If you run a private maritime security company (PMSC), or you’re a land-based security firm thinking about moving into maritime work, you’ll hear “ISO 28007” mentioned very early on. Shipping companies ask about it, and the UK government’s own guidance refers to it.
What’s less well understood is how it actually works. ISO 28007 is not something you’re certified to on its own, and the UK position has some specific wording that’s worth reading carefully. This article sets out the facts as they stand, using only the official sources, so you know what you’re signing up for before you speak to a certification body.
What ISO 28007-1:2015 is
The current standard is ISO 28007-1:2015. Its full title is long but tells you exactly what it’s for: Ships and marine technology: Guidelines for Private Maritime Security Companies (PMSC) providing privately contracted armed security personnel (PCASP) on board ships (and pro forma contract): Part 1: General.
A few points from ISO’s own listing are worth knowing:
- it’s the first edition, published in 2015, and ISO lists it as current
- ISO states it “was last reviewed and confirmed in 2022”
- it replaced an earlier publicly available specification, ISO/PAS 28007:2012, which is now withdrawn
- it sits with ISO’s ships and marine technology committee (ISO/TC 8), not the security committee
That systematic review point matters. ISO reviews standards periodically, and in 2022 it decided to keep ISO 28007-1 as it is. There’s no revision shown as under development on the ISO page at the time of writing (October 2026).
How ISO 28007 relates to ISO 28000
This is the bit that causes most confusion. ISO 28007-1 is written as guidance, not as a standalone set of requirements. ISO’s abstract says it “gives guidelines containing additional sector-specific recommendations, which companies (organizations) who comply with ISO 28000 can implement to demonstrate that they provide Privately Contracted Armed Security Personnel (PCASP) on board ships.”
In other words, ISO 28000 is the management system standard and ISO 28007-1 tells you how to apply it to armed maritime security. The current ISO 28000 is ISO 28000:2022, the security management system standard. If you already hold ISO 18788 for security operations, much of your existing system (risk assessment, competence, incident management, and internal audit) is likely to carry across.
UKAS makes the relationship explicit in its guidance for certification bodies, CIS 9 (Edition 3, June 2024). It states that “ISO 28007-1 provides sector specific guidance to PMSC seeking certification under ISO 28000.” The certificate is to ISO 28000, and any nonconformities are raised against ISO 28000 while referring to the relevant ISO 28007-1 clause. UKAS also expects the certificate to carry a statement that the certification was prepared using the full ISO 28007-1 guidelines.
One scope point catches people out. According to UKAS, ISO 28007-1 covers armed security personnel operating on board ships. It does not cover other maritime security services such as consultancy or training for state entities. If that’s a big part of your business, discuss scope with your certification body at the outset.
The UK government’s position
The Department for Transport publishes interim guidance to UK flagged shipping on the use of armed guards to defend against the threat of piracy in exceptional circumstances. It was first published on 6 December 2011 and the GOV.UK page shows it was last updated on 1 December 2015. Read it in full if you work with UK flagged vessels, because it’s addressed to shipping companies choosing a PMSC as much as to PMSCs themselves. Given its age, check the page for any newer version before you rely on it.
On standards, the guidance says the government views ISO 28007-1:2015 “as important to promoting professional standards among merchant ship maritime security providers.” (GOV.UK refers to it as “ISO PAS 28007-1:2015”, but it’s the same 2015 document described above.) It says the UK government wants high standards, including respect for human rights, to be “reflected in PMSC operations and certified through an independent certification process”, and it encourages shipping companies to use independent third-party certification to ISO 28000 and ISO 28007-1 when selecting a PMSC.
I want to be careful here. The guidance encourages certification and makes it part of a shipping company’s due diligence. I couldn’t find wording in it that makes certification a legal requirement for a PMSC to operate, so I won’t claim that it is.
The guidance is clear on one point, though: who does the certifying. Its annex on accreditation says certification to PSC1, ISO 18788, or ISO 28007 “must be carried out by an accredited certification body”, and tells you to ask the certification body for its certificate of accreditation and check it on the UKAS website.
It’s also worth knowing that the same guidance expects PMSCs to apply to the Home Office for section 5 authorisation under the Firearms Act 1968. Certification doesn’t replace firearms authorisation, export control licensing, or any other legal permission.
What certification involves in practice
Under UKAS CIS 9, certification bodies working in this area are accredited against ISO/IEC 17021-1 used together with ISO 28003, and their audits include a stage 1 audit, a stage 2 audit, surveillance “at least yearly”, and recertification “after three years”. Special audits can happen sooner if serious allegations are made against a company.
What makes ISO 28007 audits different is the subject matter. UKAS says certification bodies and their audit teams should have expertise across a wide range of areas, including:
- risk management
- international and national regulation, contracts, and insurance
- vetting and training of personnel
- command and control, and rules for the use of force
- firearms procurement, licensing, storage, import, export, and movement
- human rights, detainees, and incident management
- security technology and data retention
That list is a good checklist for your own preparation. If the auditor needs to be competent in it, your system needs to address it. UKAS also says the audit team should determine whether personnel have fully understood the requirements of ISO 28007-1, and that this may need an independent interpreter. In practice, that means talking to your operatives, not just reading your manual.
On personnel vetting, CIS 9 notes that BS 7858 provides for the screening of security operatives. Many land-based security firms will already know that standard well, and it’s covered in my BS 7858 screening guide for employers.
UKAS itself also observes certification bodies at work. Its assessment includes witnessing at least one audit of a PMSC by the certification body, and its annual surveillance of the certification body includes observing at least one such audit each year.
Common gaps to fix before your audit
From what I see in security company audits generally, these tend to be the weak spots:
- a risk assessment that’s generic rather than specific to routes, vessels, and transit areas
- training records that show attendance but not competence, particularly for use of force
- subcontracted team members whose vetting and qualifications can’t be evidenced
- firearms movement records that don’t join up from start to finish
- incident reporting that exists on paper but has never been tested
- no clear link between the contract, the scope, and the rules for the use of force
None of these is unusual, and all of them can be fixed with a bit of structure. My ISO certification process guide explains what to expect at each audit stage.
FAQs
What is ISO 28007?
ISO 28007-1:2015 gives sector-specific guidelines for private maritime security companies that provide privately contracted armed security personnel on board ships. It is used together with ISO 28000, the security management system standard.
Can you be certified to ISO 28007 on its own?
No. According to UKAS guidance, the management system is certified to ISO 28000, with ISO 28007-1 applied as sector-specific guidance. UKAS expects the certificate to state that the full ISO 28007-1 guidelines were used.
Is ISO 28007-1:2015 still current?
Yes. ISO lists ISO 28007-1:2015 as published and current, and states it was last reviewed and confirmed in 2022. No revision is shown as under development on the ISO page.
Is ISO 28007 certification mandatory in the UK?
The Department for Transport’s guidance encourages shipping companies to use independent third-party certification to ISO 28000 and ISO 28007-1 when selecting a PMSC, and says such certification must be carried out by an accredited certification body. It does not state that certification is a legal requirement for PMSCs.
Who accredits ISO 28007 certification bodies in the UK?
UKAS, the UK’s national accreditation body. It publishes guidance (CIS 9) for certification bodies certifying PMSCs against ISO 28000 with ISO 28007-1. You can check a certification body’s accreditation on the UKAS website.
How often are ISO 28007 audits carried out?
UKAS guidance states surveillance audits take place at least yearly, with recertification after three years. Special audits can be carried out sooner if serious allegations are made against a company.
Talk to us about maritime security certification
Preparing for ISO 28000 with ISO 28007-1 is a serious piece of work, but it’s very manageable when the system is built around how your teams actually operate. CAW Consultancy helps PMSCs and security companies build that system and get audit-ready. Certification itself is carried out by an independent, accredited certification body of your choice (you can check its accreditation on the UKAS website). A gap analysis with us is free.
Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk.
For BS 7858 vetting of your operatives, our sister company Screen My Staff can take that work off your hands. If you’d like your team trained in ISO fundamentals, ISO Training Institute runs online ISO and screening courses.
Sources
- ISO 28007-1:2015, iso.org
- ISO 28000:2022, iso.org
- UKAS CIS 9, Edition 3, June 2024
- Department for Transport: interim guidance to UK flagged shipping on the use of armed guards, GOV.UK (publication page)
- Department for Transport: interim guidance, full text, GOV.UK
Craig Willetts is the founder of CAW Consultancy Business Solutions Ltd and a UK lead auditor with over 20 years’ experience across ISO management systems and UK security industry schemes.
Leave a Reply