Initiation of an SeMS implementation
What the exam tests
Initiation is the pre-project phase: obtaining mandate, defining the SeMS boundary and building the implementation case. ISO 28000 clause 4 (context, interested parties, scope) and clause 5 (leadership) are central. The exam tests sequence: commitment before documentation, scope before gap analysis, gap analysis before detailed planning.
Core rules and concepts
- Secure top-management sponsorship and a written mandate. The sponsor approves scope, budget, steering arrangements and escalation paths.
- Analyse context: business model, locations, cargo flows, regulatory environment, threat landscape and existing security arrangements.
- Identify interested parties and their requirements: customers, insurers, carriers, employees, regulators, unions, communities and partners.
- Define scope precisely: organizational units, sites, processes, supply-chain interfaces and exclusions with justification. Avoid a scope drawn only to make certification easy.
- Run an initial gap analysis against ISO 28000 clauses 4–10. Record evidence, not opinions, and rate gaps by risk and effort.
- Establish governance: project board, SeMS manager, process owners, working groups, budget and a milestone plan.
Worked example
A manufacturer has three plants and uses 3PL warehouses. Its mandate covers all outbound distribution. Gap analysis finds no supplier security clauses and no documented risk method. The project board prioritizes supplier clauses and a risk method before writing procedures. This order is defensible because clause 6 planning depends on a valid scope and a real baseline.
Traps that cost marks
Starting with a document set; assigning the project only to the security department; writing a scope that excludes key interfaces; treating gap analysis as a certification audit; and promising a certificate date before capability is assessed.