PECB ISO 18788 Foundation cheat sheet

ISO 18788 is the international standard for Security Operations Management Systems (SOMS); it specifies requirements for organizations that conduct or contract security operations and is built on the ISO High-Level Structure shared with ISO 9001 and ISO 14001.

A SOMS applies the Plan-Do-Check-Act (PDCA) cycle: Plan establishes policy, objectives and risk treatment; Do implements controls and operations; Check monitors, measures and audits; Act takes corrective action and improves.

The standard follows a risk-based approach: security risks and human rights risks are identified, assessed, treated and continually reviewed rather than addressed through fixed checklists.

Annex SL core clauses structure the SOMS: context of the organization, leadership, planning, support, operation, performance evaluation and improvement; sector-specific security content sits inside these clauses.

Human rights due diligence is a defining principle of ISO 18788, drawing on the UN Guiding Principles on Business and Human Rights and the Voluntary Principles on Security and Human Rights.

Scope is defined by the organization's context, interested parties, legal and other requirements, and the security operations it performs or commissions; exclusions must be justified and cannot remove requirements affecting the ability to achieve intended outcomes.

The use-of-force principle is legality, necessity and proportionality: force is applied only as permitted by law, only when necessary, and only to the extent required by the situation.

Leadership and worker participation are requirements, not options: top management must demonstrate commitment, establish policy, assign roles and ensure the SOMS is integrated into business processes.

Documented information is used as evidence of conformity and operational control; it is created, updated and controlled for availability, protection and retention.

Clause 6 planning requires risk and opportunity identification, security risk assessment, human rights risk assessment, determination of legal and other requirements, and documented security objectives with plans to achieve them.

Clause 8 operation covers operational planning and control, management of change, outsourcing and contractors, incident response, and the specific security operation controls the organization determines.

Competence requirements apply to all persons performing security work under the organization's control, including contractors: determine competence needs, ensure training or experience, evaluate effectiveness, and retain evidence.

Performance evaluation (Clause 9) requires monitoring, measurement, analysis and evaluation with defined what, how, when and who; internal audit at planned intervals; and management review of specified inputs and outputs.

Incident management follows a defined cycle: report, record, classify, investigate, respond, analyze root cause, and implement corrective action with verification of effectiveness.

Nonconformity and corrective action (Clause 10) require reaction to control and correct the issue, evaluation of the need to eliminate causes, implementation of action, review of effectiveness, and updating risks if necessary.

Monitoring and measurement should include leading indicators (training completion, drills conducted, audit findings closed) as well as lagging indicators (incidents, complaints, use-of-force events).

Internal audit programme must consider the importance of processes, changes affecting the organization, and results of previous audits; auditors must not audit their own work.

Management review inputs include status of actions from previous reviews, changes in context, performance trends, audit results, nonconformities, and feedback from interested parties; outputs include improvement and resource decisions.