Fundamental Principles and Concepts of a Security Management System
In this domain the exam tests whether you can explain what a security management system is under ISO 28000:2022, what 'security' means in that standard, and how risk-based thinking and the process approach hold the system together. Expect questions that ask you to distinguish concepts rather than recite clause numbers.
What ISO 28000 actually is
ISO 28000:2022, Security and resilience - Security management systems - Requirements, is a certifiable requirements standard built on the harmonized structure shared by ISO management system standards. Its 2007 predecessor was written narrowly for supply chain security; the 2022 edition applies to any organization and treats security broadly - physical, human, information and cyber, and supply chain security can all sit inside one SMS.
Security versus safety
Security addresses protection against intentional, malicious acts: theft, fraud, sabotage, insider threat, intrusion, terrorism. Safety addresses unintentional harm. A warehouse fire started by faulty wiring is a safety event; the same fire started deliberately is a security event. The risk assessment follows from that distinction.
Principles that run through the standard
- Top management accountability: the security policy is issued by top management, not by the security function.
- Risk-based thinking: controls exist because a documented risk assessment justified them, not because they are customary.
- Process approach and continual improvement: plan, do, check, act.
- Context and interested parties: legal, regulatory, contractual and societal obligations shape the scope.
Worked example
An auditor is told 'our security management system is our CCTV and access control.' The reasoning that earns marks: those are controls, not a system. Evidence of a system would be a scope statement, a security policy, a documented risk assessment naming threats and vulnerabilities, treatment decisions linked to the controls, measured performance, and a management review.
Traps
Treating ISO 28000 as a cyber-only or port-only standard; confusing it with ISO 28001 or ISO 28004, which contain no certifiable requirements; and accepting a list of controls as evidence of a management system.