System Guides

ISO 18788 - Clause 4.2 - SOMS Understanding the needs and expectations of stakeholders

ISO 18788 Clause 4.2 focuses on the requirement for understanding the needs and expectations of stakeholders within the Security Operations Management System (SOMS). This clause emphasizes the importance of identifying and comprehending the interests, concerns, and requirements of various stakeholders to effectively manage security operations. Here's an explanation of the key elements of this clause:

Clause 4.2 - SOMS Understanding the Needs and Expectations of Stakeholders:

1. Identification of Stakeholders: The organization should identify all relevant stakeholders who have an interest in or can affect security operations. This includes but is not limited to clients, employees, regulatory authorities, suppliers, partners, local communities, and other entities that interact with the organization's security activities.

2. Needs and Expectations: Once stakeholders are identified, the organization should determine and document their needs, expectations, concerns, and requirements related to security operations. This information should cover a wide range of areas, including safety, compliance, ethical considerations, and security performance.

3. Prioritization: Prioritize the identified needs and expectations based on their significance and potential impact on security operations. Some stakeholder requirements may carry more weight or legal obligations than others.

4. Communication Channels: Establish effective communication channels with stakeholders to gather their input and feedback regularly. This may involve surveys, meetings, interviews, or other methods to engage with stakeholders and ensure their perspectives are considered.

5. Integration with the SOMS: Ensure that the identified stakeholder needs and expectations are integrated into the Security Operations Management System (SOMS). This involves aligning security policies, procedures, and activities with stakeholder requirements.

6. Compliance and Legal Obligations: Consider any legal or regulatory requirements related to stakeholder engagement and ensure compliance with them. Some industries or regions may have specific mandates regarding stakeholder communication and consultation.

7. Monitoring and Review: Continuously monitor and review stakeholder needs and expectations to stay up-to-date with any changes or evolving concerns. This information can help the organization adapt its security operations accordingly.

8. Feedback Mechanism: Establish a mechanism for stakeholders to provide feedback, report concerns, or request information related to security operations. Ensure that this mechanism is accessible and responsive.

9. Documentation: Document the results of stakeholder engagement, including their needs and expectations, in a systematic and accessible manner. This documentation should be used as a reference point for decision-making and improvements.

10. Continuous Improvement: Use the insights gained from stakeholder engagement to drive continuous improvement in security operations and enhance the organization's ability to meet stakeholder needs and expectations.

Understanding the needs and expectations of stakeholders is vital for maintaining trust, managing security risks, and demonstrating commitment to security excellence within the SOMS. It helps the organization align its security strategies with the interests of key stakeholders and fosters a culture of transparency and accountability.

Specific procedures and documentation related to stakeholder engagement should be developed and implemented in accordance with the organization's unique needs and the requirements of ISO 18788.

ISO 18788 - Clause 4.3 - SOMS Determining the scope of the security operations management system

ISO 18788 Clause 4.3 addresses the requirement for determining the scope of the Security Operations Management System (SOMS). This clause is essential for defining the boundaries and coverage of the security management system within an organization. Here's an explanation of the key elements of this clause:

Clause 4.3 - Determining the Scope of the Security Operations Management System (SOMS):

1. Scope Definition: The organization must clearly define and document the scope of its SOMS. This definition should outline the extent of security operations, functions, processes, and activities that are covered by the SOMS. It sets the boundaries for what the SOMS encompasses.

2. Consideration of External and Internal Factors: When determining the scope, the organization should consider both internal and external factors that can influence security operations. These factors may include legal and regulatory requirements, organizational goals, stakeholder expectations, the organization's size and structure, and the nature of its security-related activities.

3. Inclusion and Exclusion: The scope should explicitly state what is included within the SOMS and, equally important, what is excluded. Items excluded from the scope should be justified, and the reasons for exclusion should be documented.

4. Alignment with Organizational Objectives: The scope of the SOMS should align with the organization's overall objectives and strategic direction. It should support the organization's mission and goals, especially in relation to security and risk management.

5. Communication: Once the scope is defined, it should be communicated effectively within the organization. All relevant personnel, including security management and staff, should understand the scope and its implications.

6. Documented Information: Document the defined scope and maintain it as documented information within the SOMS documentation. This ensures that the scope is accessible to those who need it for reference and decision-making.

7. Periodic Review: The scope should not be static. It should be periodically reviewed and updated to reflect changes in the organization's security operations, external factors, or strategic priorities.

8. Consistency with ISO 18788: Ensure that the scope aligns with the requirements of ISO 18788 and supports the organization's commitment to security management best practices.

Defining the scope of the SOMS is a fundamental step in establishing an effective security management framework. It provides clarity about what the SOMS covers and helps the organization allocate resources, establish objectives, and manage risks in a focused and systematic manner. Additionally, it facilitates communication with internal and external stakeholders regarding the organization's security management efforts.

Specific procedures and documentation related to scope determination should be developed and implemented in accordance with the organization's unique needs and the requirements of ISO 18788.