PECB ISO 28000 LI study plan

Map the structure of ISO 28000 clause by clause (scope, normative references, terms, context, leadership, planning, support, operation, performance evaluation, improvement) and label which exam domain each clause cluster feeds

Define and distinguish security management system (SeMS) vocabulary: security policy, security risk, security objective, interested party, threat, vulnerability, consequence, control, resilience, supply chain security, and security performance

Explain how ISO 28000 relates to the ISO management system high-level structure and to ISO 31000 risk principles and ISO 28001/28002/28003 guidance documents without conflating their scopes

Distinguish security management from related disciplines (physical security, information security under ISO 27001, quality, occupational health and safety) and articulate where they overlap and diverge

Identify the PDCA cycle positions of each ISO 28000 clause group and explain why continual improvement is embedded rather than appended

Explain the principle of risk-based thinking in ISO 28000 and how it drives scope decisions, objectives, and controls rather than being a one-off document

Describe the inputs a Lead Implementer must gather before initiating an SeMS: organizational context, legal and regulatory obligations, contractual security requirements, existing security arrangements, and prior incidents

Produce a gap analysis approach comparing current security practices against ISO 28000 requirements, including how to rate gaps by severity and effort

Draft a business case for SeMS implementation covering drivers, benefits, resource needs, risks of inaction, and alignment with organizational strategy

Identify the roles of top management, the SeMS manager, process owners, and internal audit in an implementation programme and describe their accountabilities

Define the SeMS scope boundary, including physical locations, business units, supply chain interfaces, and outsourced activities, and justify inclusions and exclusions

Write a security policy statement aligned with the organization's strategic direction that commits to satisfying requirements and continual improvement

Construct a project plan for SeMS implementation with phases, dependencies, owners, and a realistic timeline that sequences risk assessment before control selection

Plan the communication and awareness campaign needed to secure buy-in from operational staff, contractors, and logistics partners

Establish the documented information framework: which documents are mandatory, which are discretionary, and how version control and retention will work

Apply a recognized risk assessment methodology to build a security risk register that captures assets, threats, vulnerabilities, likelihood, impact, and inherent versus residual risk

Perform a threat and vulnerability assessment for at least two realistic scenarios (for example cargo theft at a warehouse and a cyber-physical intrusion at a distribution hub) and document the reasoning

Evaluate risk treatment options (avoid, reduce, transfer, accept) and select controls with a written justification and a named risk owner for each accepted risk

Define security objectives that are measurable, monitored, and traceable to significant risks, and state what evidence would prove each objective is met

Identify legal, regulatory, and contractual security obligations applicable to the organization and map each to the SeMS process that addresses it

Build the risk treatment plan and translate it into operational controls covering access control, perimeter and asset protection, personnel security, contractor management, incident response, and supply chain partner requirements

Write competence, training, and awareness requirements for security-critical roles and specify how competence will be verified and recorded

Design the operational planning and control process, including criteria for outsourced processes and how supplier security performance will be monitored

Establish the emergency preparedness and response arrangements, including drills, and define how lessons from drills feed back into risk assessment

Create the monitoring and measurement plan specifying what is measured, how often, by whom, and against which target

Implement the documented information set: procedures, work instructions, registers, and records, and verify each satisfies the corresponding ISO 28000 requirement

Run a tabletop exercise or walkthrough of an actual security process and record observations against the designed procedure

Design the internal audit programme, including audit criteria, scope, frequency, auditor competence and independence, and the audit report format

Prepare the management review inputs and agenda required by the standard and specify what decisions and outputs the review must produce

Define the performance evaluation approach: leading and trailing security indicators, incident analysis, nonconformity handling, and corrective action workflow

Analyze a set of simulated security incidents and nonconformities, determine root causes, and write corrective actions that address cause rather than symptom

Evaluate whether corrective actions were effective and describe how effectiveness evidence is retained

Identify opportunities for continual improvement from audit findings, incident trends, management review outputs, and changes in the threat landscape

Distinguish correction, corrective action, and improvement, and explain why the standard requires improvement to be planned rather than reactive

Assess how changes to the organization's context, supply chain, or legal obligations trigger updates to the risk assessment and the SeMS itself

Explain the certification audit process: application and contract review, stage 1 documentation and readiness review, stage 2 implementation effectiveness audit, surveillance audits, and recertification

Prepare the evidence pack for a stage 1 and stage 2 audit, including scope, policy, risk register, treatment plan, internal audit results, management review minutes, and corrective action records

Anticipate auditor questions on risk assessment rigour, control effectiveness, and objective evidence, and rehearse concise answers with clause references

Identify common reasons certification audits fail or raise major nonconformities in SeMS implementations and describe preventive actions

Complete a timed mock exam across all seven domains and review every wrong answer back to the source clause