Implementation of an SeMS based on ISO 28000
What the exam tests
Implementation puts clause 7 support and clause 8 operation into practice. The exam tests whether you can turn plans into controlled processes, competent people, controlled information and evidence that the SeMS operates, not just exists.
Core rules and concepts
- Implement operational planning and control for security-critical processes: access, screening, escorting, seal control, monitoring, incident response, investigations and recovery interfaces.
- Flow requirements to suppliers, carriers and outsourcers through contracts, pre-qualification, security requirements, performance monitoring and escalation.
- Provide resources, competent people, awareness and communication. Training records alone do not prove competence; define what a person must be able to do.
- Control documented information: approval, version, distribution, availability, backup, retention and protection. Avoid unnecessary documents that no one uses.
- Manage change: new routes, systems, sites, subcontractors or threat levels should be assessed and controlled before implementation.
- Keep operational evidence: logs, inspection records, access reviews, incident reports, supplier assessments and management dashboards.
Worked example
A retailer introduces a carrier pre-qualification process. Procurement sends a security questionnaire, checks insurance and past incidents, adds seal and route-deviation clauses to the contract, and schedules annual reviews. Warehouse staff are trained to reject mismatched seals. The SeMS team samples five carriers and finds two missing contract clauses; it opens corrective actions. This shows implementation, monitoring and control rather than a policy on a shelf.
Traps that cost marks
Writing procedures with no operating evidence; treating attendance at awareness training as competence; leaving outsourced processes uncontrolled; failing to flow security requirements down the supply chain; and implementing technology before defining the process and owner.