Fundamental concepts and principles of security management and an SeMS based on ISO 28000
What the exam tests
This domain checks whether you can explain security management as a management discipline, not a guard-service checklist. You need to define a security management system (SeMS), describe the purpose and benefits of ISO 28000, and apply principles such as risk-based thinking, process approach, leadership, and continual improvement.
Core rules and concepts
- Security management is coordinated activity to direct and control an organization with regard to security. A SeMS is a set of interrelated elements used to establish security policy and objectives and the processes needed to achieve them.
- ISO 28000 is a certifiable management system standard built on the harmonized structure, so it shares clause 4–10 logic with ISO 9001, ISO 14001, and ISO 27001.
- The standard is risk-based: identify security risks, assess likelihood and consequence, treat them to an acceptable level, and monitor whether controls work.
- Context and interested parties matter: legal, regulatory, contractual, customer, insurer, and community expectations shape the SeMS.
- PDCA underpins the standard: Plan (context, leadership, planning), Do (support, operation), Check (performance evaluation), Act (improvement).
- Security is broader than physical protection; it includes people, information, premises, transport, and supply-chain processes.
Worked example
A logistics firm faces cargo theft. It does not simply buy more cameras. It defines the SeMS scope as two warehouses and road transport, identifies customers, insurers, and customs as interested parties, and assesses theft risks at loading docks and through insider collusion. It sets a measurable objective, introduces carrier vetting and segregation of duties, monitors incidents monthly, and updates controls after an attempted theft. The reasoning: the camera purchase would be a control, but ISO 28000 requires the context, risk assessment, objective, operational control, monitoring, and improvement loop around it.
Traps
Do not equate ISO 28000 with IT security or physical guarding only. Do not write a policy without top-management ownership, omit legal/contractual requirements, treat risk assessment as a one-off paper exercise, or claim that the standard applies only to large multinational supply chains. Avoid confusing security with occupational safety.