kept original license documentation authoritative for legal interpretation.

  82. 2016 Apr

    NIST published interoperable SWID guidance

    NISTIR 8060 placed SWID tags in an operational software lifecycle and documented creation guidance and inventory and security use cases.

  88. 2016 Sep 7

    ISO committee draft registered

    ISO registered and opened consultation on the committee draft for the knowledge management systems standard. The project moved from approval into documented committee work.

  89. 2016 Sep 27

    New Office 365 admin center reaches general availability

    Microsoft took the redesigned admin center out of preview and introduced a Service health dashboard. Administrators gained a common operational view for tenant work and cloud incidents.

  90. 2016 Oct 21

    AWS adds budget API and programmatic notifications

    AWS announced a Budget API and notification delivery through email or Amazon SNS. Budget thresholds could begin a manual, semi-automated, or automated response process.

  91. 2017 Jan

    First CSF 1.1 draft released

    The first draft update added supply-chain-risk detail, clarified terms, and introduced cybersecurity measurement discussion. It made the revision process visible for public comment.

  92. 2017 Jul 10

    Microsoft 365 is introduced

    Microsoft introduced Microsoft 365 offerings that combined Office 365 with Windows and Enterprise Mobility and Security. Administration expanded from collaboration services toward identity, devices, applications, and security as one commercial suite.

  93. 2017 Aug 14

    AWS Migration Hub announced

    AWS introduced a central view for tracking migrations across AWS and partner tools. Portfolio-level progress and issue visibility became a separate migration-management concern.

  94. 2017 Aug 17

    AWS redesigns Cost Explorer

    The redesigned Cost Explorer added more flexible filtering, saved reports, and forward forecasting over user-defined intervals. Cost views could better match a chosen reporting scope.

  95. 2017 Sep

    ISO/IEC 19770-4 standardized utilization measurements

    The new structure represented resource-utilization measurements for IT asset management. It supplied evidence for metrics that require more than installation presence.

  96. 2017 Sep

    MIT CISR publishes four transformation pathways

    Survey research organized digital business transformation around customer experience and operational efficiency. Leaders gained a pathway model that made sequencing and operating-model disruption explicit.

  97. 2017 Sep

    Resource-utilization measurements structured

    ISO/IEC 19770-4 defined an information structure for resource-utilization measurements. License positions could draw on standardized metric evidence beyond installation presence.

  98. 2017 Sep 21

    Draft International Standard registered

    ISO registered the draft as a Draft International Standard. The proposed requirements moved into the international enquiry stage.

  99. 2017 Sep 25

    Azure Migrate announced

    Microsoft introduced discovery, assessment, dependency mapping, rightsizing, and compatibility reporting for Azure migrations. Discovery evidence became more directly connected to target planning.

  100. 2017 Oct

    ISO 23081-1 metadata principles updated

    ISO published an updated metadata-principles edition aligned with ISO 15489:2016. The update reflected experience managing records metadata in digital environments.

  101. 2017 Nov

    UK publishes major IT contract exit guidance

    Exit from large technology contracts became an explicit program of operational preparation rather than a termination clause left for the contract end.

  103. 2017 Dec

    ISO/IEC 19770-1 third edition rewrites to MSS format

    Major rewrite aligned ITAM with ISO management system standards like ISO 9001 and 27001. Renamed from SAM to IT asset management, explicitly covering hardware, software, subscriptions, and cloud services within one governance framework.

  104. 2017 Dec

    Second CSF 1.1 draft released

    NIST published a second proposed update to clarify and refine the Framework. It incorporated another round of public review before the final release.

  105. 2018

    CIS Controls v7 establishes asset inventory as Control 1

    The Center for Internet Security placed inventory and control of enterprise assets at the top of its prioritized defense list, cementing asset visibility as the prerequisite for every other security control.

  108. 2018 Jan

    Carillion enters liquidation

    The failure exposed dependencies that extend beyond individual contracts and reinforced the need to monitor supplier health and plan continuity.

  109. 2018 Feb

    ISO/IEC 27000:2018 updates family terms

    The overview-and-vocabulary standard was updated, clarifying the terms and concepts the 27000 family uses. It supplies the shared definitions the family depends on.

  110. 2018 Mar 2

    Microsoft 365 admin center begins rolling out

    Microsoft announced a new admin experience at admin.microsoft.com for Microsoft 365 enterprise customers. The stated control scope joined users, devices, applications, and services.

  111. 2018 Apr

    CSF 1.1 released

    Version 1.1 added self-assessment material, expanded supply-chain-risk guidance, and clarified the relationship between Profiles and Tiers. The update remained compatible with Version 1.0.

  112. 2018 Apr

    NIST releases Cybersecurity Framework 1.1

    CSF 1.1 added emphasis on self-assessment and cybersecurity supply chain risk management. Governance programs gained a clearer reason to connect supplier dependencies to risk oversight.

  113. 2018 Apr 27

    Common admin center expands to Office 365 customers

    Microsoft extended the same Microsoft 365 admin center to Office 365 users. The common entry point reduced portal switching while preserving workload-specific capabilities.

  114. 2018 May 17

    Draft approved for final standard preparation

    ISO recorded approval to register the draft as a Final Draft International Standard. The requirements advanced toward formal publication.

  117. 2018 Jun 5

    WCAG 2.1 becomes a W3C Recommendation

    WCAG 2.1 added guidance addressing more mobile, low-vision, and cognitive accessibility needs. Dashboard testing expanded beyond a desktop mouse-and-screen workflow.

  118. 2018 Jul

    Gartner launches the first UEM Magic Quadrant

    Gartner retired its separate Magic Quadrants for Client Management Tools and Enterprise Mobility Management and published its first Magic Quadrant for Unified Endpoint Management, evaluating 14 vendors. The change formalized "UEM" as the market's term for managing mobile and desktop devices from one console.

  120. 2018 Sep 24

    Azure migration services expanded

    Microsoft described Azure Migrate, Azure Database Migration Service, and Azure Data Box as migration capabilities. Different workload components could use specialized discovery, data, and transport services.

  121. 2018 Oct 23

    EU data-protection rules for institutions adopted

    Parliament and Council adopted the EUDPR, extending the reformed framework to EU institutions, bodies, offices, and agencies.

  122. 2018 Oct 31

    ISO 30401 published

    ISO published the first edition of its knowledge management systems requirements. Organizations gained an international reference for establishing, maintaining, reviewing, and improving a knowledge management system.

  123. 2018 Nov

    ISACA launches COBIT 2019

    COBIT 2019 added design factors and guidance for tailoring a governance system to enterprise context rather than applying one uniform configuration.

  127. 2019 Feb

    ITIL 4 Foundation launches

    ITIL 4 introduced a service value system and a more holistic, value-oriented approach that integrated governance, practices, and continual improvement.

  128. 2019 Feb

    Outsourcing Playbook published

    The Playbook introduced guidance on risk allocation, pilots, performance indicators, resolution plans, and delivery-model decisions. These made lifecycle controls explicit in central-government outsourcing.

  129. 2019 Feb

    UK launches the Outsourcing Playbook

    New guidance emphasized evidence-based make-or-buy decisions, appropriate risk allocation, pilots, published performance measures, and resolution plans.

  130. 2019 Mar

    Global Digital Marketplace shares multi-supplier lessons

    Government Digital Service described work to adapt digital marketplace practices internationally. The work linked procurement transparency with digital-sector development.

  133. 2019 Sep

    Team Topologies first edition published

    Team Topologies supplied four fundamental team types and three interaction patterns for evolving organizational boundaries around fast flow and manageable cognitive load.

  134. 2019 Oct

    ISO 22301:2019 is published

    ISO published edition 2 of ISO 22301 in October 2019, replacing the 2012 edition. The standard specifies requirements for a business continuity management system.

  135. 2019 Oct 22

    Security defaults apply to new tenants

    Tenants created from this date could have security defaults enabled at creation. Baseline protections included multifactor authentication and blocking legacy authentication patterns.

2020s

75 milestones

  1. 2020

    ISO 16175 functional requirements consolidated

    ISO 16175-1:2020 provided functional requirements and associated guidance for applications that manage digital records. It consolidated earlier ISO 16175 material for system selection, design, implementation, and maintenance.

  2. 2020

    NIST SP 1800-5 practice guide for ITAM finalized

    The National Institute of Standards and Technology published a practice guide linking IT asset visibility directly to cybersecurity outcomes, providing an architecture reference for integrating ITAM evidence with security monitoring.

  3. 2020 Jan

    Industry-practice mapping guidance published

    ISO/IEC 19770-8 defined how industry practices can be mapped to and from the 19770 family. Organizations gained a structured way to relate their existing controls to the standards.

  4. 2020 Feb

    OECD publishes the Going Digital integrated framework

    The framework connected access, use, innovation, jobs, inclusion, trust, and market openness. It treated digital transformation as a cross-domain system with tradeoffs rather than a technology program.

  7. 2020 Jun

    Foundation joins the Linux Foundation

    The FinOps Foundation became part of the Linux Foundation, moving the practice into a broader open-source foundation structure.

  8. 2020 Jun

    Outsourcing Playbook updated

    The update added delivery model assessments and strengthened guidance on value, risk, and supplier relationships. It shifted attention from contract award toward the choice and operation of the delivery model.

  10. 2020 Jun

    The Playbook broadens from outsourcing to sourcing

    The second version was rebranded to reflect a choice among internal, external, and combined delivery models rather than a presumption to outsource.

  11. 2020 Jun 24

    Commission publishes first GDPR application report

    The Commission published its first report on applying the GDPR, shifting attention from preparation to implementation experience.

  12. 2020 Jul

    Jamf goes public on the Nasdaq

    Jamf, an Apple-only device management specialist, closed its initial public offering and began trading under the ticker JAMF. It showed that a platform focused on one operating-system family, rather than a broad UEM console, could still reach public-market scale.

  13. 2020 Sep

    NIST publishes SP 800-53 Revision 5

    Revision 5 updated the federal security and privacy control catalog. The contingency-planning family remained part of the risk-management control structure.

  14. 2020 Sep

    The Sourcing Playbook published

    The UK government published commercial guidance covering delivery models, market management, evaluation, cost, risk allocation, and resolution planning. It emphasized procurement as an end-to-end commercial lifecycle.

  15. 2020 Nov

    NIST IR 8286 connects cyber risk registers to ERM

    NIST described how cybersecurity risk registers can communicate system and organizational risks into enterprise risk management. The guidance made risk aggregation a governance concern rather than a system-by-system activity.

  16. 2020 Dec

    Ivanti completes its acquisition of MobileIron and Pulse Secure

    Ivanti closed simultaneous acquisitions of MobileIron, an early enterprise mobility management pioneer, and Pulse Secure, folding both into a combined unified endpoint management and zero-trust security portfolio. The deal removed another independent EMM pioneer from the market.

  18. 2021 Feb

    AWS publishes Disaster Recovery of Workloads on AWS

    The AWS Well-Architected whitepaper formalized cloud disaster-recovery guidance. It organized recovery design around workload disruption, recovery options, detection, and testing.

  19. 2021 Mar

    Digital, Data and Technology Playbook published

    The UK government issued technology-specific guidance for sourcing and contracting digital, data, and technology projects. It connected commercial decisions with technology delivery concerns.

  20. 2021 May

    Third annual Playbook update issued

    The Sourcing Playbook became the third annual refresh of the earlier Outsourcing Playbook. It set expectations for how contracting authorities and suppliers engage.

  22. 2021 Jul 13

    Migrate for Compute Engine V5 described as a managed service

    Google described replication-based VM migration with test clones, migration groups, and cutover. Testable replication and grouped execution became part of the service workflow.

  23. 2021 Nov

    Earlier FinOps definition is approved

    The Technical Advisory Council approved the earlier cloud-financial-management definition later replaced by the 2024 wording.

  24. 2021 Dec 8

    Google Cloud publishes Cloud Allocation percentage guidance

    Google Cloud described allocation percentage as a FinOps metric spanning directly attributable, shared, and non-taggable costs. Coverage became an explicit operating measure.

  25. 2022

    ISO publishes the first amendment

    ISO published the first amendment to ISO 30401. The amendment showed that the management-system reference had entered a maintained lifecycle.

  26. 2022

    Journey to CSF 2.0 begins

    NIST began the CSF 2.0 development journey, opening a new cycle of concept work, drafts, reference-tool development, and stakeholder feedback.

  27. 2022 Feb

    AWS updates active-passive failover guidance

    The whitepaper added data-plane and control-plane material, expanded active-passive failover guidance, and replaced CloudEndure Disaster Recovery with AWS Elastic Disaster Recovery.

  28. 2022 Feb

    ISO/IEC 27002:2022 reworks the control catalog

    The 2022 edition condensed the controls into 93 items grouped in four themes — organizational, people, physical, and technological — consolidating 56 of the 2013 edition's 114 controls into 24 and adding new ones.

  29. 2022 Feb 17

    AWS launches auto-adjusting budgets

    AWS introduced budgets that calculate a new period amount from historical billing data. Teams could use a historical baseline while still deciding how to handle planned changes outside that baseline.

  31. 2022 Apr

    TOGAF Standard, 10th Edition

    The 10th Edition split the standard into Fundamental Content and TOGAF Series Guides, separating enduring concepts from configurable practice and adding guidance for agile enterprises.

  33. 2022 Sep

    Morgan Stanley pays $35M SEC penalty for disposal failures

    The SEC charged Morgan Stanley Smith Barney for failures in asset disposal — lost decommissioned devices with customer data, unvetted vendors, no verification of destruction. The case became the canonical example of what happens when retirement and disposal controls exist on paper but not in practice.

  34. 2022 Oct

    ISO/IEC 27001 third edition published

    ISO published the third edition of ISO/IEC 27001. Organizations applying the standard continued to use a requirements-based ISMS and risk-management approach.

  35. 2022 Oct

    ISO/IEC 27005:2022 updates risk guidance

    The risk management guidance standard was updated to align with ISO 31000, giving the family's risk process a dedicated, current reference.

  36. 2022 Oct 25

    ISO/IEC 27001:2022 third edition

    The requirements edition was revised to match the 27002 control structure, with four themes replacing the older domains and new requirements including planned change (Clause 6.3) and explicit ISMS processes (Clause 4.4).

  40. 2023

    Practice Manager and Master routes are added

    The qualification portfolio added the Practice Manager and ITIL Master routes, giving practice capability a clearer progression beyond Foundation.

  41. 2023 Jan

    FOCUS moves into a Linux Foundation specification project

    Work on the FinOps Open Cost and Usage Specification moved from a FinOps Foundation working group to a Joint Development Foundation project. Common billing-data requirements became a formal specification effort.

  42. 2023 Jan

    FOCUS moves to a Linux Foundation project

    The open billing work migrated into the FinOps Open Cost and Usage Specification project, creating a vendor-neutral billing-data specification effort.

  45. 2023 May

    NIST SP 800-124 Revision 2 covers the full mobile-device lifecycle

    The revision covered centralized management and endpoint protection for organization-owned and personal devices from deployment through disposal.

  46. 2023 Jun

    IETF standardized CoSWID

    RFC 9393 defined a compact CBOR representation aligned with SWID semantics. Constrained devices could carry software identification information with less transport and storage overhead.

  47. 2023 Jul

    SEC adopts cybersecurity disclosure rules

    The SEC adopted rules requiring covered public companies to describe cybersecurity risk management, strategy, governance, and incident disclosure. Board oversight and management roles became explicit disclosure subjects for those issuers.

  48. 2023 Jul 11

    Azure Active Directory becomes Microsoft Entra ID

    Microsoft announced the identity service rename and completed customer-facing changes later in 2023. Existing capabilities, licensing, sign-in addresses, application programming interfaces, and deployments remained in place.

  49. 2023 Aug

    CSF 2.0 public draft and implementation examples released

    NIST released the public draft of CSF 2.0 and associated implementation examples for comment. The draft invited review of changes intended to address current and future cybersecurity challenges.

  50. 2023 Oct

    Procurement Act 2023 received Royal Assent

    The Act established the new procurement regime that later changed the supporting guidance and operational preparation for contracting authorities and suppliers.

  51. 2023 Oct

    Procurement Act 2023 receives Royal Assent

    The Act created a new statutory procurement framework for England, Wales, and Northern Ireland. It set the direction for later implementation guidance and procedures.

  52. 2023 Oct 5

    WCAG 2.2 becomes a W3C Recommendation

    WCAG 2.2 added success criteria while retaining backward compatibility with earlier WCAG 2 versions. Report and dashboard teams gained a new current accessibility target for web delivery.

  53. 2023 Oct 10

    Google Cloud connects allocation to value measurement

    Google Cloud identified cost allocation as necessary for understanding who spends what before calculating business value. Allocation moved beyond bill reporting into unit-economics analysis.

  54. 2023 Dec

    Updated FinOps definition receives TAC approval

    The Technical Advisory Council approved wording that describes FinOps as an operational framework and cultural practice centered on business value, timely decisions, and collaboration.

  55. 2024

    ISO 22301 receives Amendment 1

    ISO lists Amendment 1:2024 for ISO 22301:2019. The amendment kept the standard current while its next full edition entered development.

  56. 2024

    Practice adoption guidance expands

    Additional adoption guidance made the practice material more usable for organizations applying ITIL 4.

  58. 2024 Feb

    CSF 2.0 released

    NIST released CSF 2.0 for organizations in every sector. The update added the Govern Function and expanded the Framework's scope beyond critical infrastructure.

  59. 2024 Feb

    NIST releases Cybersecurity Framework 2.0

    CSF 2.0 added Govern as a sixth Function and expanded the framework's scope beyond critical infrastructure. Governance became an explicit set of outcomes for strategy, expectations, policy, communication, and monitoring.

  60. 2024 Feb 23

    Climate action changes added by amendment

    ISO/IEC 27001:2022/Amd 1:2024 introduced climate action changes to the standard, adding the consideration of climate-related risk to the ISMS context and risk process.

  61. 2024 Mar

    Framework 2024 revisions are published

    The Foundation published revisions that updated the definition and reorganized Framework domains, capabilities, and Personas around current practice.

  62. 2024 Mar

    ISO/IEC 27006-1:2024 replaces the certifier requirements

    The requirements for bodies that audit and certify ISMSs were reissued as 27006-1:2024, aligning certification-body competence with the current 27001 edition.

  63. 2024 Apr 26

    ISO records that ISO 30401 will be revised

    ISO completed its systematic review and recorded the standard for revision. Practitioners could continue using the published edition while tracking a replacement under development.

  64. 2024 May

    CIS Controls version 8.1 adds governance recommendations

    CIS released Controls v8.1 with governance recommendations for policies, procedures, processes, and compliance evidence. The update connected prioritized safeguards more directly to governance practice.

  65. 2024 Jun 20

    FOCUS 1.0 reaches general availability

    The FinOps Foundation announced FOCUS 1.0 general availability. A common billing-data format supported cross-provider cost analysis, allocation, budgeting, and forecasting workflows.

  66. 2024 Jul

    Omnissa launches as an independent company

    Following KKR's acquisition of VMware's end-user computing business from Broadcom, Omnissa launched as a standalone software company carrying the Workspace ONE unified endpoint management product forward outside VMware. It showed that even a market-leading UEM platform's ownership keeps changing as its parent company's strategy shifts.

  68. 2024 Aug 1

    Azure documents cost allocation rule resources

    Azure documented resource-based rules that distribute selected source costs to targets with fixed proportions. Native allocation controls made rule definitions deployable and reviewable.

  69. 2024 Oct

    TAC approves Scopes as a Framework element

    The Technical Advisory Council approved Scopes to capture the technology cost and usage contexts to which practitioners apply FinOps concepts.

  70. 2024 Nov 7

    FOCUS 1.1 is ratified

    FOCUS 1.1 added columns and metadata improvements for more granular multi-cloud billing analysis. Standardized billing data reduced the normalization work ahead of allocation.

  72. 2025 Jan

    EU DORA takes effect

    The Digital Operational Resilience Act requires EU financial institutions to maintain continuously updated asset inventories connected to risk controls and third-party dependency maps, making ITAM a compliance obligation rather than an operational preference.

  73. 2025 Feb

    Procurement Act 2023 came into force

    The new regime took effect on 24 February 2025. Official learning materials included operational procurement staff and professionals who manage suppliers or contracts.

  74. 2025 Feb

    Procurement Act 2023 comes into force

    The new regime took effect on 24 February 2025. Buyers and suppliers began using the framework in live procurement activity.

  75. 2025 Mar

    Framework 2025 adds Scopes

    Framework 2025 made Scopes a core element and reflected a Cloud-plus approach that can include technology spending beyond public cloud.