PECB ISO 18788 Lead Implementer study plan

Define a Security Operations Management System (SOMS) in your own words and distinguish it from an ISO 27001 ISMS and an ISO 9001 QMS by listing at least four scope and stakeholder differences

Map the ISO 18788 clause structure (Clauses 4-10) and Annex A control themes into a one-page outline you can redraw from memory

Explain the Plan-Do-Check-Act cycle as applied to a SOMS and identify which clauses sit in each phase

Summarize the core principles behind ISO 18788: human rights due diligence, rule of law, proportionality, and client and community accountability

List the main interested parties for a private security provider (clients, employees, local communities, regulators, insurers) and the expectations each typically holds

Walk through Clauses 4-7 of ISO 18788 and write, for each, the required documented information and who typically owns it

Draft a context analysis for a fictional security company covering internal and external issues, including human rights risk exposure

Produce a stakeholder register with at least eight interested parties, their needs, and how each will be engaged

Define the SOMS scope statement and justify at least three exclusions or boundaries

Draft a leadership commitment statement and a draft policy that reflects the standard's policy requirements

Build a gap analysis against all ISO 18788 clauses and Annex A controls, scoring current maturity on a 1-5 scale

Identify and prioritize risks and opportunities using a documented method, including at least three human rights and use-of-force scenarios

Translate prioritized risks into at least ten objectives with owners, metrics, and target dates

Sequence an implementation roadmap across people, process, technology, and documentation workstreams

Estimate resources (budget, headcount, training hours) needed for the roadmap and flag the top three constraints

Write the core SOMS procedures: risk assessment, use of force, incident reporting and investigation, and human rights due diligence

Design a competence and training matrix covering guards, supervisors, and managers, with required competencies per role

Draft a communication plan covering internal reporting lines, client reporting, and community or grievance channels

Define the documented information control scheme (naming, versioning, retention, access) and apply it to the procedures you wrote

Select at least five Annex A controls and write an implementation statement for each showing how it is operationalized

Complete implementation statements for all Annex A control themes, marking each as implemented, partially implemented, or not applicable with justification

Design a monitoring and measurement plan with at least eight KPIs, each with a formula, data source, frequency, and threshold

Build a draft internal audit program covering scope, criteria, auditor competence, and a one-year schedule

Prepare an audit checklist with at least 20 questions traceable to specific ISO 18788 clauses

Draft a management review agenda and inputs list aligned with Clause 9.3

Run a tabletop internal audit of two clauses using your checklist and record findings with evidence references

Classify findings as major nonconformity, minor nonconformity, observation, or opportunity for improvement, and justify each classification

Write nonconformity reports with root cause analysis using a 5-Why or fishbone approach

Analyze KPI data from a simulated quarter and identify two adverse trends with proposed responses

Produce management review minutes with decisions, actions, owners, and due dates

Write corrective action records tracking each week-6 finding from containment through effectiveness verification

Apply a continual improvement model to identify three improvement opportunities and rank them by impact and effort

Assemble the certification audit evidence pack, mapping each clause and Annex A theme to its objective evidence

Prepare opening meeting talking points and a Stage 1 versus Stage 2 readiness checklist

Anticipate the ten most likely auditor questions and draft concise, evidence-backed answers

Conduct two full timed mock exams (at least 80 questions each) and score them, logging every missed topic

Re-study your three weakest domains using the missed-topic log and rewrite summary notes for each

Recite the ISO 18788 clause structure and Annex A themes from memory in under five minutes

Simulate a 30-minute certification interview with a peer or self-recording, covering policy, risk, and use of force

Finalize a post-certification continual improvement calendar covering audits, reviews, and KPI refresh cycles