What Is ISO 28000:2022 in Qatar and How Does ISO 28000 Certification Work?

ISO 28000 Certification in Qatar, Requirements and Process

Quick answer: ISO 28000:2022 Qatar compliance means running a security management system (SeMS) that meets the international standard for security and resilience. ISO 28000 certification in Qatar is the independent audit that confirms it. The system covers security risk assessment, controls, security incident response and continual improvement, and it suits ports, airports, logistics, energy and critical infrastructure.

What Is ISO 28000:2022 and What Does a Security Management System Cover?

ISO 28000:2022 is titled “Security and resilience, Security management systems, Requirements”. ISO Technical Committee TC 292 published it in March 2022 as the second edition. A security management system is a coordinated set of policies, roles, processes and records that protect people, assets, facilities, information and supply chain operations. The threats it addresses include theft, cargo tampering, smuggling, sabotage, fraud and unauthorised access.

It applies to any organisation, whatever its size or sector. It is also the requirements standard that an auditor assesses you against. Other documents in the ISO 28000 family, such as ISO 28001 and ISO 28002, offer supporting material.

What Changed in ISO 28000:2022 Compared With the 2007 Edition?

The 2022 edition is broader and easier to integrate:

The scope moved from supply chain security alone to security management across the whole organisation.
It follows the Annex SL high level structure, so it fits alongside ISO 9001, ISO 27001 and ISO 22301.
It aligns with ISO 31000, so security decisions are based on risk.
Context analysis and stakeholder needs carry more weight.
Amendment 1:2024 added climate action considerations.

The transition period for the 2007 edition has closed, so the 2022 edition is what auditors use today.

Why Does ISO 28000:2022 Matter in Qatar?

Qatar positions itself as a regional trade and logistics hub, so ISO 28000 security management Qatar projects tend to cluster around a few sectors. Hamad Port, operated under Mwani Qatar, handles container and general cargo. Hamad International Airport moves courier and air freight. LNG shipping and energy supply chains linked to QatarEnergy depend on secure handling and trusted contractors. Qatar Free Zones tenants, pharmaceutical distributors, high value goods importers, banks handling cash in transit and critical infrastructure operators also face clear security exposure.

Customers and tender teams increasingly ask for evidence of structured security management. Always check what your own regulator, tender document or contract actually requires.

What Are the ISO 28000:2022 Requirements From Clause 4 to 10?

Clause	What it asks you to do
Clause 4, Context	Define the SeMS scope, interested parties and the principles behind your security decisions.
Clause 5, Leadership	Top management owns the security policy and assigns responsibilities.
Clause 6, Planning	Run a security risk assessment, plan risk treatment, record controls in a statement of applicability and set measurable security objectives.
Clause 7, Support	Provide resources, competent people, awareness training and controlled documented information.
Clause 8, Operation	Apply controls in daily work, manage outsourced security activities and maintain security incident response procedures.
Clause 9, Performance evaluation	Monitor results, run internal audits and hold management reviews.
Clause 10, Improvement	Correct nonconformities and learn from every incident.

How Does ISO 28000 Fit With ISO 27001, ISO 22301, AEO and ISPS Code?

ISO 28000 is voluntary and certifiable. The ISPS Code is an international ship and port security regulation, and AEO is a customs trusted trader programme. ISO 28000 does not replace them, but it gives you the management system and records that support them. ISO 27001 covers information security, while ISO 28000 covers physical, operational and supply chain security. ISO 22301 adds business continuity, and ISO 45001 helps where security and worker safety overlap. Combining them avoids duplicate risk registers and audits.

What Evidence Do Auditors Ask For During a Stage 2 Security Audit?

Auditors sample real proof, not just manuals. Prepare an evidence index that maps each clause to the record that proves it. Expect requests for:

The scope statement and a security policy approved by top management
The risk register, assessment method and treatment plan
The statement of applicability, with reasons for any excluded controls
Competence and training records for security and operations staff
Access control logs, visitor records, key control and CCTV procedures
Security checks on suppliers, transporters and guard contractors
Incident reports showing investigation and corrective action
Records of drills or exercises that tested your response plan
The internal audit report and management review minutes

Auditors also interview staff and walk the site, so the people on the floor must be able to explain their own security duties.

What Are the Most Common Mistakes Qatar Organisations Make During ISO 28000 Implementation?

Copying a template manual: generic documents rarely match real sites, shifts or cargo flows.
Writing a vague scope: if sites, activities and exclusions are unclear, every later decision weakens.
Treating risk assessment as a guard checklist: good assessments also cover people, suppliers, information flows and insider threats.
Ignoring contractors: guard companies, transporters and warehouse partners often hold the weakest controls.
Never testing incident response: a procedure that has not been drilled is only a document.
Leaving leadership out: without management review, the system fades after the audit.
Running parallel systems: separate risk registers for each standard waste time and create conflicts.

How Does ISO 28000 Certification in Qatar Work?

The path starts with a gap analysis against ISO 28000:2022, followed by system design, implementation, internal audit and management review. A Stage 1 audit checks readiness and documentation. A Stage 2 audit samples evidence and observes security operations on site. After a positive certification decision, the certificate is normally valid for three years, with annual surveillance audits and a recertification audit before the cycle ends. Timelines depend on your size, number of sites and threat exposure, so plan from your own gap analysis.

How Do You Verify an Accredited ISO 28000 Certification Body?

Not every certificate carries equal weight. Accreditation means an independent accreditation body has assessed the certification body’s competence against ISO/IEC 17021. Before paying for any ISO 28000 certification in Qatar:

Ask for the accreditation certificate and confirm ISO 28000 is named in its scope.
Confirm the accreditation body is an IAF MLA signatory.
Check the certificate on IAF CertSearch where available.
Ask your customer or tender authority in writing whether an unaccredited scheme is acceptable.

Final Thoughts

ISO 28000:2022 gives Qatar’s trade, energy and infrastructure organisations a clear way to manage security risk and prove it. Define your scope, run a real risk assessment, collect strong evidence and choose an accredited route that your customers accept.

Frequently Asked Questions (FAQs)

What is ISO 28000 certification in Qatar?

It is third party confirmation that an organisation in Qatar runs a security management system meeting ISO 28000:2022. Its value depends on the issuing body and its accreditation.

How much does ISO 28000 certification cost in Qatar?

Cost depends on headcount, number of sites, operational complexity, threat exposure and integration with other standards. Request written quotations that list audit days and surveillance fees.

How long does ISO 28000 implementation take?

It depends on your starting point. Organisations with mature security practices can move faster than those building a system from scratch.

Is ISO 28000 the same as ISO 27001?

No. ISO 27001 covers information security. ISO 28000 covers physical, operational and supply chain security.

Does ISO 28000 replace ISPS or AEO?

No. It supports them but each framework keeps its own rules.

Recent blogs