Port Authority Clause Mapping Is Not a Transition
Northgate Port Authority holds an ISO 28000:2007 certificate covering container terminal security. The certificate expires in 14 months. The security director's gap analysis against ISO 28000:2022 concludes that only the clause numbers need changing: the existing 22-page security manual, approved by the harbour master in 2019, has been mapped to the new clauses. The manual policy states that the terminal will prevent unauthorised access and cargo theft. The board has not discussed security since 2021; the security director reports to the operations manager. The port is expanding into cruise passenger handling and a new rail link, but neither appears in any security document. The customs authority and a cruise line have asked for assurance. The security director wants to issue the old manual as the 2022 system and 'fix the wording later'.
1. Evaluate whether the clause-mapping gap analysis is adequate for transition. Cite the specific 2022 requirements that the analysis misses and explain the risk of issuing the old manual.
Read the worked answer
The gap analysis is inadequate. A clause map only proves that document sections can be cross-referenced; it does not produce the evidence required by ISO 28000:2022. The analysis misses clause 4.1 (external and internal issues relevant to the port's purpose, including legal, regulatory, physical, technological and supply-chain factors), 4.2 (relevant interested parties and their requirements), 4.3 (a documented scope), 5.1 (top management integration of security into business processes) and 5.2 (a policy with commitments to satisfy applicable requirements and continual improvement). It also misses 6.1.2 and 6.1.3, because the cruise and rail expansion changes the risk profile. Issuing the old manual risks a transition nonconformity: the policy is narrow, the scope is undocumented, there is no context or interested-party evidence, and the manual does not show risk-based planning. An auditor will ask for records, not a renumbered manual.
2. What changes to policy, leadership and context analysis should be completed before a transition audit, and what evidence should exist?
Read the worked answer
Top management should approve a policy appropriate to the port's purpose and provide a framework for security objectives. The policy should commit to satisfying applicable requirements and to continual improvement, and should be available as documented information. Leadership must show that security is integrated into business processes, that roles and authorities are assigned, and that resources are provided. The board should have minutes demonstrating oversight. Context analysis should identify external and internal issues, including the cruise terminal, rail interface, customs rules, insurers, labour relations and subcontractors. An interested-party register should record the customs authority, cruise line, employees, unions, insurers and regulators, with their relevant requirements. The scope statement should describe boundaries and interfaces. Evidence should include a signed policy, board minutes, context and interested-party registers, a documented scope, communication records and a risk assessment covering the new operations.
3. How should the port handle the cruise and rail expansion in the SMS scope and risk assessment?
Read the worked answer
The expansion cannot be ignored. Clause 4.1 requires the organization to determine issues that affect the SMS, and clause 4.3 requires a scope that reflects activities, products, services and interfaces. The cruise terminal brings public access, different threat actors, passenger screening, baggage handling and new regulatory interfaces; the rail link creates a landside interface and new logistics flows. The port should either include these activities in scope or explicitly exclude them with justification and show how interface risks are controlled. Under 6.1.2, the risk assessment should identify new security risk sources, events, consequences and likelihood, and evaluate them against documented criteria. The risk treatment plan under 6.1.3 should assign owners, resources, dates and evaluation methods. Excluding the expansion while claiming a terminal-wide scope would be misleading and difficult to defend at audit.