ISO 28000

(Specification for security management systems for the supply chain)

ISO 28000:2022, Security and resilience – Security management systems – Requirements, is a management system standard published by International Organization for Standardization that specifies requirements for a security management system including aspects relevant to the supply chain. The standard was originally developed by ISO/TC 8 on "Ships and maritime technology" and published in 2007. In 2015 the responsibility for the ISO 28000 series was transferred to ISO/TC 292 on "Security and resilience", who in 2019 decided to start a revision. A justification study for the revision was accepted by ISO TMB (Technical Management Board). The revised version of ISO 28000 was published on March 15, 2022.ISO 28000:2022, Security and resilience – Security management systems – Requirements, is a management system standard published by International Organization for Standardization that specifies requirements for a security management system including aspects relevant to the supply chain. The standard was originally developed by ISO/TC 8 on "Ships and maritime technology" and published in 2007. In 2015 the responsibility for the ISO 28000 series was transferred to ISO/TC 292 on "Security and resilience", who in 2019 decided to start a revision. A justification study for the revision was accepted by ISO TMB (Technical Management Board). The revised version of ISO 28000 was published on March 15, 2022.

Why ISO 28000?

The ISO 28000 standard provides a best practice framework to reduce risks for people and cargo within the supply chain. It helps manage and mitigate potential security within the logistics area, targeting threats such as terrorism, fraud and piracy.

...

ISO 28000:2007 specifies the requirements for a security management system, including those aspects critical to security assurance of the supply chain. Security management is linked to many other aspects of business management. Aspects include all activities controlled or influenced by organizations that impact on supply chain security. These other aspects should be considered directly, where and when they have an impact on security management, including transporting these goods along the supply chain.ISO 28000:2007 is applicable to all sizes of organizations, from small to multinational, in manufacturing, service, storage or transportation at any stage of the production or supply chain that wishes to:

a) establish, implement, maintain and improve a security management system;

b) assure conformance with stated security management policy;

c) demonstrate such conformance to others;

d) seek certification/registration of its security management system by an Accredited third party Certification Body;

or

e) make a self-determination and self-declaration of conformance with ISO 28000:2007.There are legislative and regulatory codes that address some of the requirements in ISO 28000:2007.It is not the intention of ISO 28000:2007 to require duplicative demonstration of conformance.Organizations that choose third party certification can further demonstrate that they are contributing significantly to supply chain security.