Fundamental principles and concepts of a Security Operations Management System (SOMS)
What the exam tests
This domain checks whether you can explain ISO 18788 as a management system standard for security operations, not as a tactical security plan. Expect questions on the SOMS model, risk-based thinking, human rights, legal compliance, and the process approach.
Core rules and concepts
- A SOMS is a set of interrelated processes that directs security operations toward intended outcomes; it follows the Plan-Do-Check-Act cycle and the Annex SL high-level structure.
- ISO 18788 is written for organizations that provide security operations, including guarding, protection of people and assets, and related services. It can also apply to organizations that contract such services.
- Security risk is assessed in terms of threat, vulnerability, and consequence; the SOMS treats risk and opportunity, not only threats.
- Human rights due diligence is central: the organization must identify, prevent, mitigate, and account for human rights impacts linked to its operations.
- Legal and other requirements include national use-of-force law, licensing, labor law, and client contract terms.
- Leadership, competence, awareness, and documented information are enabling conditions, not paperwork.
Worked example
A guarding provider wins a contract in a new country. The exam may ask what to do first. The best answer is not “write a post order.” It is to review the context: legal use-of-force rules, licensing, local labor conditions, client requirements, and human rights risks. Then update the risk assessment, rules for use of force, training, contract clauses, and incident reporting. Reasoning: the SOMS must adapt to the new legal and human rights context before deployment.
Traps
Do not reduce the SOMS to a security plan. Do not ignore human rights or treat them as a public-relations add-on. Do not confuse security risk with occupational health and safety risk. Do not assume a certificate proves operational effectiveness.