If I understand correctly, the organization that defines ISO Alpha-3 and Numeric Codes is actually the U. The Internet Assigned Numbers Authority (IANA) administers top-level domain names (.com, .edu, .org, and so on).
The UU code was revoked in 2010-04 with the changeover to Geopolitical Entities and Codes.
Since Kosovo declared independence, it has treated Serbia as Serbia proper (RI) plus Kosovo (KV).
The 2004 edition of the CIA World Factbook explains why it has added country listings for Akrotiri and Dhekelia, two British military bases in Cyprus.
It maintains an authoritative list of ISO Alpha-2 Codes . See the changes in ISO 3166-1 page for the change history.
Its list is coordinated with a list of countries used by the United Nations Statistics Division for reporting purposes. I have also written a page about using ISO 3166-1 in software.