Security Management System Requirements
This domain tests whether you know the requirements an ISO 28000:2022 audit is measured against, clause by clause, and whether you can recognise conforming and nonconforming evidence.
The clause map
- Clause 4 Context: internal and external issues, interested parties and their requirements, the scope of the SMS, and the SMS as interrelated processes.
- Clause 5 Leadership: commitment, the security policy, and assigned roles, responsibilities and authorities.
- Clause 6 Planning: actions to address risks and opportunities, security risk assessment and treatment, and measurable security objectives with plans to achieve them.
- Clause 7 Support: resources, competence, awareness, communication, and documented information - creation, updating, control.
- Clause 8 Operation: operational planning and control, including outsourced and contracted security processes.
- Clause 9 Performance evaluation: monitoring, measurement, analysis and evaluation; internal audit; management review with defined inputs and outputs.
- Clause 10 Improvement: nonconformity and corrective action, and continual improvement.
What good risk assessment evidence looks like
A credible assessment names the threat source, the vulnerability, likelihood and consequence, the resulting risk level against defined criteria, the treatment chosen, the residual risk accepted by someone with authority, and the review date. A list of assets is not a risk assessment.
Worked example
An organization shows a spreadsheet of 40 'risks' that are really asset names, with no ratings or owners. The auditor's reasoning: Clause 6 requires risks to be assessed so treatment and objectives can be planned. Without criteria and rating, neither treatment priority nor objective setting can be justified. Nonconformity against Clause 6, evidenced by the spreadsheet and the absence of any treatment plan.
Traps
Accepting a policy document as proof of leadership; treating a management review meeting as sufficient without outputs and decisions; confusing internal audit with routine monitoring; and missing that outsourced security processes must still be controlled.