PECB ISO 18788 Foundation key terms

A structured set of policies, processes, roles, and resources an organization uses to direct, deliver, and improve the security operations it provides to clients and stakeholders.

The planned activities an organization performs to protect people, property, information, and reputation for clients, including guarding, monitoring, incident response, and protective services delivery.

A framework of interrelated elements, including policy, objectives, processes, and responsibilities, used to achieve intended outcomes consistently rather than through ad hoc effort.

An international standard that specifies requirements for establishing, implementing, maintaining, and improving a security operations management system, including principles for conducting security operations with respect for human rights.

An organization that delivers protective, guarding, monitoring, or related security services to clients under contractual arrangements, and which may seek certification of its management system.

The entity that contracts a security service provider to protect its people, assets, or activities, and whose requirements and risk context shape the services delivered.

A person or organization that can affect, be affected by, or perceive itself to be affected by the security operations, such as clients, personnel, communities, regulators, and shareholders.

The internal and external factors, including legal, cultural, social, and risk conditions, that influence how an organization designs and runs its security operations management system.

The documented boundaries of the management system, stating which services, locations, entities, and activities are covered by the security operations management system and which are excluded.

A top-level statement of intent and direction, approved by leadership, that commits the organization to lawful, accountable, human-rights-respecting delivery of security services and to continual improvement.

The person or group at the highest level who directs the organization, approves policy, provides resources, and is accountable for the effectiveness of the management system.

Visible, active support from senior levels, shown through resource allocation, decisions, and personal engagement, that makes the management system credible and effective across the organization.

An approach that identifies what could go wrong or right, evaluates likelihood and consequence, and uses that analysis to prioritize controls, decisions, and improvement actions.

The process of identifying hazards and threats, analyzing their likelihood and impact on people, assets, and operations, and evaluating which risks need treatment.

Selecting and applying options to modify risk, such as avoiding, reducing, transferring, or accepting it, then recording the chosen controls and residual risk.

A controlled record listing the applicable requirements or controls, whether each is applied or excluded, and the justification for that decision, giving a clear view of the control set.

An ongoing process to identify, prevent, mitigate, and account for how security activities may affect human rights, including screening personnel and reviewing use-of-force practices.

The application of physical or other coercive measures by security personnel, which must be lawful, necessary, proportionate, and governed by clear rules and reporting.

A channel through which employees, clients, communities, or affected persons can raise complaints about security conduct and receive a fair, documented response.

The combination of education, training, experience, and demonstrated skills that enables a person to perform assigned security tasks to the required standard.

Planned activities that build required skills and ensure personnel understand the policy, their responsibilities, risks, and the consequences of nonconformance in their work.

The documented allocation of duties and authority across the organization so that every process in the management system has a named owner and clear accountability.

The process of planning security activities, setting criteria for them, and controlling them through documented procedures and resources so they meet requirements consistently.

Contracting work to an external provider, which the organization must still control by defining requirements, monitoring performance, and retaining accountability for the results.

Assessing and selecting external providers against defined criteria such as legality, human rights conduct, competence, and quality, and monitoring their ongoing performance.

The structured process for reporting, responding to, investigating, and learning from security incidents, including escalation, evidence handling, and corrective action.

Planning and testing how the organization will respond to foreseeable emergencies, such as intrusions, fires, or medical events, and protecting people and assets during them.

Systematically tracking defined indicators of security performance and management system health, using valid methods, to determine whether intended results are being achieved.

An independent, planned examination of the management system against its own requirements and the standard, used to find gaps and feed improvement.

A periodic, structured review by top management of performance data, audit results, and changing context, leading to decisions and actions on improvement and resources.

A failure to meet a requirement, whether in a process, a control, or a deliverable, which must be recorded, contained, and addressed so it does not recur.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not happen again, verified for effectiveness after implementation.

The ongoing effort to enhance security performance and management system effectiveness through analysis, action, and review rather than one-off fixes.

Information the organization must control and maintain, including policies, procedures, records, and evidence, covering its creation, approval, distribution, and retention.

Planned communication and consultation with interested parties to understand their expectations, share information, and build trust in security operations.

Protecting sensitive operational data, such as client schedules, vulnerabilities, and incident details, from unauthorized access, disclosure, or misuse.

An independent organization that audits a security service provider's management system against ISO 18788 and issues a certificate when requirements are met.