I85PREP
⌘ K
PECB ISO 18788 Lead Implementer study materials
PECB ISO 18788 Lead Implementer study resources

PECB ISO 18788 Lead Implementer practice questions

One question at a time. Build your PECB ISO 18788 Lead Implementer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a Security Operations Management System (SOMS)

In ISO 18788, what is the primary purpose of a Security Operations Management System (SOMS)?

  1. To define the technical specifications for physical perimeter fencing
  2. To provide a structured framework for governing security operations and their associated risks Correct answer.
  3. To certify individual security guards against a national licensing standard
  4. To replace the organization's financial audit programme with security inspections

Explanation

A SOMS is a management system: it gives the organization a repeatable, governable framework of policy, planning, operation, evaluation and improvement for security operations and their risks. It does not certify individuals, substitute financial audit, or prescribe product specifications.

Question 2Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which characteristic best distinguishes a management-system approach from a collection of standalone security procedures?

  1. It documents every task in a fixed manual that is revised only at contract renewal
  2. It relies on a single appointed security manager to enforce compliance
  3. It focuses exclusively on reacting to incidents after they have occurred
  4. It links interrelated processes through shared policy, objectives and continual improvement Correct answer.

Explanation

A management system is defined by interacting processes steered by common policy, objectives, performance evaluation and improvement, which is what makes it systemic rather than a loose set of documents. Dependence on one person, static manuals, or purely reactive incident handling all undermine that systemic character.

Question 3Fundamental principles and concepts of a Security Operations Management System (SOMS)

ISO 18788 is built on the Plan-Do-Check-Act cycle. Which activity belongs to the 'Check' phase?

  1. Assigning corrective actions to close an identified gap
  2. Implementing operational controls at a guarded facility
  3. Establishing security objectives and allocating resources
  4. Monitoring, measuring and evaluating security performance Correct answer.

Explanation

'Check' covers monitoring, measurement, analysis and evaluation of performance against the security objectives. Objectives and resourcing sit in 'Plan', operational controls in 'Do', and corrective action in 'Act'.

Question 4Fundamental principles and concepts of a Security Operations Management System (SOMS)

The scope of a SOMS must be defined and documented. Which input is most directly relevant to establishing that scope?

  1. The number of years the security manager has worked in the sector
  2. The marketing budget allocated to the security department
  3. The brand of access-control technology already installed
  4. The organization's external and internal issues and the security obligations it must fulfil Correct answer.

Explanation

Scope determination depends on the issues identified from the organization's context and on the interested parties' requirements and legal or contractual obligations. Budget, tenure and vendor brands are not determinants of scope.

Question 5Fundamental principles and concepts of a Security Operations Management System (SOMS)

In ISO 18788, what does 'context of the organization' refer to?

  1. The contractual terms agreed with each client
  2. The internal and external issues relevant to the organization's purpose and security objectives Correct answer.
  3. The organizational chart of the security department
  4. The physical environment surrounding each guarded site

Explanation

Context covers the internal and external issues that affect the organization's ability to achieve the intended outcomes of its SOMS. It is broader than physical surroundings, internal structure, or any single contract.

Question 6Fundamental principles and concepts of a Security Operations Management System (SOMS)

A security provider operating in a region with new human-rights legislation reviews its SOMS. Which action best reflects the principle of identifying interested parties and their requirements?

  1. Mapping regulators, clients and affected communities and determining their relevant requirements Correct answer.
  2. Delegating the matter to the legal department and closing the review
  3. Updating the guard roster to cover the new legal inspection schedule
  4. Adding the legislation to the induction slides without further analysis

Explanation

The standard requires determining relevant interested parties and the requirements they impose on the SOMS, then using them to shape the system. Roster changes, slide updates or pure delegation do not establish which parties matter or what they require.

Question 7Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which statement correctly describes the role of top management in a SOMS?

  1. Top management's role is limited to approving the annual security budget
  2. Top management may delegate all security accountability to an external contractor
  3. Top management need only be informed of incidents that reach the media
  4. Top management must demonstrate leadership and commitment and integrate SOMS requirements into business processes Correct answer.

Explanation

Leadership and commitment require top management to take accountability, integrate SOMS requirements into the organization's business processes and ensure resources are available. Delegating all accountability, limiting involvement to budget approval or media incidents does not meet this.

Question 8Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the function of a security policy within a SOMS?

  1. To list the names of all personnel authorized to carry weapons
  2. To record every incident that occurred in the previous year
  3. To serve as the contract between the organization and its clients
  4. To provide a documented framework of commitments and direction against which objectives are set Correct answer.

Explanation

The security policy states top management's commitments and provides the framework for setting security objectives. It is not a personnel authorization list, a client contract, or an incident register.

Question 9Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which of the following is a risk-based principle that underpins security operations under ISO 18788?

  1. Risk should be reassessed only after a serious incident occurs
  2. Security measures should be proportionate to the assessed risk and potential impact Correct answer.
  3. Controls should be applied uniformly regardless of the assessed threat
  4. The most expensive technology always provides the most appropriate control

Explanation

ISO 18788 emphasizes risk-based, proportionate decision-making so that controls match the assessed threat and consequences. Uniform application, cost as a proxy for adequacy, and incident-triggered-only reassessment all conflict with that principle.

Question 10Fundamental principles and concepts of a Security Operations Management System (SOMS)

An organization must address 'risks and opportunities' when planning its SOMS. What does the 'opportunities' element primarily require?

  1. Listing commercial sales leads for the security services division
  2. Recording favorable weather conditions for outdoor patrols
  3. Documenting opportunities for staff promotion within the security team
  4. Identifying chances to improve security performance or achieve objectives more effectively Correct answer.

Explanation

Risks and opportunities planning ensures the SOMS can achieve its intended outcomes, prevent undesired effects and pursue improvement. Opportunities therefore concern improved security performance and objective achievement, not weather, promotion or sales matters.

Question 11Fundamental principles and concepts of a Security Operations Management System (SOMS)

How should security objectives be formulated to conform to ISO 18788?

  1. As confidential targets known only to the chief executive
  2. As qualitative statements that cannot be assessed
  3. As general aspirations that are reviewed only at five-year intervals
  4. As measurable, monitored objectives consistent with the security policy and relevant requirements Correct answer.

Explanation

Objectives must be consistent with the policy, measurable where practicable, monitored, communicated and updated. Vague aspirations, extreme secrecy or non-assessable statements prevent performance evaluation.

Question 12Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the essential purpose of a risk assessment in a SOMS?

  1. To assign blame for past security failures
  2. To produce a definitive list of every possible future event
  3. To satisfy insurers without influencing operational decisions
  4. To identify, analyse and evaluate security risks so that treatment decisions are informed Correct answer.

Explanation

Risk assessment identifies, analyses and evaluates risks to inform proportionate treatment and decision-making. It cannot enumerate every future event, is not a blame exercise, and should genuinely inform operations rather than exist only for insurers.

Question 13Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which item is an example of a risk treatment option in a security operations context?

  1. Accepting the residual risk without any further action after evaluation
  2. Avoiding the activity, reducing the likelihood or impact, or sharing the risk Correct answer.
  3. Transferring the risk to an insurer and taking no other measure
  4. Ignoring the risk because it has not yet materialized

Explanation

Risk treatment options include avoiding the risk, reducing likelihood or consequence, sharing or transferring it, and accepting it with justification. Acceptance without evaluation, transfer without other measures, or ignoring a risk are not sound treatments.

Question 14Fundamental principles and concepts of a Security Operations Management System (SOMS)

ISO 18788 places strong emphasis on respect for human rights. What does this mean operationally for a security provider?

  1. Guards may use force whenever they judge it commercially necessary
  2. Use of force must be lawful, necessary and proportionate, with safeguards against abuse Correct answer.
  3. Human-rights considerations apply only to employees, not to affected communities
  4. Human-rights compliance is the sole responsibility of the client

Explanation

The standard requires security operations to respect human rights, meaning force is lawful, necessary and proportionate, with safeguards and accountability. Commercial convenience, excluding affected communities, or shifting responsibility entirely to the client all contradict this.

Question 15Fundamental principles and concepts of a Security Operations Management System (SOMS)

A security company is planning its SOMS documentation. Which principle should guide the extent of documented information?

  1. Keep documentation to the minimum required for the effectiveness of the SOMS Correct answer.
  2. Avoid documentation so that the organization retains flexibility
  3. Restrict documentation to documents explicitly demanded by clients
  4. Document everything to the maximum extent possible to demonstrate diligence

Explanation

The standard requires documented information necessary for the effectiveness of the SOMS, not maximal paperwork. Excessive documentation adds burden, while client-only or absent documentation fails to support the system.

Question 16Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which activity best demonstrates operational planning and control in a SOMS?

  1. Reviewing the organization's financial statements annually
  2. Writing the security policy and then filing it without further action
  3. Conducting a one-off training session at the start of a contract
  4. Establishing criteria for security processes and implementing controls in line with those criteria Correct answer.

Explanation

Operational planning and control means establishing process criteria and implementing controls consistent with them, including managing outsourced processes. Policy that is merely filed, financial review, or a single training event does not provide ongoing operational control.

Question 17Fundamental principles and concepts of a Security Operations Management System (SOMS)

Why does ISO 18788 require the organization to control outsourced security processes?

  1. Because outsourced staff do not require any competence assessment
  2. Because contractors automatically assume all legal liability
  3. Because outsourcing is prohibited under the standard
  4. Because outsourced processes can affect the organization's ability to meet its security obligations Correct answer.

Explanation

Outsourced processes remain part of the organization's security operations and can affect conformity with requirements, so they must be controlled and their performance monitored. Outsourcing is not prohibited, liability is not automatically transferred, and contractor competence still matters.

Question 18Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the main purpose of monitoring and measurement in a SOMS?

  1. To determine whether security performance and the SOMS achieve intended results Correct answer.
  2. To satisfy a one-time external certification requirement
  3. To generate data for marketing claims about security performance
  4. To replace internal audit with continuous surveillance cameras

Explanation

Monitoring and measurement provide evidence of performance against objectives and of the system's effectiveness. They are not marketing inputs, a substitute for audit, or a one-time certification exercise.

Question 19Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which statement best captures the intent of the internal audit requirement in ISO 18788?

  1. Audits should be performed only when a client requests them
  2. Audits should provide objective evidence on whether the SOMS conforms and is effectively implemented Correct answer.
  3. Audits should focus exclusively on financial records
  4. Audits should be conducted by the security manager on their own area of responsibility

Explanation

Internal audits provide objective information on conformity and effectiveness and must be planned with impartiality. Self-auditing one's own area, client-triggered-only audits, or exclusive financial focus all fail that intent.

Question 20Fundamental principles and concepts of a Security Operations Management System (SOMS)

What is the role of management review in a SOMS?

  1. To assess the continuing suitability, adequacy and effectiveness of the SOMS and decide on improvement Correct answer.
  2. To conduct disciplinary hearings for security staff
  3. To replace the need for corrective action
  4. To approve individual guard shift rosters

Explanation

Management review is a top-management evaluation of the system's suitability, adequacy and effectiveness, leading to decisions on improvement and resources. It does not replace corrective action, schedule shifts, or handle disciplinary matters.

Question 21Fundamental principles and concepts of a Security Operations Management System (SOMS)

When a nonconformity is detected in security operations, what is required by the corrective-action process?

  1. Reassigning the person involved and closing the record
  2. Reacting to control it, evaluating the cause, and taking action to prevent recurrence Correct answer.
  3. Waiting for the next management review before any response
  4. Recording it in a log without further analysis

Explanation

Corrective action requires controlling the nonconformity, evaluating the need to eliminate causes, implementing action, reviewing effectiveness and updating risks where relevant. Logging alone, blaming an individual, or deferring all response is insufficient.

Question 22Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which of the following best reflects the principle of continual improvement in a SOMS?

  1. Reducing documentation to zero to increase flexibility
  2. Enhancing security performance through recurring evaluation and adjustment Correct answer.
  3. Replacing the entire SOMS every year with a new structure
  4. Maintaining the original procedures unchanged to preserve stability

Explanation

Continual improvement means recurringly enhancing performance and the system through evaluation, learning and adjustment. Freezing procedures, wholesale annual replacement, or eliminating documentation does not constitute improvement.

Question 23Fundamental principles and concepts of a Security Operations Management System (SOMS)

What does the term 'competence' require in the context of a SOMS?

  1. Requiring all staff to hold the same qualification regardless of role
  2. Assuming competence from the job title alone
  3. Counting the number of years each guard has been employed
  4. Determining necessary competence, ensuring personnel are competent, and retaining evidence Correct answer.

Explanation

Competence requires identifying the competence needed for roles affecting security performance, ensuring people meet it through education, training or experience, and retaining evidence. Tenure counts, uniform qualifications, or title-based assumptions do not demonstrate competence.

Question 24Fundamental principles and concepts of a Security Operations Management System (SOMS)

A client demands a security control that conflicts with applicable law. How should a SOMS-aligned organization respond?

  1. Implement the control silently and document the legal exposure
  2. Ask guards to decide individually whether to comply
  3. Refuse the unlawful element and address the conflict through its compliance and risk processes Correct answer.
  4. Implement the control because the client contract overrides legal requirements

Explanation

A SOMS requires commitment to satisfy applicable legal and other requirements, so unlawful client demands must not be implemented and the conflict must be handled through compliance and risk processes. Contract supremacy, silent implementation, or leaving the decision to individual guards all fail this.

Question 25Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which combination of elements most accurately characterizes the intended outcomes of a SOMS?

  1. Elimination of all security risk and zero incidents
  2. Consistent achievement of security objectives, fulfilment of obligations and continual improvement Correct answer.
  3. Increased revenue, reduced headcount and expanded market share
  4. Complete outsourcing of security accountability

Explanation

A SOMS aims to help the organization consistently achieve its security objectives, meet its obligations and improve over time. Revenue, headcount or market share are not its outcomes, risk cannot be eliminated entirely, and accountability cannot be outsourced away.

Question 26Fundamental principles and concepts of a Security Operations Management System (SOMS)

Which concept distinguishes a Security Operations Management System (SOMS) under ISO 18788 from a purely procedural security manual?

  1. A contractual annex listing the security services a client has purchased
  2. A set of documented procedures that describe guard deployment and incident reporting steps
  3. A management system in which security operations are planned, executed, monitored and improved through interacting processes Correct answer.
  4. A register of security incidents maintained for insurance and liability purposes

Explanation

A SOMS is a management system, meaning it links leadership, planning, support, operation, performance evaluation and improvement into an interdependent process framework rather than a static rulebook. The procedures, contracts and incident logs are outputs or inputs within that system, not the system itself.

Question 27Fundamental principles and concepts of a Security Operations Management System (SOMS)

A security provider wants its SOMS to reflect the principle that security operations must be conducted within a framework of accountability to law and human rights. Which structural choice best embodies that principle?

  1. Adding a human rights clause to client contracts and relying on client audits to verify conduct
  2. Assigning human rights compliance solely to the legal department and reporting to it annually
  3. Requiring each guard to sign an individual declaration that they will not commit abuses
  4. Embedding human rights commitments in policy, assigning defined roles and authorities, and reviewing conduct through the SOMS performance-evaluation processes Correct answer.

Explanation

Accountability in a SOMS is built through governance: policy commitments, clearly assigned roles, authorities and responsibilities, and verification through monitoring, audit and management review. Individual declarations and contractual clauses support this but do not by themselves create an accountable system.

Question 28Fundamental principles and concepts of a Security Operations Management System (SOMS)

In ISO 18788, the principle of 'due diligence' in security operations is best understood as which ongoing obligation?

  1. Purchasing liability insurance that covers claims arising from the conduct of security personnel
  2. Completing a one-time background screening of all personnel before they are first deployed
  3. Obtaining written consent from the client before any use of force is authorized
  4. Continuously identifying, preventing and mitigating adverse human rights impacts connected to the organization's activities and relationships Correct answer.

Explanation

Due diligence is a continuing process of identifying and addressing actual and potential adverse impacts linked to the organization's operations and business relationships, and accounting for how they are addressed. It is not a single screening event, an insurance product or a client permission step.

Question 29Fundamental principles and concepts of a Security Operations Management System (SOMS)

Two security providers both hold ISO 18788 certification. Provider A documents every work instruction in detail and follows them rigidly; Provider B sets outcome-based objectives, monitors performance indicators and adjusts methods when results drift. Which analysis best explains why Provider B is more consistent with SOMS principles?

  1. Provider B is more compliant because certification requires performance indicators for every process
  2. Both are equally compliant because ISO 18788 prescribes neither performance indicators nor work-instruction detail
  3. Provider B treats the SOMS as a performance-driven system subject to evaluation and improvement, whereas Provider A risks treating documentation as an end in itself Correct answer.
  4. Provider A is more compliant because detailed work instructions always satisfy the standard's documentation requirements

Explanation

A management system is judged by its ability to achieve intended outcomes and improve, so measurable objectives, monitoring and adjustment are central. Documentation supports control but excessive prescription without evaluation turns the system into a static rulebook that cannot respond to changing risk.

Question 30Security Operations Management System (SOMS)

Under ISO 18788, which document sits at the top of the security operations management system hierarchy and establishes the organization's overarching security commitments?

  1. The incident register
  2. The risk treatment plan
  3. The security operations policy Correct answer.
  4. The statement of applicability

Explanation

The security operations policy is the apex document of the SOMS; it states top management's commitment, sets direction and provides the framework for setting security objectives. All lower-level procedures, plans and records must be consistent with it.

Question 31Security Operations Management System (SOMS)

Which activity is performed during the 'Plan' phase of the PDCA cycle as applied to a security operations management system?

  1. Delivering security services to the client in line with contractual terms
  2. Establishing security objectives and processes needed to deliver results Correct answer.
  3. Taking corrective action on nonconformities found in operations
  4. Conducting internal audits of security operations

Explanation

In PDCA, 'Plan' covers establishing objectives, identifying risks and opportunities, and designing the processes needed to deliver results consistent with the policy. Auditing, service delivery and corrective action belong to later phases (Check, Do and Act respectively).

Question 32Security Operations Management System (SOMS)

A security provider is defining the scope of its SOMS. Which input is most relevant to justifying exclusions from the scope?

  1. The marketing budget allocated to security services
  2. The preferred shift pattern used by operations staff
  3. The results of the context analysis and risk assessment Correct answer.
  4. The number of guards employed at each site

Explanation

Scope decisions must be justified by the organization's context, the interested parties' requirements and the risk assessment, because these determine which activities and locations the SOMS must cover. Staffing counts, budgets and shift patterns are operational details that do not by themselves justify exclusions.

Question 33Security Operations Management System (SOMS)

What is the primary purpose of a gap analysis when an organization is first implementing ISO 18788?

  1. To compare current practices against the standard's requirements and identify what must change Correct answer.
  2. To verify that suppliers meet contractual security obligations
  3. To calculate the residual risk after controls are applied
  4. To benchmark service pricing against competitors

Explanation

A gap analysis maps existing arrangements against each requirement of the standard so the implementation team can plan the work needed to close shortfalls. It is a planning diagnostic, not a pricing, risk-calculation or supplier-verification exercise.

Question 34Security Operations Management System (SOMS)

An organization identifies a new legal requirement affecting its security operations. According to the compliance obligations process, what should happen first?

  1. Suspend all security operations until legal review is complete
  2. Record and assess the new requirement and determine how it applies to the organization Correct answer.
  3. Update the security operations policy immediately
  4. Notify the certification body before any internal action

Explanation

Compliance obligations must be identified, recorded and evaluated for how they apply to the organization's risks and operations before the SOMS is adjusted. Policy changes or operational adjustments follow from that assessment rather than preceding it.

Question 35Security Operations Management System (SOMS)

Which statement best describes how risk criteria should be established for a security operations management system?

  1. They should be copied unchanged from a peer organization to ensure comparability
  2. They should be reviewed only when a certification audit is scheduled
  3. They should be defined by top management with criteria for accepting risk and levels of risk that are significant Correct answer.
  4. They should be set solely by the operations manager without management review

Explanation

Top management defines risk criteria, including the organization's appetite for risk and thresholds that determine which risks require treatment. Criteria are organization-specific and must be reviewed at planned intervals, not borrowed wholesale or tied to audit timing.

Question 36Security Operations Management System (SOMS)

A security provider wants to demonstrate that personnel are competent for assigned security roles. Which combination of actions best satisfies the competence requirement?

  1. Counting the number of years each employee has worked in the sector
  2. Determining necessary competence, providing training or other action, and evaluating the effectiveness of that action Correct answer.
  3. Issuing each employee a copy of the security policy
  4. Recording attendance at a team briefing

Explanation

The competence requirement follows a cycle: determine the competence needed, ensure people are competent through education, training or experience, take action to acquire needed competence, and retain evidence of competence. Evaluating effectiveness distinguishes genuine competence management from mere attendance records.

Question 37Security Operations Management System (SOMS)

When should a formal management review of the security operations management system take place?

  1. Only after a security incident has been reported
  2. Whenever a client requests a copy of the policy
  3. At planned intervals determined by the organization Correct answer.
  4. Only when a new contract is signed

Explanation

Management review is a planned, recurring activity that lets top management evaluate the continuing suitability, adequacy and effectiveness of the SOMS using defined inputs and outputs. Triggering it only on incidents, client requests or contract events would leave the system without systematic oversight.

Question 38Security Operations Management System (SOMS)

During a security operation, a guard observes activity that suggests a planned intrusion. Which action sequence best reflects the operating principles of the SOMS?

  1. Post details of the observation on the client's public social media account
  2. Wait until the end of the shift and mention it informally to a colleague
  3. Confront the suspects directly and detain them without notifying anyone
  4. Follow the documented response procedure, record observations, and escalate through the defined reporting channel Correct answer.

Explanation

Security operations must be executed according to documented procedures that define response, recording and escalation, so that decisions are consistent and traceable. Improvised confrontation, delayed informal reporting or public disclosure undermine both safety and the evidence trail.

Question 39Security Operations Management System (SOMS)

What distinguishes a security operations management system from a standalone security plan?

  1. A SOMS is a one-off document while a plan is continuously improved
  2. A SOMS applies only to physical guarding while a plan covers all security types
  3. A SOMS requires no documented information while a plan always does
  4. A SOMS is a managed system of interrelated processes subject to continual improvement, while a plan is a static description of arrangements Correct answer.

Explanation

A management system comprises interrelated processes governed by policy, objectives, risk management, performance evaluation and improvement, whereas a security plan is a point-in-time description of arrangements. The system's defining feature is the PDCA-driven cycle of continual improvement.

Question 40Security Operations Management System (SOMS)

Which of the following is the most appropriate way to treat a risk that a critical security post will be left unstaffed during a staff shortage?

  1. Record the risk only in the incident register
  2. Accept the risk without any further action
  3. Implement a standby roster and cross-training as a mitigation, then reassess residual risk Correct answer.
  4. Remove the post from the scope of the SOMS

Explanation

Risk treatment selects controls that reduce likelihood or impact, and the residual risk is then reassessed against the risk criteria. A standby roster with cross-training directly addresses the staffing risk and allows the organization to judge whether the remaining risk is acceptable.

Question 41Security Operations Management System (SOMS)

An internal audit of the SOMS finds that a documented procedure is being followed inconsistently across two sites. What is the most appropriate next step under the corrective action process?

  1. Delete the procedure so that inconsistency can no longer be identified
  2. Determine the cause of the inconsistency and take action to eliminate it, then verify effectiveness Correct answer.
  3. Reassign all staff at both sites to other duties
  4. Immediately revoke the certification of both sites

Explanation

Corrective action requires reacting to the nonconformity, evaluating the need to eliminate its causes, implementing action, reviewing effectiveness and updating risks if needed. Addressing root cause and verifying the result prevents recurrence, which is the purpose of the process.

Question 42Security Operations Management System (SOMS)

Which set of items is most typical of the inputs to a management review of a security operations management system?

  1. Status of actions from previous reviews, audit results, nonconformities and performance against security objectives Correct answer.
  2. Competitor marketing campaigns and pricing changes
  3. The personal career plans of individual guards
  4. Employee holiday schedules and payroll costs

Explanation

Management review inputs include the status of previous actions, changes in context, performance against objectives, audit and incident results, nonconformities and corrective actions, and feedback from interested parties. These give top management the evidence needed to make decisions about the system.

Question 43Security Operations Management System (SOMS)

What is the role of interested parties in establishing the SOMS?

  1. They must approve the security operations policy before it is issued
  2. They are responsible for conducting internal audits
  3. Their relevant requirements and expectations must be determined and considered when designing the system Correct answer.
  4. They are excluded from the context analysis to preserve confidentiality

Explanation

The organization must determine the interested parties relevant to the SOMS and the requirements these parties impose, such as clients, regulators, employees and communities. These requirements feed the scope, compliance obligations and risk criteria rather than being excluded.

Question 44Security Operations Management System (SOMS)

A client requires the security provider to demonstrate that subcontractors meet the same security standards. Which SOMS mechanism best addresses this?

  1. Outsourcing all responsibility to the subcontractor
  2. Removing subcontractor activities from the risk assessment
  3. Relying on the subcontractor's verbal assurances
  4. Applying defined criteria for selection, monitoring and re-evaluation of externally provided processes Correct answer.

Explanation

Externally provided processes, products and services must be controlled through defined criteria for selection, performance monitoring and periodic re-evaluation. This keeps outsourced security activities within the control of the SOMS and provides evidence for the client.

Question 45Security Operations Management System (SOMS)

Which statement correctly describes the relationship between the security operations policy and security objectives?

  1. Objectives are optional if the policy is comprehensive
  2. Objectives replace the policy once they are set
  3. The policy must be rewritten whenever any objective changes
  4. Objectives must be consistent with the policy and be measurable, monitored and updated Correct answer.

Explanation

Security objectives are set at relevant functions and levels, must be consistent with the policy, and must be measurable, monitored, communicated and updated as appropriate. The policy provides the framework within which objectives are established.

Question 46Security Operations Management System (SOMS)

An organization is deciding how to structure documented information for its SOMS. Which approach best aligns with the standard?

  1. Keep no records so that auditors cannot find faults
  2. Create and update documents with appropriate identification, review and approval, and control their availability and protection Correct answer.
  3. Allow any employee to delete records once they are no longer convenient
  4. Document everything in a single uncontrolled spreadsheet

Explanation

Documented information must be controlled: it needs identification, format, review and approval for suitability and adequacy, and must be available where needed while protected from loss, misuse or alteration. Retention and disposal rules also apply.

Question 47Security Operations Management System (SOMS)

What is the main purpose of performance monitoring and measurement within the SOMS?

  1. To determine employee salaries
  2. To provide evidence of the effectiveness of security operations and support decisions for improvement Correct answer.
  3. To satisfy client marketing requirements
  4. To replace the need for internal audits

Explanation

Monitoring and measurement against defined criteria show whether security operations and the management system are achieving intended results, and they feed management review and improvement. They complement, rather than replace, internal audit.

Question 48Security Operations Management System (SOMS)

A security manager is planning how to respond to a nonconformity identified during operations. Which element is essential to a complete corrective action record?

  1. The name of the client who complained
  2. The nature of the nonconformity, actions taken, and results of the effectiveness review Correct answer.
  3. The personal opinion of the security guard on duty
  4. The estimated cost of the certification audit

Explanation

Records of nonconformities and corrective actions must capture the nature of the nonconformity, subsequent actions taken and the results of any corrective action, so that effectiveness can be verified. Cost estimates, client names and personal opinions are not the required elements.

Question 49Security Operations Management System (SOMS)

Which action best demonstrates top management's leadership commitment to the SOMS?

  1. Approving the security budget once a year without further involvement
  2. Attending only the certification audit
  3. Ensuring the security policy and objectives are compatible with strategic direction and integrating SOMS requirements into business processes Correct answer.
  4. Delegating all security responsibility to a junior administrator

Explanation

Leadership requires top management to ensure the policy and objectives align with strategic direction and that SOMS requirements are integrated into the organization's business processes. This is active integration, not symbolic or delegated oversight.

Question 50Security Operations Management System (SOMS)

An organization must decide which security risks are significant enough to require treatment. Which factor is most directly relevant to that decision?

  1. The length of time the organization has held its certification
  2. The seniority of the person who identified the risk
  3. The number of pages in the risk register
  4. The risk criteria and acceptance thresholds defined by top management Correct answer.

Explanation

Whether a risk requires treatment is judged against the organization's defined risk criteria and acceptance thresholds, which reflect its risk appetite. Register size, identifier seniority and certification tenure do not determine significance.