Guards, Gates and a Certificate: What the COO's 'SeMS' Is Missing
Northbridge Freight Systems is a third-party logistics provider with 480 staff across two bonded warehouses and a regional control tower. It is bidding for a three-year contract with a consumer-electronics retailer that requires ISO 28000 certification within twelve months. The newly appointed COO, recruited from a military background, has drafted what he calls the 'security management system': a 70-page manual consisting almost entirely of guard-force post instructions, CCTV retention rules and key-holding arrangements. There is no security policy, no risk assessment and no objectives; the only recorded 'risk review' is a list of 14 threats (theft, fire, vandalism, cyber) with no owners, likelihood or impact. The COO has defined the scope as 'protection of Northbridge premises and assets' and intends to exclude the 40 subcontractor carriers that move 70% of customer freight, arguing they are 'third parties outside our control'. He has told the steering group that certification is a tender prerequisite and that the SeMS must not slow down operations.
1. Identify which fundamental SeMS concepts the COO's approach misapplies, and explain the consequence for the intended certification.
Read the worked answer
The core misapplication is category error: ISO 28000 specifies requirements for a management system, not a catalogue of physical security measures. Guards, CCTV and keys are possible risk-treatment controls; they become a SeMS only when they are selected because an assessed risk justified them and are then operated, monitored and improved. Because no risk assessment exists, the 70-page manual has no traceable justification and cannot be shown to be proportionate or complete.
Second, most of the management system is simply absent. A conforming SeMS needs the full cycle: context and interested parties (Clause 4), a top-management security policy and assigned roles (Clause 5), risk assessment, treatment and objectives (Clause 6), competence and communication (Clause 7), operational control (Clause 8), monitoring, internal audit and management review (Clause 9), and nonconformity handling and improvement (Clause 10). A guard manual sits at a fragment of Clause 8 only.
Third, the COO is using a narrow definition of security. ISO 28000 treats security as covering people, information, goods and infrastructure across the supply chain, not just premises. The 14-item threat list shows awareness of cyber and theft but no asset inventory, no vulnerability analysis and no dependencies on upstream and downstream parties.
The consequence is predictable: a Stage 1 audit would find the management system not designed, and Stage 2 could not be recommended. A certificate evidences conformity of a management system, not the presence of a guarding contract.
2. Evaluate the proposed scope statement and the exclusion of the 40 subcontractor carriers. What should Northbridge do instead?
Read the worked answer
The scope is required to be documented and to state the boundaries and applicability of the SeMS. Judged against that, the statement fails on three counts.
First, it is defined by physical location rather than by activity and organisational role. A 3PL's security exposure is mostly in the movement and custody of other people's goods, which the statement does not mention.
Second, excluding 70% of freight movements makes the scope unrepresentative of the business and, more seriously, misleading to the reader of the certificate. The retailer will interpret 'ISO 28000 certified' as covering its own cargo in transit; it will not read the small print of a scope that stops at the warehouse gate.
Third, the reason given is a misunderstanding. ISO 28000 applies to the processes the organisation controls or influences. Northbridge does not have to certify the carriers themselves; it must manage the carrier-management process - risk-based selection, security requirements in contracts, driver and vehicle verification, seal issuance and recording, route and rest-stop planning for high-value loads, tracking, exception and arrival confirmation, incident reporting, performance review and consequences.
Recommended action: restate the scope in activity terms (for example, 'receipt, storage, consolidation and distribution of customer goods, including management of subcontracted linehaul'), define interfaces and dependencies explicitly, and document the justification for any genuine exclusion. Expect the certification body to challenge the scope during Stage 1 and to reflect its own validated wording on the certificate.
3. The COO frames certification as a tender prerequisite and says the SeMS 'must not slow down operations'. What does ISO 28000 require of top management, and what risks does this framing create?
Read the worked answer
Top management cannot delegate the substance of the system to a steering group and a manual. The standard requires top management to establish the security policy and objectives, integrate the SeMS into the organisation's business processes, ensure resources are available, communicate the importance of effective security management, and promote improvement. A policy invented by a consultant and signed off as a marketing asset does not meet that test, because the standard asks for evidence of direction-setting and involvement, not a document.
The framing creates three concrete risks. Commercially, the tender is likely to require more than a certificate: customer questionnaires, contractual security schedules, KPIs and audit rights. A thin system will pass the tender and fail the first customer audit. Certification-wise, an implementation driven by deadline rather than risk typically produces documents without records, which is exactly what Stage 2 tests; the certificate can be suspended or withdrawn at surveillance if the system is not maintained. Operationally, treating security as a brake on operations guarantees workarounds - a warehouse team under pressure will bypass seal recording if the process is not designed into the loading workflow.
The practical advice is to reframe: security controls should be designed into operational processes (loading, dispatch, carrier booking) so that compliance is the path of least resistance, and the business case should be built on loss prevention and contract retention rather than the certificate alone. Certification is then an output, not the objective.