A shipment may pass through several carriers and warehouses between a factory and its customer. A security plan should show who takes responsibility at each stage, what information is retained and how a discrepancy is investigated. This page uses cargo movement as the basis for discussing node assessment and a pilot security plan.
Who may consider this and when
Manufacturers, traders, transport providers and warehouses involved in international supply chains may map a shipment when a route changes, outsourcing increases or a customer introduces security requirements. Include people who understand physical flows and outsourced contracts.
Common challenges
Factory dispatch records may be complete while the party receiving a transfer later is unknown. A seal irregularity may be reported only to the carrier, so the customer-delivery owner learns of it after arrival. Gaps often occur between nodes; additional factory patrols alone do not address them.
Approach and applicable requirements
ISO 28001:2007 includes requirements and guidance for international supply-chain security, including scope definition, security assessment, security plans and training. Its predecessor, ISO/PAS 28001:2006, is a separate publication and should not be confused with the formal standard. ISO catalogue
Potential work topics include:
- Define cargo flows and manageable boundaries: Record origin, destination, transfer and external handoff points. Separate activities under the organization's control from those requiring partner coordination.
- Assess security by node: Compare threats, vulnerabilities, incidents and customer conditions at each node. Retain the information used for risk decisions and note unresolved items.
- Plan security measures and partner training: Assign each measure an owner, timing and record. Test whether partners understand exception reporting and required training during a handoff.
Support and work stages
Map one selected cargo flow
Use an actual shipment route to record nodes and contract responsibilities, then confirm the assessment boundary.
Review risk at each stage
Have responsible contacts identify breaks in cargo, information and security responsibilities. Track missing external information.
Build and pilot a security plan
Choose an observable handoff and test whether measures, reporting and responsibilities work; retain exception-handling records.
Recheck partner understanding and changes
Confirm that requirements and training reach the people performing the work. Update the plan when routes or carriers change.
Possible outputs include a cargo-node map, security assessment, security plan, partner-requirements register and pilot results. A review should be able to trace a handoff irregularity to the responsible person, response conditions and required records.
Information to prepare
- Cargo origin, destination, route and transfer nodes.
- Carrier and warehouse contracts, subcontracting relationships and contacts.
- Customer requirements, current security measures and incident summaries.
- Sample handoff, seal inspection, training and improvement records.
Use an information index and de-identified samples initially. Confirm purpose, access and retention arrangements before sharing project information.
Schedule and fees
Review depth depends on chain segments, nodes, partners and access to cross-border information. AEO and C-TPAT eligibility reviews and applications should be checked separately; completing a security plan does not itself complete either application.
Frequently asked questions
Can we assess only one supply-chain segment?
Yes, if the segment is manageable and its start, end and external interfaces are explicit. Any public description should stay within that scope.
Does ISO 28001 directly grant customs status?
No. Supporting evidence may be organized for a program, but AEO and C-TPAT status is determined under each program's rules.
Does the word “guidance” mean it cannot be assessed?
Do not decide based on that word alone; the standard also contains requirements. Confirm the assessment method under the actual third-party program.
Can we reuse a customer security assessment?
Compare its scope, period and evidence purpose, then address any uncovered nodes and responsibilities.
What if a carrier will not provide all requested information?
Agree on essential handoff information and alternative evidence. Clearly identify unavailable data and assess controls the organization can apply itself.
Can a security contract serve as the whole security plan?
A contract usually covers only some responsibilities. The plan should also address chain risks, measures, handoffs and training.
Is certification included in system work?
Agree on it separately. Confirm the assessment body, accreditation scope, assessed entity and customer acceptance in advance.
Related services and enquiries
Share one representative shipment route, its nodes and outsourcing relationships to define an assessment boundary. Contact Captain International