Planning a SOMS implementation based on ISO 18788
What the exam tests
This domain tests project-level implementation planning: mandate, scope, gap analysis, governance, resources, risk, sequencing, and communication. It asks how to move from a decision to implement ISO 18788 to an auditable system.
Core rules and concepts
- Secure top-management sponsorship and define who owns the implementation. A security manager alone cannot implement a management system.
- Define the SOMS scope carefully: sites, services, contracts, subsidiaries, and exclusions must be justified.
- Perform a gap analysis against ISO 18788 clauses and against legal, client, and human rights requirements.
- Build a roadmap with phases: context and scope, risk assessment, policy and objectives, support processes, operational controls, measurement, internal audit, management review, and certification preparation.
- Identify resources, competence needs, budget, and external expertise early.
- Communicate with employees, clients, subcontractors, and relevant authorities; plan for resistance and contractual constraints.
Worked example
A guarding company with 1,200 staff in three countries plans implementation. A strong plan starts with a baseline gap analysis and a legal register per country, then prioritizes high-risk contracts for pilot controls. Policy and risk assessment come before procedure writing. Training and communication follow. Internal audit and management review are scheduled before the certification audit. Reasoning: sequencing prevents documenting controls that do not fit the legal or contractual reality.
Traps
Writing procedures before understanding context and risk leads to generic documentation. Assigning implementation only to the security department weakens cross-functional support. Ignoring client contract requirements creates audit findings. Over-documenting slows the project; focus on evidence and control. A plan without measurement baselines cannot show improvement.