ISO 28000:2022 Security Management Systems Foundation Level Training and Certification Program

Programme Summary

Build an understanding of organizational security using ISO 28000:2022. Participants connect security threats, operational vulnerabilities and coordinated protective controls with responsibilities and performance measures. Exercises based on a distribution hub and supply network case develop requirement interpretation, evidence selection and gap recognition. The programme establishes a foundation for proportionate protection of people, assets and business activities and further implementation or auditor development.

Training Objectives

1 Explain organizational security requirements; 2 Connect requirements with operational responsibilities; 3 Recognise uncontrolled physical access; 4 Select relevant implementation evidence; 5 Prepare for further practical development.

Learning Outcomes

1 Define organisational security boundaries; 2 Evaluate threats and vulnerable dependencies; 3 Select proportionate protective controls; 4 Review partner and custody evidence; 5 Assess security incident response readiness.

Target Audience

Security Managers; Corporate Security Officers; Supply Chain Security Managers; Operations Managers; Management System Coordinators.

Target Industries

Logistics and Distribution; Ports and Terminals; Industrial Manufacturing; Critical Infrastructure; Retail Distribution.

Course Contents

• Module 1 Standard Purpose and Practical Application: Management system purpose and intended outcomes; Requirement guidance and evidence distinctions; Course case scope and learning responsibilities.
• Module 2 Security Context and System Scope: Organisational activities and security boundaries; Internal external and supply chain interfaces; Interested parties obligations and climate relevance.
• Module 3 Security Threat and Risk Assessment: Threat sources and vulnerable activities; Consequence likelihood and risk evaluation; Existing controls and treatment priorities.
• Module 4 Security Leadership and Planning: Policy objectives and accountable responsibilities; Security plans and measurable action priorities; Competence awareness and information sharing.
• Module 5 People Assets and Access Controls: Personnel access and visitor arrangements; Asset protection and physical security interfaces; Sensitive information and security record handling.
• Module 6 Supply Chain and Partner Security: Custody movements and transfer points; Supplier and partner security responsibilities; Changes in routes facilities and dependencies.
• Module 7 Operational Security and Change: Control criteria and operating procedures; Contractor coordination and exception handling; Security considerations in operational changes.
• Module 8 Security Incident Preparedness and Response: Threat escalation and reporting responsibilities; Response coordination and continuity interfaces; Exercises investigation and incident learning.
• Module 9 Security Performance and Improvement: Monitoring indicators and control effectiveness; Internal audit and management review; Corrective actions and evolving threat review.
• Module 10 Interpreting Requirements in Context: Mandatory requirements and proportionate application; Interfaces with applicable legal obligations; Supported judgements and unresolved interpretation issues.
• Module 11 Selecting Relevant Management System Evidence: Security threat assessments; Access and movement records; Security incident reports.
• Module 12 Foundation Application Workshop: Map responsibilities within the supplied case; Match controls to relevant requirements; Explain gaps and practical next steps.

Assessment

• 60 single best answer questions, including applied scenarios; one mark per question.
• 90 minute invigilated digital examination with identity verification. Approved accessibility adjustments preserve the assessed competence.
• Clean standard text and supplied case documents permitted; internet, messaging and external AI tools prohibited.
• Individual applied assessment (45 minutes): Using a supplied distribution hub and supply network case, produce a security risk register and control map, link three controls to relevant requirements and explain one unresolved weakness.
• Assessment criteria: Accurate interpretation of organizational security requirements; Relevant use of security threat assessments; Clear connection between controls responsibilities and identified gaps.
• Pass each component separately: 45/60 written marks (75%) and at least 70% on the applied task.
• All mandatory criteria must pass: Do not fabricate evidence or knowingly present unsupported conformity conclusions.
• Individual results and feedback are provided. One reassessment may follow coaching under the published enrolment terms.

Certification

• Successful learners receive a TQCSI Arabia digital Certificate of Successful Completion.
• The certificate records the learner name, exact programme title, teaching hours, completion date and unique verification reference.
• Verified identity, full attendance and separate written and applied passes are required; all mandatory critical criteria must be met.
• Proposed issue target: within 30 calendar days of approved results and settlement of applicable fees.
• Records assessed foundation knowledge of organizational security; it does not establish professional auditor status, independent personnel certification or organisational certification.
• Attendance confirmation may record completed hours for unsuccessful learners; it does not certify successful completion.

Programme Profile

Number of daysNumber of daysNumber of days

333

Total teaching hoursTotal teaching hoursTotal teaching hours

18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.18 hours; breaks, pre course work and formal final assessments excluded.

Delegates allowedDelegates allowedDelegates allowed

Maximum 20 delegates.Maximum 20 delegates.Maximum 20 delegates.

Training prerequisitesTraining prerequisitesTraining prerequisites

No formal qualification required. Familiarity with organizational security activities and everyday business processes is recommended.No formal qualification required. Familiarity with organizational security activities and everyday business processes is recommended.No formal qualification required. Familiarity with organizational security activities and everyday business processes is recommended.

Pre course assignment and assessmentPre course assignment and assessmentPre course assignment and assessment

Complete a 20-minute diagnostic and identify how security threat assessments support a supplied operational case.Complete a 20-minute diagnostic and identify how security threat assessments support a supplied operational case.Complete a 20-minute diagnostic and identify how security threat assessments support a supplied operational case.

End of course assessmentEnd of course assessmentEnd of course assessment

60 question written exam (90 minutes) and individual applied task (45 minutes).60 question written exam (90 minutes) and individual applied task (45 minutes).60 question written exam (90 minutes) and individual applied task (45 minutes).

Passing criteriaPassing criteriaPassing criteria

75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.75% written and 70% applied, passed separately; full attendance. All mandatory criteria must pass.