Security Management System Certification Audits

Key requirements — selected themes

• Security context, policy and responsibilities
• Security risk assessment and treatment
• Security objectives and operational planning
• Control of relevant assets, activities and interfaces
• Preparedness, response and communication
• Performance evaluation and continual improvement

High-level summary

An independent assessment of the system used to manage security risks across defined operations. Audits examine relevant threats, responsibilities, operational measures and interfaces, including supply chain activities where they form part of the scope.

Certification recognises management system conformity rather than absolute physical or operational security. It provides a structured basis for stakeholder confidence without guaranteeing that security incidents or disruptions will not occur.

Third-party certification pathway

References: [S20] · [G01] · [G02] · [G03]

• Application & scope. Identify operations, assets, locations, supply chain interfaces and proposed security boundaries.
• Review & audit planning. Confirm eligibility, impartiality, competence and applicable rules; agree scope, audit time and programme.
• Stage 1 — readiness. Review security risks, treatment arrangements, objectives and evidence of system evaluation.
• Stage 2 — implementation. Sample security controls, personnel responsibilities, response arrangements and operating records.
• Nonconformity resolution. Review corrections and corrective actions; verify closure or accept action plans as the applicable rules require.
• Independent certification decision. A competent function independent of the audit evaluates the evidence; certification is issued only when requirements are met.
• Surveillance. Review changed threats, incidents, dependencies and continuing security management effectiveness.
• Recertification. Reassess the system before certificate expiry and complete the required review and decision for a new cycle.