OGP Report 510 – Operating Management System Framework refers to a management system as ‘a structured and documented set of interdependent practices, process and procedures used by the managers and the workforce at every level in a company to plan, direct and execute activities.’ A security management system may be considered as that part of the overall management system that provides the structure to enable identification of potential threats to an organisation and which establishes, implements, operates, monitors, reviews and maintains all appropriate measures to provide assurance of the effective management of the associated security risks. This document provides a high-level view of what the main components of a security management system could be, based upon the guidance in IOGP Report 510. It is not intended to be prescriptive, and organisations are encouraged to develop their own systems based on the guidance set out in this document and IOGP Report 510.