Fundamental principles and concepts of an SeMS
What the exam tests
Domain 1 tests whether you can describe a security management system (SeMS) as a management system for supply-chain security, not as a guard-force contract. ISO 28000:2022 is the requirements standard; it follows the harmonized structure in clauses 4–10 and the Plan–Do–Check–Act cycle. ISO 28001 provides best-practice guidance for supply-chain security assessments and plans, ISO 28003 sets requirements for certification bodies, and ISO 28004 gives implementation guidance. The exam expects you to distinguish requirements from guidance.
Core rules and concepts
- An SeMS is a set of interrelated elements used to establish security policy and objectives and to achieve those objectives. It covers governance, risk, operations, performance evaluation and improvement.
- Security scope is broader than physical protection: people, assets, information, processes, reputation and supply-chain interfaces can be in scope.
- ISO 28000 is risk-based and process-based. It requires context analysis, interested-party needs, scope definition, leadership, planning, support, operation, evaluation and improvement.
- The standard does not prescribe a fixed control catalogue. You select controls from risk assessment results, legal and contractual obligations, and business needs.
- Certification is against ISO 28000 requirements, not against a specific cargo-screening technology or a national programme.
Worked example
A freight forwarder wants to reduce cargo theft. It defines the SeMS scope as its own warehouse, carrier selection and customer handover, excluding customs brokerage. It identifies customers, insurers, carriers and regulators as interested parties, then assesses theft and tampering risks. The output is a risk treatment plan with access control, seal verification and carrier qualification. That is an ISO 28000-style approach: scope and risk drive controls.
Traps that cost marks
Treating SeMS as only physical security; copying an ISO 27001 information-security scope without adapting it; assuming ISO 28000 mandates specific guards, cameras or scanners; and confusing ISO 28001 guidance with ISO 28000 requirements.