SeMS as a binder at Meridian Cold Chain
Meridian Cold Chain operates four temperature-controlled warehouses handling pharmaceuticals and food, with 220 staff and about 600 pallet movements per day. It already holds ISO 9001 and ISO 27001. The board approved an ISO 28000 project, and a consultant produced a 300-page security manual copied from a template, a policy signed by the CEO, and a risk register listing theft, fire and cyber with no scoring method. The operations director calls the SeMS the security team's binder; line managers are not involved. In the last six months there were three cargo tampering attempts, two unauthorized entries to the cold store, and one insider theft of high-value vaccines. The consultant proposes a separate SeMS team and separate monthly meetings to avoid mixing systems. The certification audit is in five months.
1. The consultant says the SeMS should be kept separate from ISO 9001 and ISO 27001 to avoid contamination. Using fundamental SeMS principles, evaluate that advice and explain how Meridian should integrate the system.
Read the worked answer
The advice is wrong because it treats the SeMS as a document set rather than a management system. The incidents did not occur in a binder; they occurred in receiving, access control, dispatch and HR processes. A functioning SeMS is risk-based, uses a process approach, follows Plan-Do-Check-Act, and is integrated into the organization's business processes. Separating it would isolate security from the people who control the risks and would duplicate governance.
Integration does not mean identical documentation. Meridian can keep a security-specific risk assessment method while using the same document control, internal audit programme, management review, competence records and corrective action process already used for ISO 9001 and ISO 27001. The process approach means mapping where security controls belong: supplier approval, warehouse entry, picking, chain of custody, incident reporting and disciplinary processes. PDCA means setting security objectives, implementing controls, monitoring indicators such as tampering attempts and badge exceptions, and improving when results show gaps.
Interested parties such as pharmaceutical customers, insurers and regulators impose security requirements that must shape the scope and objectives. A separate SeMS team would weaken the leadership integration that Clause 5 requires.
2. What should Meridian reuse from its existing management systems, and what must be newly developed for security? Justify each choice against the incidents described.
Read the worked answer
Meridian should reuse the ISO 9001 and ISO 27001 governance machinery: document control, internal audit scheduling, management review, training and competence records, nonconformity and corrective action, and supplier management. These are mature and avoid three parallel systems. It should also reuse the ISO 27001 information security risk method as a starting point for cyber-related threats.
New development is needed where the incidents exposed gaps. First, a security risk assessment that covers physical threats, insider threat and supply chain handling, not just generic categories. The tampering attempts and unauthorized cold-store entries show that vulnerability analysis was missing. Second, security objectives and performance indicators, because the current manual does not measure whether controls work. Third, operational controls for access, key control, chain of custody and tamper-evident sealing in the warehouses. Fourth, an incident reporting and investigation process, because insider theft requires confidential reporting and root-cause analysis. Fifth, supplier and contractor security requirements, since agency or transport staff may be involved.
The test is not whether a document exists but whether it changes behaviour at the loading dock and the cold-store door. Reusing governance and adding operational security controls addresses both.