ISO 18788 · ASIS PSC.1 · Security operations management systems
ISO 18788 certification consulting for private security companies that operate lawfully and professionally.
ISO 18788 and ASIS PSC.1 set management system requirements for private security operations, including respect for law and human rights. Sterling's expert and experienced consultants build the system with your operations team and prepare you for the certification audit. We ensure successful certification for our clients.
- One all-inclusive proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard
- Expert and experienced consultants who have advised on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an independent certification body audits and decides
8,100+ client engagements in 60+ countries.
Security sector client experience
What it is
What are ISO 18788 and PSC.1?
ISO 18788 is the international standard titled "Management system for private security operations — Requirements with guidance for use". It sets a framework for a security operations management system for any organisation that conducts or contracts security operations, so that it can deliver professional services to clients, show accountability to law and respect for human rights, and stay consistent with voluntary commitments it has made.
ASIS PSC.1 is the ASIS International standard for the same field, now titled "Management System for Private Security Company Operations Standard – Requirements with Guidance". Buyers and schemes may name either; we build one system that answers the one your client asks for.
Current editions. ISO 18788:2015, first edition, published September 2015 by ISO/TC 292, with Amendment 1:2024 adding climate action changes. ISO has the standard under systematic review. The current ASIS edition is ASIS PSC.1-2022.
Who it is for
Who needs ISO 18788 or PSC.1 certification?
Security providers usually come to the standard from one of four directions:
- A client or tender asks for it. Clients such as governments, NGOs and multinationals may ask for evidence of controlled, lawful security operations.
- You operate in complex environments. Armed or high-risk work needs rules on use of force, vetting and incident reporting that hold up.
- You subcontract security. Organisations that contract security operations need a way to manage providers.
- You are growing across countries. Each contract has built its own practices; one system with local ownership fixes that.
The value is in how guards, supervisors and managers behave on the ground; the certificate records it.
Requirements
What are the main ISO 18788 requirements?
ISO describes the standard as setting principles and requirements for a security operations management system. Its clause titles are not summarised here; the list shows what a Sterling programme covers, checked against the edition you certify to during the gap assessment.
- Context and scope: the operations, sites, clients and legal settings the system covers
- Legal and human rights commitments: applicable law, human rights obligations and voluntary commitments identified and owned
- Risk assessment: risks to people, clients and communities assessed, with controls agreed
- Personnel and training: vetting, competence and training records for every person deployed
- Operational control: procedures for security operations, incidents and reporting
- Audit and review: internal audit, management review and corrective action
What does useful ISO 18788 evidence look like?
A register of legal and human rights obligations, risk assessments for each contract, vetting and training records, incident reports with follow-up, subcontractor evaluations, and audit findings closed with proof. Held in Effivity from the start, the evidence shows a system that runs.
Your engagement
What your ISO 18788 / PSC.1 engagement includes
Your agreed scope brings together what a working security operations management system needs, from one team under one all-inclusive proposal.
Scope, gap analysis and plan
Contracts, sites and standard agreed, with owners and dates.
Procedures and documentation
Built with your operations managers, on Sterling's template sets.
Effivity ISO & GRC software
Your system runs in Effivity, included at no additional cost.
Training for everyone
Internal auditor training, as applicable, and preferential Sterling Academy access, including complimentary awareness training.
Internal audit and management review
Findings closed with evidence before the certification body arrives.
Certification readiness
Preparation for the certification audit and support until the certificate is issued.
Sterling does not certify. An independent certification body conducts the audit and makes the certification decision.
Often combined with
Standards organisations pair with ISO 18788 / PSC.1
- COPC CX StandardCOPC CX Standard certification readiness for contact centres and CX operations: gap assessment, metrics, processes and people, with Sterling's support.
- ISO 17100ISO 17100 certification for translation service providers: processes, translator and reviser competence, client agreements and audit readiness with Sterling.
- ISO 18091ISO 18091 local government guidance put into practice: a citizen-focused ISO 9001 quality system, the diagnostic, SDG progress and certification readiness.
- ISO 18295ISO 18295 certification consulting for in-house and outsourced contact centres: consistent, measurable customer service on every channel, ready for audit.
- ISO 18587ISO 18587 certification support for language service providers: post-editing process, post-editor competence and audit readiness, with Effivity included.
- ISO 20121ISO 20121 certification consulting for events: environmental, social and economic impacts managed from concept to review, ready for an independent audit.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO 18788 / PSC.1.
Every Sterling ISO 18788 / PSC.1 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so legal obligations, risk assessments, vetting and training records, incidents, audits and management review live in one place, the system runs in daily work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope and interested parties
The scope, the internal and external issues and the interested parties are kept in one register and reviewed on a schedule, so they stay current as the business changes instead of being rewritten before each assessment.
Policies, roles and objectives
Policies, responsibilities and objectives with their measures, owners and dates live where the people who own them work; progress is reported from the system, not from a separate spreadsheet.
Risks and opportunities
A risk register with owners, actions and review dates; treatments tracked to closure and brought to management review automatically.
Competence, awareness and documented information
Training and competence records for every person, linked to Sterling Academy; documents with versions, approvals and distribution, so the current version is the only one in use.
Contracts, deployment and incidents
Contract risk assessments, deployment records, incident reports and subcontractor evaluations, each with its record created as the work is done.
Monitoring, internal audit and management review
Audit programmes, findings and follow-up; KPIs on live dashboards; a management review that records its inputs, decisions and actions.
Nonconformity, complaints and corrective action
Raised, investigated and closed with root cause and the evidence that the action worked; recurring issues visible to management before they become a finding.
Your own processes, forms and reports
Forms, fields, workflows and reports adapted to how you work, without code; legal and customer requirements tracked to the processes they affect.
What this means at the certification audit
The auditor asks for the legal register, risk assessments, training and vetting records, incident follow-up and the last management review. In Effivity each is a screen with owners and evidence attached. After certification, Sustain™ runs in the same workspace, so surveillance audits find a system that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for QMS, EMS, OHSMS, ISMS and more when you integrate other standards
Sterling Academy · ISO 18788 / PSC.1 e-learning
Train every guard and supervisor, not just the compliance team.
Sterling Academy delivers e-learning for the whole workforce and for the people who run the system: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for every employee, with evidence of competence
- Courses for supervisors, operations managers and the system lead
- Internal auditor training for the people who will audit the system, as applicable, as part of the engagement
- Learner progress by site and a training status report for the auditor
- New hires trained as they arrive, so evidence is current at every surveillance audit
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about ISO 18788 / PSC.1
ISO 18788 / PSC.1 resources
Services for ISO 18788 / PSC.1
Why Sterling
Want successful ISO 18788 certification? Come to Sterling.
Whether you run one contract or operations across several countries, Sterling helps you set shared security procedures with clear local ownership, adapted to the law and risks of each location.
Management systems in 60+ countries since 2003
Programmes delivered for organisations across sectors and every region we serve, with one engagement team accountable across every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any third-party fees identified separately. No surprises, ever.
A system your people can use
Less documentation and maximum effectiveness: documents, training and software connected to day-to-day work, so your people adopt the system rather than tolerate it.
Expert and experienced consultants
Consultants who have advised on management systems for service and operations businesses across sectors and countries, and who build it properly the first time, so the assessment confirms what already works.
The Sterling Promise
What our ISO 18788 certification success guarantee means
We stay with you until your agreed ISO 18788 or PSC.1 certification outcome is achieved, supporting implementation, preparation and the resolution of audit findings. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The independent certification body assesses conformity and retains its certification decision. Our commitment concerns the agreed certification support, not a promise of every future contract award.
FAQs
Frequently asked questions about ISO 18788 / PSC.1
What is the difference between ISO 18788 and PSC.1?
They cover the same ground from different publishers. ISO 18788 is published by ISO; ASIS PSC.1 is published by ASIS International. Your client, tender or scheme decides which one the certificate must name.
Does Sterling issue the ISO 18788 certificate?
No. Sterling provides consulting and hands-on support. An independent certification body conducts the audit and makes the certification decision.
Can ISO 18788 be combined with ISO 9001 or ISO 45001?
Yes. Document control, internal audit and management review can be shared in one integrated system, while the specific requirements of each standard are still addressed.
Talk to a consultant
Plan your ISO 18788 certification with confidence.
Tell us about your contracts, locations and target date. We will help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice