Security Operations Management System (SOMS)
What the exam tests
This domain tests your grasp of the mandatory requirements and how clauses interlock. You must map a real security operation to the standard’s clause structure and identify gaps.
Core rules and concepts
- Clause 4 Context: determine external and internal issues, interested parties, scope, and establish the SOMS.
- Clause 5 Leadership: top management commitment, policy, and roles. The policy must commit to legal compliance, human rights, and the rules for use of force.
- Clause 6 Planning: actions to address risks and opportunities, security objectives, and planning of changes.
- Clause 7 Support: resources, competence, awareness, communication, and documented information.
- Clause 8 Operation: operational planning and control, client contracts, supply chain control, incident management, and use of force.
- Clause 9 Performance evaluation and clause 10 Improvement close the loop through monitoring, audit, review, nonconformity, and corrective action.
Worked example
A client asks for armed guarding at a port. Map the request to clause 8: confirm legal authorization, assess human rights risk, define rules for use of force, verify guard competence, set incident reporting, and review the client contract. Clause 6 must be updated if the risk assessment changes. Clause 7 ensures training and communication. Reasoning: the request is not only a deployment decision; it triggers planning, support, and operational controls.
Traps
Omitting supply chain and subcontractor controls is a common error. Treating the client as the only interested party misses regulators, communities, and employees. A policy without a human rights commitment is nonconforming. Do not treat “risk” as threats only. Do not assume documented procedures alone satisfy operation; evidence of control matters.