ISO 18788:2015
ISO 18788 requirements for a security operations management system: context and risk criteria, leadership and the Statement of Conformance, human rights risk assessment, competence and communications, use of force and weapons control, vetting and welfare, incident, grievance and whistle-blower handling, audits, management review and improvement.
ISO 18788:2015 is a compliance framework from International with 7 domains and 48 controls. The largest domains are Clause 8: Operation – ISO 18788:2015 (20 controls), Clause 7: Support – ISO 18788:2015 (8 controls), Clause 4: Context of the organization – ISO 18788:2015 (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Clause 10: Improvement – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::10.1 | Deal with nonconformities and take corrective and preventive action |
| iso-18788-2015::10.2 | Continually improve the system, manage change and act on opportunities |
Clause 4: Context of the organization – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::4.1a | Determine and document the internal and external context, and the factors that shape risk |
| iso-18788-2015::4.1b | Map the supply chain and subcontractors and bring their risk into the programme |
| iso-18788-2015::4.1c | Define, document and keep under review the criteria for judging the significance of risk |
| iso-18788-2015::4.2 | Identify stakeholders and their needs, and determine the scope of the SOMS |
| iso-18788-2015::4.4 | Establish, run, maintain and improve the SOMS and keep outsourced processes under control |
Clause 5: Leadership – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::5.1 | Top management leads the SOMS and publishes a Statement of Conformance |
| iso-18788-2015::5.2 | Establish and communicate a security operations policy |
| iso-18788-2015::5.3 | Assign and communicate roles, responsibilities and authorities, including a management representative |
Clause 6: Planning – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::6.1.1 | Run a documented risk assessment process covering threats, vulnerabilities, consequences and human rights |
| iso-18788-2015::6.1.2 | Identify, document and communicate legal and other requirements |
| iso-18788-2015::6.1.3 | Maintain a documented process for risk communication and consultation |
| iso-18788-2015::6.2.1 | Set security operations objectives and plan how to achieve them |
| iso-18788-2015::6.2.2 | Run programmes and a documented risk treatment process |
Clause 7: Support – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::7.1 | Provide resources and meet the structural requirements of a security provider |
| iso-18788-2015::7.2a | Determine competence and identify the competencies and training needs for security tasks |
| iso-18788-2015::7.2b | Deliver competence-based training, measure proficiency and keep the records |
| iso-18788-2015::7.3 | Make people aware of the policy, their contribution, the consequences of nonconformity and their obligations |
| iso-18788-2015::7.4a | Determine and run internal and external communications, including operational communications |
| iso-18788-2015::7.4b | Decide and manage external risk communication, alerts and warnings |
| iso-18788-2015::7.4c | Publish complaint and grievance procedures and communicate the whistle-blower policy |
| iso-18788-2015::7.5 | Create, update and control documented information and records |
Clause 8: Operation – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::8.1a | Plan and control operations, with documented procedures where their absence would cause deviation |
| iso-18788-2015::8.1b | Maintain procedures for performing security functions and for respecting human rights |
| iso-18788-2015::8.1c | Document how undesirable or disruptive events will be prevented and managed |
| iso-18788-2015::8.2 | Establish, communicate and enforce a Code of Ethics |
| iso-18788-2015::8.3a | Establish use of force procedures grounded in authorised rules and reviewed by lawyers |
| iso-18788-2015::8.3b | Authorise personnel to carry weapons only when suitable, vetted and qualified, and in writing |
| iso-18788-2015::8.3c | Apply a use of force continuum consistent with self-defence |
| iso-18788-2015::8.3d | Address less-lethal and lethal force explicitly under the applicable laws of self-defence |
| iso-18788-2015::8.3e | In support of law enforcement, obtain rules for the use of force and apply international principles |
| iso-18788-2015::8.4 | Set procedures for apprehension and search that respect legal limits and dignity |
| iso-18788-2015::8.5 | Perform law enforcement support only as specifically authorised and with additional procedures |
| iso-18788-2015::8.6a | Provide resources, define roles and establish incident and response teams |
| iso-18788-2015::8.6b | Retain competent personnel, screen them, treat them fairly and keep their records |
| iso-18788-2015::8.6c | Control the procurement, storage, use and disposal of weapons, hazardous materials and munitions |
| iso-18788-2015::8.6d | Use uniforms and markings to identify personnel and vehicles, with documented exceptions |
| iso-18788-2015::8.7 | Promote a safe and healthy working environment |
| iso-18788-2015::8.8a | Identify and prepare for undesirable and disruptive events |
| iso-18788-2015::8.8b | Monitor, report and investigate incidents and keep the records for at least seven years |
| iso-18788-2015::8.8c | Operate internal and external complaint and grievance procedures |
| iso-18788-2015::8.8d | Maintain a whistle-blower policy that protects reporters and informs the client |
Clause 9: Performance evaluation – ISO 18788:2015
| Code | Title |
|---|---|
| iso-18788-2015::9.1a | Monitor, measure, analyse and evaluate performance, and keep the records |
| iso-18788-2015::9.1b | Evaluate compliance with legal and other requirements at intervals |
| iso-18788-2015::9.1c | Exercise and test the system at least annually and after significant change |
| iso-18788-2015::9.2 | Run an internal audit programme and act on its findings |
| iso-18788-2015::9.3 | Top management reviews the SOMS at planned intervals with the required inputs and outputs |
What is ISO 18788:2015 and who does it apply to?
ISO 18788:2015 is a compliance framework from International with 7 domains and 48 controls. ISO 18788 requirements for a security operations management system: context and risk criteria, leadership and the Statement of Conformance, human rights risk assessment, competence and communications, use of force and weapons control, vetting and welfare, incident, grievance and whistle-blower handling, audits, management review and improvement. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO 18788:2015 actually require?
ISO 18788:2015 has 48 controls organised across 7 domains. The largest domains are Clause 8: Operation – ISO 18788:2015 (20 controls), Clause 7: Support – ISO 18788:2015 (8 controls), Clause 4: Context of the organization – ISO 18788:2015 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO 18788:2015 do I already cover?
ISO 18788:2015 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ISO 18788:2015?
Start your ISO 18788:2015 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 18788:2015 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 48 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required