ISO 18788 Certification for Private Security Operations
ISO 18788 is the international standard for managing private security operations. Certification shows governments, defense contractors, and humanitarian clients that use of force, weapons, and human rights risks are controlled on every assignment. Audits cover guarding, protective, and escort operations, with senior-led audits and a fixed fee. Most providers certify in 6–12 weeks.
What Is ISO 18788 Certification?
ISO 18788 certification is independent confirmation that a private security provider runs a security operations management system that meets the standard. The auditor checks how you assess risk to clients, staff, and local communities. They also check how you control the use of force and weapons, and how you report and investigate incidents. A successful audit leads to a certificate valid for three years.
The standard is written for security work where the rule of law may be weak or disrupted. That is why respect for human rights sits at its center, alongside the usual management system clauses on leadership, planning, and improvement.
The audit looks at what happens on the ground. We sample real assignments, talk to guards and supervisors, and trace incidents from the first report to the final lessons learned.
The 2015 Edition, the 2024 Climate Amendment, and the Current Review
The 2015 edition is the only edition. ISO published it in September 2015 through ISO/TC 292, the committee for security and resilience. It was confirmed in 2021 without changes.
A climate amendment applies since February 2024. Like other management system standards, the standard now asks you to decide whether climate change is a relevant issue for your organization. It also notes that interested parties may have climate-related requirements. Auditors check both points at your next visit.
The standard is under systematic review. The latest review closed in September 2026. ISO will now decide whether to confirm the 2015 edition again or start a revision. Your certificate stays valid either way, and any revision would come with a transition period.
Sources: ISO 18788:2015 (ISO) · Amendment 1:2024 (ISO) · DFARS 252.225-7039 (Acquisition.gov) · ICoCA-accepted certification bodies
Who Needs ISO 18788 Certification?
Security providers whose clients must prove they hired responsibly.
Private security functions under US and allied contracts. See ISO for defense.
Static guarding of embassies, bases, and critical sites.
Protection of executives, officials, and aid workers.
Movement of people, cargo, and cash. See ISO 28000.
Mines, oil fields, and pipelines in remote areas. See ISO for oil and gas.
Security for UN agencies, NGOs, and their compounds.
Where the Standard Is Required or Recognized
Clients ask for it in different ways. Check which route your contract names.
| Framework | What it says | What it means for you |
|---|---|---|
| DFARS 252.225-7039 | US defense contractors performing private security functions abroad must comply with PSC.1 or ISO 18788 | Your contract sets how conformance is shown |
| ANSI/ASIS PSC.1-2012 | The American standard the international one was built from | Close match; many requirements carry across |
| Montreux Document | States' legal obligations and good practice for private security | Background the standard puts into practice |
| International Code of Conduct | Principles for private security providers | Code commitments built into the system |
| ICoCA certification | Recognizes ISO 18788, PSC.1, and ISO 28007 from accepted certification bodies only | Accredify Global is not an ICoCA-accepted body |
| UN Guiding Principles | Business responsibility to respect human rights | Due diligence and grievance mechanisms |
If a client requires ICoCA membership, use an ICoCA-accepted body for that certification. If your client specifies how the certificate must be issued, tell us at scoping.
ISO 18788 Certification Requirements, Clause by Clause
The common management system structure, with security operations controls in clause 8.
| Clause | What it requires | What the auditor checks |
|---|---|---|
| 4. Context | Legal, human rights, and operating context, stakeholders, and scope | Which countries and services are in scope |
| 5. Leadership | Policy, commitment to human rights, roles, and authority | Leaders who own security risk decisions |
| 6. Planning | Risk assessment, legal requirements, and objectives | Risk assessments for each assignment |
| 7. Support | Resources, screening, competence, training, and communication | Vetting and training records for guards |
| 8. Operation | Use of force, weapons, apprehension, detention, incidents, and grievances | Rules applied on real assignments |
| 9. Performance | Monitoring, internal audit, and management review | Incident trends and audit results reviewed |
| 10. Improvement | Nonconformity, corrective action, and improvement | Lessons from incidents acted on |
The Operational Controls Auditors Test
These controls are what set the security operations standard apart from ISO 9001.
Force, weapons, and people
- Written rules for the use of force, based on local law
- Weapons and ammunition licensed, issued, and recorded
- Rules for apprehension, search, and handover to authorities
- Background screening before deployment
- Training on force, first aid, and human rights
Incidents and accountability
- Every use of force reported and investigated
- Grievance channels open to staff and communities
- Whistleblowers protected from retaliation
- Subcontractors held to the same standards
- Community relations planned for each site
Expect the auditor to pick a few recent incidents and follow each one through. They will read the first report, check who was told and when, and look at the investigation and its outcome. They will also check whether training or rules changed as a result. A complete trail matters more than a low incident count.
How Security Operations Certification Works
From scoping to certificate. The ISO certification process guide explains each step.
Bidding on a contract that names the security operations standard? Tell us the deadline in your scoping review.
Book a free scoping reviewCommon Security Operations Audit Findings
The gaps that most often delay a certificate.
Head office findings
- Human rights risk assessment done once, not per assignment
- Legal register missing host-country firearms law
- Subcontractor vetting not checked
- Grievance mechanism exists but nobody knows about it
- Climate change not considered in context
Field findings
- Weapons logs not reconciled at shift change
- Refresher training overdue
- Minor uses of force not reported
- Rules for force not in the local language
- Incident investigations closed without root cause
ISO 18788 Certification Cost and Timeline
There is no price list. The audit man-days your operations need set one fixed fee.
What sets the audit man-days
- People: guards, supervisors, and office staff
- Sites: head office, operating bases, and client sites
- Countries: each legal and risk setting in scope
- Services: armed, unarmed, escort, or protection
- Integration: combined with ISO 9001 or 45001
How long it takes
| Proposal | Days after scoping |
|---|---|
| To certificate | Usually 6–12 weeks |
| Surveillance | Every year |
| Recertification | Before the end of year three |
How to Choose an ISO 18788 Certification Body
What security providers usually ask us before signing.
| Question to ask | Accredify Global's answer |
|---|---|
| Who issues our certificate? | Your proposal names the certification body, before you commit. |
| Will it count for ICoCA? | No. ICoCA only accepts its listed bodies, and we are not one of them. |
| Will you visit operating sites? | Yes. We sample real sites and interview guards. |
| Can clients check the certificate? | Yes. Certificates appear on our verification page. |
| Will you write our procedures? | No. We do not consult, so every audit stays impartial. |
| How is it priced? | A fixed fee, set by audit man-days, in a tailored proposal. |
Frequently Asked Questions About ISO 18788 Certification
Straight answers on PSC.1, ICoCA, use of force, cost, and timeline.
What is ISO 18788 certification?
ISO 18788 certification is independent confirmation that a private security provider runs a security operations management system that meets the standard. It shows clients that use of force, weapons, human rights and incidents are controlled in practice.
What is the current version of ISO 18788?
ISO 18788:2015, published in September 2015, is the only edition. Amendment 1, published in February 2024, added climate change to the context clauses. ISO is reviewing the standard, and its current systematic review closed in September 2026.
Who needs ISO 18788 certification?
Private security companies that guard sites, protect people or escort convoys, especially in complex or high-risk environments. Clients include governments, defense contractors, UN agencies, NGOs, and extractive companies.
Is ISO 18788 the same as ANSI/ASIS PSC.1?
They are closely related. PSC.1-2012 was the American national standard for private security company operations, and the international standard was developed from it as an international standard in 2015. Both build on the Montreux Document and the International Code of Conduct.
Do US defense contracts require ISO 18788?
DFARS 252.225-7039 requires defense contractors performing private security functions outside the United States to comply with ANSI/ASIS PSC.1 or ISO 18788. The clause sets the standard to meet; your contract states how conformance must be shown.
Does this certification give ICoCA membership?
Not by itself. ICoCA only accepts certificates from its accepted certification bodies, and Accredify Global is not on that list. If you need ICoCA certification, choose an ICoCA-accepted body for that audit.
What does the standard require on use of force?
You must set rules for the use of force based on law and human rights, and train staff on them. Every use of force must be reported and investigated. Force must be necessary, proportionate, and a last resort.
Does the standard cover human rights?
Yes. Respect for human rights is central. You must assess human rights risks, prevent abuses, provide a grievance mechanism, and report and investigate incidents.
What is the difference between ISO 18788 and ISO 28007?
ISO 18788 covers land-based private security operations. ISO 28007-1 gives guidelines for private maritime security companies providing armed guards on board ships.
Can security operations certification be combined with ISO 9001 and ISO 45001?
Yes. The standard uses the common management system structure. It can be audited together with ISO 9001, ISO 45001 or ISO 14001 in one integrated audit.
How long does ISO 18788 certification take?
Most security providers with a working system certify in 6 to 12 weeks from Stage 1 to the certificate. Operations in several countries or high-risk locations take longer.
How much does ISO 18788 certification cost?
The cost follows the audit man-days your scope needs. Headcount, sites, countries, armed or unarmed services and the risk of each operation set the man-days. A free scoping review gives you a tailored, fixed-fee proposal.
Will auditors visit our operating sites?
Yes. Auditors sample head office and real operating sites, interview guards and supervisors, and check weapons, training and incident records. Access rules for high-risk sites are agreed in advance.
Is accredited ISO 18788 certification available?
Yes, from certification bodies accredited for the standard. Your proposal names the certification body that will issue your certificate. If a buyer requires accredited certification, tell us at scoping.
Does Accredify Global write our rules for the use of force?
No. Certification must stay impartial, so neither we nor the certification body can write your procedures. Your team, or a consultant you choose, closes any gaps.
Show Clients Your Security Work Is Lawful and Accountable
Tell us about your services, countries, and deadlines. We'll confirm your certification scope and send a fixed-fee proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.