It suits private security companies and the organisations that contract them. Extractive and development projects may require it from security providers.

• A gap assessment compares current practice with the requirements.
• Top management approves the scope, the policy and the objectives.
• Legal, human rights and safety risks of operations are assessed, with rules for the use of force.
• Processes run long enough to produce evidence for the auditor.
• An internal audit and a management review are completed.
• Stage 1 and Stage 2 audits by the certification body lead to the certificate.

Headcount, the number of sites and the scope of the system drive most of the cost. Existing practice matters, because every gap takes staff time and outside support to close. Audit days are set by the certification body from headcount and complexity under accreditation rules. The number of guards, sites and armed operations in scope drives the effort. Surveillance audits follow in each of the two years after certification.

Time depends on size, scope and readiness. Small organisations with sound practice often finish in four to six months. Larger or multi-site organisations commonly need nine to twelve months. A certificate runs for three years before recertification.

Certificates are issued by certification bodies accredited to ISO/IEC 17021-1. Your implementer and your auditor are always different, so the audit stays independent.