ISO 28000 Supply Chain Security Management

An access log may show who entered a site without showing who approved an exception. A delivery may be signed for while responsibility for handling an irregularity remains unclear. Security management starts by identifying who makes decisions at these handoffs, what information supports the decision and how work continues after an issue is found.

Service classification and standard

Management System Auditing (MS). Depending on scope and applicable edition, work may cover system implementation, internal audits, supplier audits or external audit preparation. An independent certification body makes certification decisions under its own procedures.

The service focuses on security risks, supply-chain nodes, access protection, external partners and response arrangements.

Who may consider this and when

Sites, warehouses, logistics operations and other organizations with security needs may map their sites and external interfaces when adding locations, changing carriers or consolidating security operations. Applicability is not limited to logistics companies.

Common challenges

Patrols and surveillance systems may operate separately without bringing security information together. Different shifts may respond differently to suspicious visitors, seal irregularities or unauthorized access. Without shared decision criteria and reporting responsibilities, the same gaps can recur at other sites.

Approach and applicable requirements

ISO 28000:2022 and Amendment 1:2024 specify security management system requirements for supply-chain-related security aspects and can apply across industries and organization sizes. The scope is broader than a single logistics activity or equipment safeguard. ISO catalogue

Potential project topics include:

Threats, vulnerabilities and site controls: Identify important areas and activities, then check authorization and inspection arrangements for personnel, visitors, vehicles and goods.
Partners and goods movement: Connect carrier, warehouse and outsourced responsibilities to handoff conditions; define how irregular cargo, data differences and access changes are reported.
Incidents, recovery and internal review: Plan isolation, communication, decisions and resumption of operations; use drills and inspections to set training, audit and improvement actions.

Support and work stages

Walk through an access process

Compare actual practice with procedures. Record who can authorize entry, who retains records and which exceptions have no clear owner.

Match controls to risk

Assign high-priority vulnerabilities to facilities, operations, security or external partners, with clear verification and escalation steps.

Trace handoffs and reports

Use a representative visitor, shipment or access change to test whether different shifts follow the same control principles.

Adjust arrangements after a drill

Check whether information reaches decision-makers and recovery criteria are clear; track actions and their applicability at other sites.

Possible outputs include a site and interface map, security-risk register, authorization and handoff rules, incident procedures and drill improvement records. A review should be able to trace who receives an irregularity, how it is handled and when operations can resume.

Information to prepare

Site and critical-area plans, plus personnel, vehicle and goods access flows.
Security, carrier and warehouse contracts and responsibility summaries.
Sample authorization, patrol, visitor and goods-handoff records.
Security incidents, drills and prior improvement actions.

For an initial discussion, use an information index and de-identified samples. Confirm purpose, access and retention arrangements before sharing project information.

Schedule and fees

Sites, shifts, handoff models and number of partners determine interview and review depth. Access-control or surveillance projects, outsourced security operations and customs-program applications need separate scopes. Third-party certification is arranged independently.

Frequently asked questions

We already have a security contract. What else should be reviewed?

Confirm which risks the contract covers, who decides exceptions and how responsibilities pass between the organization and the security provider.

Can a manufacturer use ISO 28000?

Yes. Define the scope around relevant security activities and responsibilities; the standard is not limited to logistics businesses.

How does ISO 28000 differ from ISO 28001?

ISO 28000 focuses on the overall security management system. ISO 28001 provides requirements and guidance for international supply-chain security assessments and plans.

Does an ISO certificate grant AEO or C-TPAT status?

No. Customs and other programs have their own application, assessment and eligibility conditions.

Do we need to test the system if no incident has occurred?

Use risk scenarios to test reporting and decision arrangements that may not be used routinely. Few incidents alone do not prove that controls are effective.

Can we copy procedures when moving to a new warehouse?

First compare routes, external responsibilities and risks, then decide which common elements remain suitable.

Who decides whether a certificate is issued?

The selected third party independently evaluates the organization against its program and scope. Management-system planning does not replace that decision.

Share the site type, main handoffs and a brief summary of a recent security exception to begin a discussion. Contact Captain International