ISO 28000

Who has to comply

Voluntary. It is asked for by customers and by customs and trade programs rather than by law: freight forwarders, ports and terminals, carriers, warehousing and logistics providers, manufacturers with international supply chains, and suppliers to critical infrastructure.

Certification is often used as supporting evidence for customs trusted-trader programs such as C-TPAT in the United States and Authorized Economic Operator (AEO) status elsewhere, but those programs have their own criteria and do not require ISO 28000.

What the assessor asks to see

Scope of the security management system; security policy signed off by top management; context, interested parties and applicable legal, regulatory and contractual security requirements; security risk assessment and treatment plan; security objectives and plans to reach them; roles, responsibilities and competence records; documented procedures for operational security controls (access to sites and cargo, personnel security, information handling, incident response); records of security incidents and how they were handled; monitoring and measurement results; internal audit reports; management review minutes; nonconformities and corrective actions.

Where the requirement sits: 5.2 policy; 6.1 risk assessment and treatment; 7.5 documented information; 8.1 operational planning and control; 9.2 internal audit; 9.3 management review

Edition and status

Current edition: ISO 28000:2022 (2nd edition), published 2022-03, 20 pages; Amendment 1:2024 adds climate action wording. Status on iso.org: Published, stage 60.60. Supersedes ISO 28000:2007, withdrawn.

Maintained by ISO/TC 292. ICS 03.100.01 and 03.100.70. The text is sold by ISO (CHF 155 for the 2022 edition); it is not free to read.

ISO 28001, the supply chain guidance

ISO 28001:2007 (Security management systems for the supply chain: best practices for implementing supply chain security, assessments and plans) is the companion guidance document.

ISO's abstract says it helps organizations in international supply chains develop and implement supply chain security processes, establish and document a minimum level of security within a supply chain, and meet the Authorized Economic Operator criteria in the World Customs Organization SAFE Framework. It was reviewed and confirmed in 2021 and remains current.

It is guidance rather than a separate certification scheme, so it is covered here rather than on its own page.

Who certifies it

Certification bodies that name ISO 28000 on their own websites are on our ISO certification bodies page; filter it for ISO 28000. Firms whose websites offer ISO 28000 consulting are listed below. Related pages on this site: C-TPAT (the US customs trusted-trader program) and NIST SP 800-161 (supply chain risk management for US federal systems).