ISO 18788 Certification for Private Security Providers

What is ISO 18788?

ISO 18788, “Management system for private security operations – Requirements with guidance for use”, is the international standard for a security operations management system (SOMS). It was published in September 2015 by ISO/TC 292 Security and resilience and provides a framework for planning, implementing, monitoring and continually improving security operations.

The standard combines business and risk management with three aims: conducting security operations professionally to meet the requirements of clients and other stakeholders, being accountable to the law and respecting human rights, and staying consistent with the voluntary commitments an organisation has made. Like other management system standards it is organised in clauses 4 to 10, with an extensive Annex A giving guidance on its use.

The 2015 edition was confirmed at its systematic review in 2021 and extended by the climate amendment Amd 1:2024. ISO started a further systematic review in 2026; until a decision is taken, ISO 18788:2015 remains the current version.

Who is ISO 18788 for?

The standard addresses organisations that conduct or contract security operations. It is specifically aimed at operations in circumstances where governance may be weak or the rule of law undermined because of human or natural events – for example in crisis and conflict regions or after disasters. Typical clients include state and non-state bodies involved in relief, reconstruction and development, companies with operations in such regions, and diplomatic missions.

Clients can use the standard too: it is intended that they refer to it when hiring private security services and build their own due diligence and contracts around it.

For a fair assessment: the standard itself notes that it is not intended to place additional burdens on general guarding services outside these specific circumstances. For routine static guarding, reception or event security, ISO 9001 or a national service standard is often the better fit. We are happy to discuss this in the initial conversation.

Foundations: Montreux Document, ICoC and human rights

ISO 18788 turns international principles into auditable requirements. It draws on the Montreux Document of 17 September 2008 on pertinent international legal obligations and good practices for states related to private military and security companies, the International Code of Conduct for Private Security Service Providers (ICoC) of 9 November 2010, and the UN Guiding Principles on Business and Human Rights of 2011.

This gives companies and their clients a way to put the commitments of these documents into daily practice and to demonstrate them. According to the standard, the key is to embed their values in the culture and activities of the organisation – which requires long-term commitment from top management.

Membership of the International Code of Conduct Association (ICoCA) is a separate process with its own rules and does not follow automatically from a certificate. The standard also does not give legal advice: each organisation must determine for itself which national and international laws apply.

ISO 18788 requirements at a glance

Alongside the familiar building blocks of a management system, ISO 18788 contains many requirements found only in this standard. The main content by clause:

• Clause 4 – Context: internal and external context, supply chain and subcontractor mapping, risk criteria, stakeholder needs and scope.
• Clause 5 – Leadership: top management commitment, a Statement of Conformance issued by top management, policy, roles and authorities.
• Clause 6 – Planning: assessment of safety, security and human rights risks, legal and other requirements, risk communication and objectives.
• Clause 7 – Support: resources, competence, training and its evaluation, communication including complaint and grievance procedures and a whistle-blower policy, documented information.
• Clause 8 – Operation: respect for human rights, codes of ethical conduct, use of force, apprehension and search, support to law enforcement, personnel screening, management of weapons and munitions, uniforms and markings, occupational health and safety, incident management.
• Clause 9 – Performance evaluation: monitoring and measurement, evaluation of compliance, exercises and testing, internal audit and management review.
• Clause 10 – Improvement: nonconformity, corrective action, change management and continual improvement.

Use of force, personnel and incidents

Three topics set ISO 18788 apart from general management system standards. First, the use of force: the organisation must ensure that force is reasonably necessary, proportional and lawful. The standard covers weapons authorisation, a use-of-force continuum, less-lethal and lethal force, and the related training.

Second, personnel: everyone working on the organisation's behalf must be carefully selected, screened and trained, and competences are defined, evaluated and documented. Third, incidents: the organisation needs procedures to monitor, report and investigate incidents, to receive complaints – including from people outside the company – and to protect whistle-blowers.

The audit therefore focuses on evidence from practice: rules for the use of force and how they are agreed with clients, training and screening records, incident reports and investigations, grievance procedures and the control of subcontractors.

Certification timeline, cost and prerequisites

There is no flat fee for ISO 18788 certification. Costs depend on scope, and CERTUNION prepares an individual quote once we have analysed your information. The main factors are the number of people deployed, the number and location of operating sites, the type of services – for example whether personnel are armed – and the share of subcontractors.

The certification process usually takes four to eight weeks, depending on size and complexity. It requires a management system that is in place and already producing results. Before the audit, the following should be available:

• a defined scope covering services, operating sites and subcontractors
• the Statement of Conformance and a documented policy
• a risk assessment that includes human rights risks and the impact on local communities
• rules for the use of force, a code of conduct, training records and screening procedures
• working complaint, whistle-blower and incident procedures
• at least one internal audit and one management review

ISO 18788 vs ISO 9001, ISO 28007-1 and national rules

ISO 9001 describes general quality management and contains no requirements on use of force, weapons or human rights. ISO 28007-1:2015 is aimed specifically at private maritime security companies providing armed security personnel on board ships. National service standards, such as DIN 77200-1 in Germany, set general requirements for security service providers.

None of these standards replaces a licence. In Ireland, for example, providing a security service requires a licence from the Private Security Authority under the Private Security Services Act 2004; other countries have comparable rules.

ISO 18788 is explicitly designed to be integrated with other management systems, such as quality, occupational health and safety, environment or information security. If you already work to ISO 9001 or ISO 45001, you can run policy, risk assessment, internal audit and management review together.

Benefits of ISO 18788 certification

For clients in sensitive environments, choosing a security provider is a question of liability and reputation. A certificate shows that an independent third party has audited the provider's management system against a publicly available standard. It supports clients' due diligence in tenders, creates consistent processes across countries, sites and subcontractors, and integrates with existing management systems instead of creating parallel structures.

A certificate does not rule out incidents. It does show that risks are assessed systematically, people are trained and incidents are investigated – and that the organisation learns from them.

The Certification Process

1. 01

   Enquiry

   Tell us about your services, operating sites and subcontractors. In the initial conversation, which is without obligation, we also clarify whether ISO 18788 is the right standard for you.

2. 02

   Analysis and quote

   We assess the scope, the number of people deployed, sites and the type of operations, and prepare an individual quote.

3. 03

   Pre-audit (optional)

   If you wish, a pre-audit shows where your management system still has gaps – for example in the rules for the use of force or the grievance procedure.

4. 04

   Certification audit

   On site or remotely, our auditors review documentation, risk assessment, training records and incident handling, and test day-to-day practice through interviews and sampling.

5. 05

   Certificate

   Once the audit has been passed, CERTUNION issues the certificate for the defined scope. It is usually valid for three years.

6. 06

   Surveillance audits

   Annual surveillance audits check that the management system remains effective – including when operating sites, contracts or subcontractors change.

Frequently asked questions