Implementation walkthrough
How to implement ISO 28000: video walkthrough
A walkthrough of implementing an ISO 28000 security management system that works at the gate, in the yard and with supply chain partners.
Key takeaways
- ISO 28000 covers the security environment, including the supply chain and dependencies.
- Scope names sites, flows, supply chain segments and partners.
- Security risks are assessed and treated, then controls and security plans put in place.
- Customs, transport and contractual security obligations are recorded and managed.
- An accredited certification body audits and decides.
Security management across the supply chain
ISO 28000 is the international standard for security management systems, developed by ISO/TC 292 on security and resilience. It specifies the requirements for a system that assesses the security environment an organisation operates in, including its supply chain and dependencies, decides whether existing security measures are adequate for the security-related risks, manages compliance with the obligations the organisation has accepted, and aligns security processes and controls upstream and downstream with its objectives.
The practical question is where a breach of security would hurt: a container that leaves a terminal with something added or removed, stock that walks out with a contractor, or a data feed that tells a criminal which truck carries what. This short film walks through how a security management system that answers that question is implemented.
The 2022 edition is written for organisations of all types and sizes; logistics providers, ports and carriers are the most frequent users, but manufacturers and security companies implement it on the same clauses.
Implementation comes before the assessment
No audit can certify a system that is not yet running, so implementation comes first. Decide what the certificate must cover: the sites, flows, supply chain segments and partners in scope, the parties who will rely on the certificate and the intended certification scope. A gap analysis then measures current security arrangements against the standard, keeps what works and agrees actions with owners and dates.
Implementation assesses and treats security-related risks, puts controls into operation, defines security strategies and treatments and writes security plans, with obligations from customs, transport and contracts recorded and partners from shippers to guarding contractors brought into the system. Internal audit and management review follow before an independent, accredited certification body audits the system and decides. ISO 28000 also gives a managed structure to security work that customs programmes such as AEO and C-TPAT look at.
Sterling's expert and experienced consultants support the preparation and implementation under Sterling OS™, with the system held in Effivity. The current edition is ISO 28000:2022 with Amendment 1:2024.
ISO 28000 at a glance
- Purpose
- Security management: assessing the security environment, treating security-related risks and keeping controls and security plans working, including across the supply chain
- Relevant to
- Organisations of any type or size; in practice manufacturers, logistics providers, carriers, forwarders, warehouses, ports and the shippers that depend on them
- Edition
- ISO 28000:2022 with Amendment 1:2024; replaced ISO 28000:2007, withdrawn in March 2022
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Consulting with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 28000 security management system depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 28000: questions people ask
Is ISO 28000 only for logistics and transport companies?
No. The 2022 edition is written for all types and sizes of organisation and is not sector specific; the supply chain is one aspect it covers, not its only subject. Logistics providers, ports and carriers are the most frequent users, but a manufacturer or a security company implements it on the same clauses.
What is the difference between ISO 28000 and ISO 28001?
ISO 28000 is the certifiable management system standard. ISO 28001:2007 is best practice for implementing supply chain security, assessments and plans in international supply chains, written to help meet the authorised economic operator criteria of the World Customs Organization's SAFE Framework. A programme can apply ISO 28001 to the supply chain segment while the system is certified to ISO 28000; ISO 28004-4 guides that combination.
Does ISO 28000 certification give us AEO or C-TPAT status?
No. AEO is a customs status granted by a customs authority, in the EU by the AEO-competent customs authority of a member state, and C-TPAT is a voluntary partnership programme run by U.S. Customs and Border Protection. Neither is issued by an ISO certification body, and an ISO 28000 certificate replaces neither application. What the system does is put the criteria those programmes check into one owned, evidenced system, so each application, validation and renewal draws on existing records.
How does ISO 28000 relate to TAPA FSR and TSR?
TAPA's Facility Security Requirements and Trucking Security Requirements are the standards of the Transported Asset Protection Association, with their own levels, audits by TAPA-approved independent audit bodies, a self-certification route for the lowest level and a three-year review cycle. They specify the security a facility or a road carrier must meet; ISO 28000 specifies how the organisation manages security as a whole. Many logistics providers hold both.
We hold ISO/IEC 27001. Does it cover supply chain security?
Only in part. ISO/IEC 27001 manages information security risks; its controls touch supplier and physical security, but its object is information. ISO 28000 manages the security of the organisation and its supply chain as such: cargo, premises, conveyances, people and the processes between them. One risk method can serve both; the risk assessment, controls and plans still have to be done for ISO 28000.
Keep exploring
Related to this video
The complete guide
Everything on ISO 28000
Start with the ISO 28000 page, or go straight to the guide you need.
On the ISO 28000 page
- What are the main ISO 28000 requirements?
- How do you get ISO 28000 certified?
- How much does ISO 28000 certification cost?
- How long does ISO 28000 certification take?
- Who needs ISO 28000 certification?
- How ISO 28000 protects the operation and the business around it
- Frequently asked questions about ISO 28000
More videos: Supply chain, logistics and customs
Talk to a consultant
Plan your ISO 28000 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice