ISO 28000 requirements for a security management system - Clauses 4 to 10
What the exam tests
This domain tests clause-by-clause requirements. You must know what each clause demands and what evidence an auditor would look for, not just the definitions.
Core rules and concepts
- Clause 4 Context requires determining external and internal issues, interested parties and their security requirements, the SeMS scope, and the establishment of the SeMS.
- Clause 5 Leadership requires top management commitment, a security policy, and assigned roles, responsibilities, and authorities.
- Clause 6 Planning covers actions to address risks and opportunities at system level, measurable security objectives, and planning of changes. Security risk assessment and treatment are operational requirements in Clause 8.
- Clause 7 Support covers resources, competence, awareness, communication, and documented information.
- Clause 8 Operation requires operational planning and control, security risk assessment, and security risk treatment.
- Clause 9 Performance evaluation covers monitoring, measurement, analysis and evaluation, internal audit, and management review.
- Clause 10 Improvement covers nonconformity and corrective action, and continual improvement.
Worked example
A port terminal prepares for certification. Clause 4 identifies port authority rules and customer contracts. Clause 5 has the CEO sign the security policy and appoint a chief security officer. Clause 6 sets an objective to reduce unauthorized access incidents by 30% in a year. Clause 7 trains gate staff and controls procedures. Clause 8 implements badge access, patrols, carrier checks, and quarterly risk assessments. Clause 9 tracks access incidents, audits, and reviews. Clause 10 corrects recurring badge-reader failures and updates maintenance. The reasoning: each clause must leave evidence, not just intent.
Traps
Common marks are lost by treating Clause 6 as the only place for risk assessment, setting objectives without measures, not communicating the policy, letting internal auditors audit their own work, holding management reviews without required inputs, and correcting only symptoms instead of root causes. Also avoid an uncontrolled scope that excludes key activities, and remember that top management cannot delegate all leadership to a security manager.