PECB ISO 18788 Foundation study plan
PECB ISO 18788 Foundation · Give each week a clear focus.
8 weeks · About 6 hours per week
Fundamental principles and concepts of a Security Operations Management System (SOMS)
Define a Security Operations Management System (SOMS) in your own words and distinguish it from general information security management and from physical guarding services
Explain the purpose and intended outcomes of ISO 18788 and how it relates to the high-level structure (HLS) shared by ISO management system standards
Map the core SOMS vocabulary: security operations, client, interested party, risk, control, top management, and continual improvement, with a one-line definition for each
Describe the Plan-Do-Check-Act cycle and locate where each SOMS clause family sits within it
Your checkpoint
A one-page glossary plus a labeled PDCA diagram placing all SOMS clause families, self-checked against the standard text
Fundamental principles and concepts of a Security Operations Management System (SOMS)
Explain the context-of-the-organization requirements, including internal and external issues and the needs and expectations of interested parties
Determine how the scope of a SOMS is defined and justify why exclusions must be documented
Illustrate how leadership commitment and a security operations policy translate into organizational direction and accountability
Differentiate roles, responsibilities, and authorities across top management, security managers, and operational staff
Your checkpoint
A scope statement and a draft security operations policy for a fictional organization, each annotated with the clause requirements they satisfy
Fundamental principles and concepts of a Security Operations Management System (SOMS)
Break down the risk-based planning requirements, including risk identification, analysis, evaluation, and treatment options
Distinguish risk assessment from risk treatment and identify when reassessment is triggered
Explain how security objectives are set, monitored, and communicated consistent with the policy
Relate legal, regulatory, contractual, and human rights obligations to SOMS planning and operations
Your checkpoint
A risk register with at least six identified risks, scored and mapped to treatment options, plus a set of measurable security objectives
Fundamental principles and concepts of a Security Operations Management System (SOMS) & Security Operations Management System (SOMS)
Explain competence, awareness, and communication requirements and how they support consistent security operations
Describe the types of documented information a SOMS requires and the controls over creation, update, and retention
Interpret operational planning and control requirements, including criteria for processes and control of outsourced activities
Prepare for the transition from foundational concepts into operational and performance-evaluation clauses
Your checkpoint
A documented-information matrix listing required records and documents, their owners, and retention rules, scored against the standard's requirements
Security Operations Management System (SOMS)
Explain how operational risk controls are implemented, monitored, and adjusted during service delivery
Describe the requirements for managing change that affects security operations and for responding to incidents and emergencies
Outline client and interested-party communication and complaint-handling expectations within a SOMS
Identify how human rights considerations and the use-of-force principle are addressed in operational controls
Your checkpoint
An incident response and change-control procedure outline with named triggers, responsibilities, and escalation paths, cross-referenced to the relevant clauses
Security Operations Management System (SOMS)
Explain performance monitoring, measurement, analysis, and evaluation requirements and select meaningful security metrics
Describe internal audit requirements: programme design, auditor independence, criteria, and reporting
Explain management review inputs, outputs, and how decisions feed back into planning
Distinguish nonconformity from corrective action and outline the corrective action process
Your checkpoint
A performance dashboard design with at least five security metrics, plus an internal audit plan covering one full audit cycle
Security Operations Management System (SOMS)
Explain continual improvement requirements and how improvement opportunities are identified and implemented
Connect audit findings, management review outputs, and corrective actions into a coherent improvement loop
Identify common failure points in SOMS implementation and how the standard's requirements mitigate them
Practice interpreting clause language to answer scenario-style foundation questions accurately
Your checkpoint
A corrective action log with three worked examples showing root cause, action taken, and verification of effectiveness
Fundamental principles and concepts of a Security Operations Management System (SOMS) & Security Operations Management System (SOMS)
Consolidate all clauses into a single clause-by-clause summary you can recall without notes
Answer timed practice questions across both domains and analyse every wrong answer by clause reference
Explain the relationships between SOMS clauses and the PDCA cycle under exam conditions
Identify and close your two weakest remaining areas before the exam
Your checkpoint
A full timed mock exam scored above 80 percent, with a written remediation note for each missed question
Milestones
Week 2: Can explain context, scope, leadership, and policy requirements from memory and has produced a defensible scope statement and policy draft
Week 4: Scores at least 75 percent on a self-made quiz covering Domain 1 concepts, risk planning, and documented information
Week 6: Can walk through an entire monitoring, audit, and management review cycle end to end without referring to notes
Week 8: Completes a timed mock exam across both domains at 80 percent or higher and has remediated every missed question