PECB ISO 28000 Foundation study plan

Define security management and the security management system (SeMS) in your own words, distinguishing it from occupational safety and from physical guarding alone

Explain why a supply-chain-wide, risk-based approach differs from site-by-site security controls, using one concrete logistics or manufacturing scenario

Map the Plan-Do-Check-Act cycle onto a security management system and state what happens in each phase

List the core vocabulary of ISO 28000 (security risk, threat, vulnerability, interested party, control, performance) and write a one-sentence definition for each

Identify the benefits an organization can claim from an SeMS: resilience, stakeholder confidence, contractual eligibility, continual improvement

Explain how ISO 28000 relates to the ISO High-Level Structure shared by ISO 9001, ISO 14001 and ISO 45001, and what that alignment buys an integrator

Differentiate ISO 28000 from ISO 28001, ISO 28002, the ISO 31000 risk family and the TAPA/CTPAT-style schemes without confusing their scopes

Describe the role of interested parties (customers, regulators, insurers, carriers, employees) in shaping security requirements

Trace how security risk assessment output feeds the selection of controls and the setting of objectives

Argue for and against certifying an SeMS versus self-declaring conformity, listing two arguments each

Read Clause 4 and Clause 5 of ISO 28000 and annotate each sub-clause with a plain-language summary

Distinguish internal and external issues relevant to the SeMS and give three examples of each for a freight forwarder

Explain the difference between interested-party needs and legally binding compliance obligations

Describe what a security management system scope statement must contain and what may legitimately be excluded

Explain top management's specific obligations: policy, integration into business processes, resources, communication and review

Explain the risk-based planning requirements of Clause 6, including how threats and vulnerabilities are identified and evaluated

Distinguish risk criteria, risk treatment options and residual risk acceptance

Write three security objectives that are measurable and time-bound, each tied to a specific risk

Describe the role of change management in planning and what triggers a re-assessment

Explain how legal, regulatory and contractual security requirements are identified, accessed and kept current

Explain the difference between support (Clause 7) and operation (Clause 8) and why the split matters in an audit

Describe competence, awareness and communication requirements and who must be covered by each

Explain documented information control: what must be created, what must be retained, and how version and access control work

Describe operational planning and control, including control of outsourced processes and contractors

Explain why security controls must be applied consistently across the supply chain rather than only at owned sites

Explain the monitoring, measurement, analysis and evaluation requirements of Clause 9, including what indicators are useful for security performance

Distinguish internal audit from management review in purpose, input and output

Draft an internal audit checklist covering Clauses 4 to 10 with at least two questions per clause

Describe the inputs and outputs of management review and how decisions are tracked to closure

Explain how security incidents and near misses are handled as part of performance evaluation

Explain Clause 10 requirements for nonconformity, corrective action and continual improvement

Distinguish correction, corrective action and preventive thinking, and give an example of each from a security context

Perform a root-cause analysis on a plausible security nonconformity and record the resulting action

Describe how lessons learned and incident trends feed back into risk assessment and objectives

Identify the most common reasons an SeMS fails to improve after certification

Rehearse the clause-to-concept mapping: for each of Clauses 4 to 10, state which Domain 1 principle it operationalizes

Complete two timed practice sets weighted 50/50 across the two domains and review every wrong answer against the source text

Explain the certification lifecycle (application, stage 1, stage 2, surveillance, recertification) and what an auditor samples at each stage

Close remaining knowledge gaps by re-reading the two weakest clauses and rewriting your own summary of each

Build a one-page pre-exam recall sheet of definitions, clause numbers and key distinctions