Security Operations Management Systems (SOMS)
Domain focus
This domain tests clause-by-clause understanding of ISO 18788:2015 and how requirements interlock. You must know what each clause demands, what evidence is expected, and where auditors commonly misread the standard.
Core rules
Clause 4 requires the organization to determine external and internal issues, interested parties and their requirements, the SOMS scope, and the processes needed. Clause 5 requires top management leadership, a policy appropriate to purpose and context, and assigned roles and authorities. Clause 6 covers actions to address risks and opportunities, legal and other requirements, SOMS objectives and planning changes. Clause 7 covers resources, competence, awareness, communication and documented information. Clause 8 covers operational planning and control, including security risk assessment and treatment, incident management, use-of-force controls and client-related obligations. Clause 9 covers monitoring, measurement, analysis, internal audit and management review. Clause 10 covers nonconformity, corrective action and continual improvement.
The standard uses “documented information” rather than “documented procedure”; retain what the standard, the organization or effectiveness requires. Risk and opportunity are broader than a security risk assessment; objectives must be measurable, monitored, resourced and linked to risks and legal requirements.
Worked example
An objective states: “Reduce unauthorized site-access incidents by 30% within 12 months.” The auditor checks that it is measurable, assigned to an owner, supported by access-control resources, monitored monthly, and connected to the site risk assessment and client requirements. If the objective exists only in the management review presentation and no data are collected, the finding is not “no objective” but ineffective planning and monitoring under clauses 6 and 9.
Traps
Do not demand a written procedure for every clause. Do not confuse risk and opportunity with incident reporting. Do not accept objectives without baselines or owners. Do not skip clause 4 when auditing scope. Do not treat management review as a meeting-minutes exercise; check inputs, decisions and actions.