Planning of an SeMS implementation based on ISO 28000
What the exam tests
Planning covers ISO 28000 clause 6: actions to address risks and opportunities, and security objectives. The exam tests whether you can move from context and baseline to a defensible risk treatment plan and measurable objectives, rather than a list of wished-for controls.
Core rules and concepts
- Define a risk assessment methodology before assessing: asset/process identification, threat and vulnerability analysis, consequence and likelihood scales, risk criteria and acceptance thresholds.
- Assess both risks and opportunities. Opportunities can include consolidated carrier contracts, improved visibility technology or supplier collaboration.
- Treat risk by avoiding, reducing, transferring or accepting it. Record the selected treatment, owner, deadline, resource and expected residual risk.
- Build a risk treatment plan that links each control to a risk and to a legal, contractual or business requirement. Avoid controls with no traceability.
- Set security objectives that are specific, measurable, achievable, relevant and time-bound, with responsible persons and evaluation methods.
- Plan changes: new sites, routes, carriers, systems or threats should trigger reassessment.
Worked example
A warehouse identifies insider theft at the loading dock. Likelihood is rated 4 and impact 5 on a 5-point scale, giving a score of 20, above the acceptance threshold of 12. Treatment combines segregation of duties, random bag checks, CCTV retention and a carrier seal log. Residual risk is estimated at 8, with the security manager accountable and a 90-day completion date. A matching objective is to reduce recorded shrinkage by 30% within 12 months.
Traps that cost marks
Producing a risk register with no treatment plan; using vague objectives such as improve security; treating risk assessment as a one-off workshop; ignoring opportunities; and selecting controls because they are familiar rather than because they address the assessed risk.