ISO 18788 in Plain English: Security Operations Management That Clients Can Trust

ISO 18788 is the standard for Security Operations Management.

In plain English, it’s about proving your security operations are:

• planned and controlled
• legally compliant
• risk-based, not reactive
• properly supervised
• continuously improved

It’s especially relevant if you provide guarding, mobile patrols, key holding, event security, or any security service where clients need confidence you’ll do the right thing under pressure.

What ISO 18788 actually covers

ISO 18788 is built around a management system approach, similar in structure to other ISO standards but tailored to security operations. It focuses on:

• operational planning and control
• legal and regulatory compliance
• risk assessment and mitigation
• competence, supervision and accountability
• incident management and learning
• monitoring, audits and continual improvement

The goal isn’t paperwork. The goal is consistent, controlled delivery — with evidence.

Who ISO 18788 is for

• private security companies
• organisations delivering security operations in higher-risk environments
• suppliers working with the public sector, infrastructure or larger corporates

If your tenders ask about governance, risk, incident response, supervision or operational control, ISO 18788 gives you a clean, auditable answer. It sits well alongside SIA Approved Contractor Scheme status and BS 7858 screening, which buyers usually ask about in the same breath.

Why clients ask for ISO 18788

1. Buyer confidence. It shows you’re not just licensed — you’re managed, controlled and accountable.
2. Reduced operational risk. Better planning, clearer roles and tighter control reduce incidents and complaints.
3. Stronger supervision and performance. It forces clarity on competence, monitoring and corrective action.
4. Competitive advantage. In a crowded security market, ISO 18788 is a differentiator.

What you need to pass ISO 18788

You don’t need a mountain of documents — you need a working system and proof. Typically you’ll need:

• a defined scope for security operations management
• legal and compliance obligations identified and controlled
• risk assessment and controls covering threats, vulnerabilities and mitigation
• operational procedures and briefings
• an incident response process, with records
• competence and supervision controls — who can do what, and how it’s checked
• monitoring and measurement against KPIs
• internal audits, management review and corrective actions

What makes ISO 18788 audits fail

• procedures that don’t match real operations
• weak evidence of supervision and monitoring
• risk assessments that are generic rather than site or service specific
• corrective actions not tracked to completion

The fix is simple: keep it operational, keep it evidence-led, and make sure what you say you do is what you actually do.

How long does ISO 18788 take?

At CAW Consultancy, systems can be built within 48 hours and are typically delivered within 72. Audit scheduling depends on the certification body, but the system build and preparation doesn’t need to drag on.

Why CAW Consultancy

• 100% pass rate across all standards and certification bodies, including UKAS
• fastest turnaround in the country
• at least 50% cheaper than other UK consultancies
• ISO consultancy packages from £999

Get ISO 18788 done properly

If you want ISO 18788 built so it’s practical, paperless and audit-ready, we’ll tell you exactly what you need — and what you don’t — then get you ready fast.

Need help with this?

CAW Consultancy has helped UK businesses achieve ISO certification and industry accreditation for over 20 years, with a 100% pass rate. See what we do, or send us an enquiry — we’ll tell you what you need, what you don’t, and what it will cost.