Security management responsibilities
Assign clear responsibilities so personnel understand the security management system activities connected with their roles and the security of assets, people and operations.
SECURITY MANAGEMENT SYSTEM • ISO 28000:2022
ISO 28000 Certification in UAE & Dubai
Independent certification of a Security Management System against ISO 28000:2022, with a defined scope covering the organization’s relevant activities, processes, locations, security controls and supply-chain interfaces.
ISO 28000:2022
Defined Security Management System scope
Independent assessment
ISO 28000
Security Management System
CERTIFICATION SCOPE
Controlled security management system.
Controlled security management system.
Consistent security operations.
A practical security management system connects personnel, premises, operations, security controls, documentation, transport and logistics.
ISO 28000 • SECURITY MANAGEMENT SYSTEM
Security Management System built around security operations.
ISO 28000 provides practical security management system guidance for the operations, control, transport and logistics of security-related activities.
WHAT IS ISO 28000?
ISO 28000 certification gives organizations managing security risks in the UAE a clear security management system framework.
ISO 28000:2022 is the current international standard for Security Management Systems within the ISO security and resilience family. It provides a common management-system approach for organizations managing security risks, including security aspects relevant to supply-chain activities.
For an organization in Dubai, Abu Dhabi or another UAE emirate, the certification scope can be defined around the services and operations, security activities, facilities and Security Management System processes that are actually assessed. The system can address personnel competence and awareness, facilities, operational controls, incident management, documented information, transport, logistics and relevant supply-chain interfaces.
ISO 28000:2022
was last reviewed and confirmed by ISO in 2022 and remains the current published edition.
ISO states that the standard is not applicable to research and development activities or
the distribution of finished services and operations.
ISO 28000 IN PRACTICE
Build security management around the way the organization actually works.
ISO 28000 is practical when security management controls follow the real movement of people, assets, information, equipment and services through the organization. The purpose is to establish a structured approach for identifying security-related risks, applying controls and reviewing performance within the defined Security Management System.
For a UAE organization, that may include access to facilities, protection of assets and information, contractor and visitor controls, transport interfaces, warehousing, cargo handling, supplier activities, incident reporting and response. The relevant controls depend on the organization’s context, security risks, legal and contractual commitments and certification scope.
ISO 28000 is not limited to one industry. ISO states that the standard can be applied to all types and sizes of organizations and is not industry or sector specific. A logistics operator may focus on cargo security and transport interfaces, while an industrial organization may place greater emphasis on facility access, asset protection, contractors and operational security controls.
The Security Management System should therefore reflect the organization’s actual activities, locations, people, processes and security context. Certification assesses the system against the applicable ISO 28000 criteria within the agreed scope, using objective evidence from relevant operations.
Personnel and security awareness
Establish practical arrangements for personal security awareness, training and conduct that support controlled security management operations.
Premises and equipment
Keep premises, equipment and working areas suitable for the activities performed and maintain them so that operations remain controlled.
Operational security control
Control materials, operational stages, access control, monitoring and incident records so that security activities are performed consistently.
Security controls
Use defined security control activities and records to support decisions about materials, services and operations and managing results within the agreed scope.
Security records and documented information
Maintain suitable procedures, records and security records and incident information so relevant security management system activities can be understood and supported by objective evidence.
ISO 28000 IMPLEMENTATION GUIDE
Build the Security Management System around the organization’s actual operations.
ISO 28000 implementation should connect security management practices with actual security-related activities, processes, facilities and responsibilities. A practical approach makes the controls usable by operations and security teams and leaves clear evidence for certification assessment.
Confirm the service and operational scope
Identify security-related activities, security services and operations, security activities, facilities and processes included in the intended certification scope.
Review current security management system practices
Compare existing operations, security, security awareness, documentation, transport and logistics practices with the applicable ISO 28000 guidance.
Map the security activity flow
Follow assets and security-related services through receiving, processing, freight handling and dispatch, security controls, transport and logistics so responsibilities and controls are clear.
Control facilities and operations
Establish practical controls for premises, equipment, cleaning, materials, operations activities and other security management system processes relevant to the activity range.
Build competence and security awareness
Ensure personnel understand their Security management responsibilities, security awareness and conduct, work methods and the records associated with their activities.
Review, audit and improve
Use internal review, incident reporting, security information, audit findings and corrective actions to keep the security management system effective as activities and security contexts change.
UAE BUSINESS CONTEXT
Keep the certification scope aligned with the actual security operation.
Organizations managing security risks in Dubai, Abu Dhabi and other UAE emirates may operate through security facilities, laboratories, warehouses, access-controlled areas, dispatch and logistics operations and external service providers. The certification scope should accurately describe the activities and locations intended for assessment.
See the certification process
THE FOUNDATION OF ISO 28000
Core security management practices for controlled security operations.
ISO 28000 brings together practical security management system activities that support the security aspects of security operations, transport, logistics and supply-chain interfaces. The way those activities are applied depends on the organization's services and operations and operating model.
Personnel
Establish responsibilities, competence, training and security awareness and conduct appropriate to security management activities.
Premises
Maintain suitable premises and working areas that support controlled security operations and security activities.
Equipment
Keep operations and supporting equipment suitable, maintained and used under controlled operating conditions.
Operations
Control security activities, materials, handling, cleaning and process records according to the activities and security context.
Security controls
Use defined security checks and information to support decisions about materials and security-related activities.
Documentation
Maintain controlled procedures, records and security records and incident information that provide evidence of relevant security management system activities.
Transport, storage and logistics
Control transport and logistics activities so security-related activities remain appropriately handled within the defined operating scope.
ISO 28000 security management system APPLICATION MODEL
Move from documented security management practices to controlled daily operations.
The value of ISO 28000 comes from applying security management system activities consistently in the facility. A simple implementation route helps the organization connect service and operational scope, people, equipment, operations records and security information.
UNDERSTAND
Define Define the security context
Confirm security services and operations, security activities, facilities and the security management system activities that will be covered by certification.
MAP
Follow the operations flow
Map assets, operational stages, security controls, storage and shipment so the relevant controls are visible.
OPERATE
Apply the security management system controls
Train personnel, operate the defined controls and maintain records that show how the security management process is managed.
VERIFY
Review and strengthen
Use security information, incident reporting, audit findings and corrective action to identify where security management system practices need attention or improvement.
ISO 28000 SECURITY MANAGEMENT SYSTEM FRAMEWORK
Eight practical areas that support a controlled Security Management System.
ISO 28000 provides a common management-system approach for security-related activities. The framework below presents practical areas that can be considered when defining controls, evidence and certification scope.
PERSONNEL
Personnel and organization
Establish responsibilities, competence, security awareness and conduct and suitable arrangements for people involved in security management activities.
FACILITIES
Premises and equipment
Maintain premises, working areas and equipment in a condition suitable for controlled security management activities.
OPERATIONS
Operational security controls
Control operational activities, access, handling, transport and other processes relevant to the organization’s security context.
SECURITY
Security controls
Maintain security controls, information and records relevant to the organization’s activities, risks and operating results.
DOCUMENTATION
Documentation and records
Keep procedures, instructions, security records and other security management system information controlled, available and traceable to the activities performed.
STORAGE
Transport, storage and logistics
Manage transport, storage and logistics activities so security controls remain effective across relevant movement and custody points.
INCIDENTS
Incidents and security information
Record and evaluate relevant incidents and security information and apply appropriate follow-up when security concerns are identified.
MAINTENANCE
Ongoing security management system maintenance
Keep security management system practices current through review, corrective action, training, records and updates when activities, facilities or processes change.
ISO 28000 CERTIFICATION READINESS
ISO 28000 audit readiness is about practical security management system evidence, not paperwork volume.
During certification, the applicable security management system practices are assessed within the agreed scope. The evidence expected depends on the services and operations, managing processes, facilities, personnel and operating model of the organization.
How responsibilities, competence, training and security awareness and conduct are established and applied in relevant security operations.
How materials, operations stages, cleaning, freight handling and dispatch and other activities are planned and controlled.
How facilities, working areas and equipment are maintained and used under suitable operating conditions.
How security-control information, security records and other relevant security management system evidence are maintained and traceable.
How materials and finished security-related activities are handled through transport and logistics activities within the defined scope.
How incident reporting, security information, audit findings and identified issues are reviewed and addressed through suitable action.
INDUSTRIES WE CERTIFY
ISO certification across the industries we serve.
ISO 28000 is primarily relevant to organizations involved in security-related activities managing and related security activities. The certification scope should reflect the actual services and operations, processes, facilities and activities assessed.
Security Services
Apply security management controls to guarding, access, patrol, monitoring and other security-related activities within scope.
Explore IndustryOil & Gas
Manage security risks around critical facilities, assets, contractors, access points, transport interfaces and operational sites.
Explore IndustryConstruction & Infrastructure
Address site access, materials, contractors, temporary facilities, logistics interfaces and security incidents across projects.
Explore IndustryFacilities Management
Control access, visitors, contractors, assets, incident reporting and security activities across managed facilities.
Explore IndustryTransport & Logistics
Manage security risks across transport operations, warehouses, yards, cargo handling, routes and supply-chain interfaces.
Explore IndustryManufacturing & Industrial
Protect facilities, restricted areas, materials, equipment, personnel access and operational assets through controlled security practices.
Explore IndustryGovernment & Public Sector
Structure security management for public facilities, controlled access, visitors, assets, contractors and service environments.
Explore IndustryData Centres & Critical Facilities
Support physical security, controlled access, visitor management, asset protection and incident response for critical infrastructure.
Explore Industry
ISO 28000 CERTIFICATION SCOPE
Your ISO 28000 certificate should describe the security activities actually assessed.
Certification scope is central to an effective ISO 28000 programme. It identifies the security-related activities and operational processes, processes, facilities and relevant functions covered by the certification assessment.
For organizations operating in Dubai or other UAE emirates, the scope should accurately reflect the security locations and activities included in the security management system.
Activities and services
Define the security-related activities families, formulations or services and operations categories included in the certification scope.
Operations processes
Identify the managing, freight handling and dispatch and other operations activities covered by the security management system.
Sites & functions
Clarify the facilities, operations areas, security functions and other locations involved in the assessed activities.
Transport, storage and logistics
Describe relevant transport and logistics activities included within the organization's ISO 28000 certification scope.
ISO 28000 CERTIFICATION PROCESS
From defined Security Management System scope definition to certification and ongoing surveillance.
The exact audit programme depends on the organization's scope, activities, facilities and operating model. The sequence below shows a practical route from application through independent assessment and continued certification activities.
Define the certification scope
Provide security-related activities, security activities, locations, personnel and intended Security Management System scope for the certification programme.
Establish and operate security management system
Apply the relevant ISO 28000 practices and generate evidence through normal security managing and security activities.
Plan the audit
Agree audit arrangements, locations, services and operations activities, personnel and certification scope with the certification body.
Certification audit
Assess implementation and objective evidence from the organization's actual security management operations within the agreed scope.
Certification decision
Audit results and applicable findings proceed through the certification body's decision process.
Surveillance and improvement
Continue operating applicable security management system practices and participate in surveillance and other scheduled certification activities.
WHY ISO 28000 MATTERS
Practical value for organizations managing security risks in the UAE.
ISO 28000 certification can provide an independent reference for security-focused security security management system practices within the agreed certification scope.
Independent assurance
Demonstrate that an independent certification assessment has examined the applicable security management practices within the agreed scope.
Consistent operations
Support repeatable operations, control, transport and logistics activities through defined security management system practices.
Traceable evidence
Maintain records that show how relevant operations and security activities are performed and controlled.
Clear responsibilities
Give personnel clear responsibilities for security awareness, operations, security controls and related security management system activities.
Operational improvement
Use reviews, incident reporting, audit findings and security information to strengthen applicable security management system practices.
Market confidence
Provide customers and business partners with recognized evidence of a security-focused security management framework.
MAINTAINING ISO 28000 CERTIFICATION
Keep security management active after certification.
Certification is maintained through continued operation, review and evidence. The organization should keep its security management system practices aligned with actual services and operations, processes, facilities and records.
Internal review
Review applicable security management system activities, records and operational conditions to identify areas needing attention.
Record maintenance
Keep operations, security, training, cleaning, storage, shipment and other relevant records current and traceable.
Corrective action
Address identified security concerns, incident reporting, audit findings and other issues through suitable action.
Continual improvement
Update security management system practices when services and operations, processes, facilities or operating conditions change.
ISO 28000 FAQ
Common questions about security management certification in the UAE.
Find concise answers about ISO 28000:2022, security management, certification scope, audits and ongoing certification.
Request an ISO 28000 QuoteWhat is ISO 28000 certification in the UAE?
ISO 28000 certification is an independent third-party conformity assessment of a Security Management System against the applicable ISO 28000 criteria within the agreed certification scope.
What is ISO 28000:2022?
ISO 28000:2022 is the current second edition of the international standard for Security Management Systems. It provides a common management-system approach that can include security aspects relevant to the supply chain.
Is ISO 28000:2022 still current?
Yes. ISO 28000:2022 is the current published edition. ISO also lists Amendment 1:2024, which introduced climate action changes applicable to the standard.
Who can use ISO 28000?
ISO 28000 is applicable to organizations of different sizes and types, including commercial enterprises, public agencies and non-profit organizations. It can be applied to internal or external activities at different organizational levels.
What does ISO 28000 cover?
ISO 28000 provides a Security Management System framework for identifying and managing security-related risks and controls across organizational activities, including aspects relevant to supply-chain security.
Does ISO 28000 apply only to supply-chain companies?
No. ISO states that the standard is not industry or sector specific. It can be applied to organizations whose activities involve security considerations, including those with relevant supply-chain interfaces.
Does ISO 28000 cover physical and operational security?
The standard provides a management-system framework for security-related activities and controls. The exact security topics addressed depend on the organization, its context, activities, risks and defined certification scope.
Can ISO 28000 be used by logistics and transport organizations?
Yes. ISO 28000 can be relevant to organizations managing security risks in transport, logistics, storage and supply-chain activities, provided the certification scope accurately describes the activities assessed.
What is included in an ISO 28000 certification scope?
The scope can identify the organization, locations, functions, activities, processes and security-related operations covered by the Security Management System and certification assessment.
What is the ISO 28000 certification process in the UAE?
A certification programme normally begins with application and scope information, followed by audit planning, Stage 1 and Stage 2 audit activities where applicable, a certification decision and ongoing surveillance during the certification cycle.
What happens during an ISO 28000 Stage 1 audit?
Stage 1 is an initial audit activity used to review information about the Security Management System, scope, locations, processes, documented information and readiness for the next audit stage.
What happens during an ISO 28000 Stage 2 audit?
Stage 2 assesses implementation and effectiveness of the Security Management System against the applicable ISO 28000 criteria within the agreed scope, using objective evidence from relevant operational and supporting processes.
How long does ISO 28000 certification take in the UAE?
There is no single timeline for every organization. Programme timing depends on the scope, number of sites, personnel, shifts, operational complexity, outsourced activities and readiness of the Security Management System.
How long is ISO 28000 certification valid?
Management-system certification operates through a defined certification cycle with ongoing surveillance and other applicable audit activities. The organization must maintain its Security Management System throughout the certification cycle.
Can a small organization obtain ISO 28000 certification?
Yes. ISO 28000 can be applied to organizations of different sizes. The certification scope and audit programme should reflect the organization’s actual activities, sites, security context and operating model.
What evidence can auditors review for ISO 28000?
Evidence may include security risk information, operational controls, competence and awareness records, documented information, incident records, monitoring results, internal audits, management review and corrective-action records.
Can ISO 28000 be used with ISO 9001 or ISO 14001?
Yes. An organization may use ISO 28000 alongside other applicable management-system standards. Each standard retains its own purpose and scope while shared management practices may be coordinated where appropriate.
Is ISO 28000 useful for organizations in Dubai and other UAE emirates?
ISO 28000 can be applied to suitable security management activities across Dubai, Abu Dhabi, Sharjah, Ajman, Ras Al Khaimah, Fujairah and Umm Al Quwain. Certification scope is based on the activities and sites assessed.
What information is needed for an ISO 28000 certification quotation?
Useful information includes security activities, locations, personnel, shifts, relevant processes, supply-chain interfaces, transport or logistics activities, outsourced processes and any existing management-system certification.
Does ISO itself issue ISO 28000 certificates?
No. ISO develops and publishes the standard but does not perform ordinary management-system certification. Organizations seeking certification engage an independent certification body.
AUTHORITATIVE ISO REFERENCES
ISO 28000 information and certification guidance.
Technical information about ISO 28000:2022, its defined Security Management System scope and current published status has been referenced against official ISO and ISO committee sources.
ISO.ORG · OFFICIAL SOURCE
ISO 28000:2022 — Security Management System
Official ISO standard record, edition, scope and current status
Open official source
COMMITTEE.ISO.ORG · OFFICIAL SOURCE
ISO/TC 292 — ISO 28000
Official committee information for the security management standard
Open official source
ISO.ORG · OFFICIAL SOURCE
ISO/TC 292 Catalogue
Published ISO/TC 292 catalogue information for security and resilience standards
Open official source
ISO.ORG · OFFICIAL SOURCE
ICS 03.100.70 — Management systems
Official ISO classification information for management systems
Open official source
ISO 28000 CERTIFICATION IN UAE
Start your ISO 28000 certification programme with a clearly defined defined Security Management System scope.
Share your security-related activities, locations and existing security management system practices so the appropriate ISO 28000 certification programme can be considered.
Request an ISO 28000 Certification Quotation
