Two-minute brief
ISO 28000 requirements explained: video brief
A two-minute brief on ISO 28000:2022 and where the security content sits inside the shared management system structure.
Key takeaways
- ISO 28000 follows clauses 4 to 10 with security content inside them.
- Context includes legal, regulatory and voluntary security obligations.
- Clause 8 covers risk assessment and treatment, controls, strategies and security plans.
- Supply chain partners fall within the system's view.
- ISO 28000:2022 replaced the 2007 edition.
Security content inside the shared structure
ISO 28000:2022 uses the common ISO management system clauses 4 to 10, with the security content inside it: principles in clause 4, security-related risks and opportunities in clause 6, and in clause 8 risk assessment and treatment, controls, security strategies and treatments, and security plans. This short film maps that structure.
Context asks the organisation to understand itself and its context, the interested parties, the legal, regulatory and other requirements, the principles the system follows and its scope. The evidence is a scope naming the sites, flows and supply chain segments covered, a register of customs, transport and contractual security obligations, and a list of the parties involved, from shippers to guarding contractors. Leadership commits to the system and sets a security policy, and planning addresses security-related risks and opportunities and sets objectives.
From risk assessment to security plans
Clause 8 turns planning into operation. Security-related risks are assessed and treated, controls are implemented, security strategies and treatments are chosen, and security plans set out how the organisation will respond. Support provides competent people, awareness, communication and documented information, and performance evaluation and improvement complete the cycle by monitoring security performance, auditing internally, reviewing at management level and correcting what fails.
The standard applies to organisations of any type or size; in practice to manufacturers and exporters, forwarders and customs brokers, carriers, warehouses, ports, terminals and the shippers that depend on them. ISO 28000:2022, with Amendment 1:2024, replaced the 2007 edition, which was withdrawn in March 2022. An independent, accredited certification body audits and decides, and the system gives a managed structure to the security work customs programmes look at.
An ISO 28000 certificate does not grant AEO or C-TPAT status: AEO is a customs status granted by a customs authority, and C-TPAT is a voluntary programme run by U.S. Customs and Border Protection. ISO/IEC 27001 covers only part of the ground, since its object is information, while ISO 28000 manages cargo, premises, conveyances, people and the processes between them; one risk method can serve both systems.
ISO 28000 at a glance
- Purpose
- Security management: assessing the security environment, treating security-related risks and keeping controls and security plans working, including across the supply chain
- Relevant to
- Organisations of any type or size; in practice manufacturers, logistics providers, carriers, forwarders, warehouses, ports and the shippers that depend on them
- Edition
- ISO 28000:2022 with Amendment 1:2024; replaced ISO 28000:2007, withdrawn in March 2022
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Consulting with your team, Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 28000 security management system depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 28000: questions people ask
Is ISO 28000 only for logistics and transport companies?
No. The 2022 edition is written for all types and sizes of organisation and is not sector specific; the supply chain is one aspect it covers, not its only subject. Logistics providers, ports and carriers are the most frequent users, but a manufacturer or a security company implements it on the same clauses.
What is the difference between ISO 28000 and ISO 28001?
ISO 28000 is the certifiable management system standard. ISO 28001:2007 is best practice for implementing supply chain security, assessments and plans in international supply chains, written to help meet the authorised economic operator criteria of the World Customs Organization's SAFE Framework. A programme can apply ISO 28001 to the supply chain segment while the system is certified to ISO 28000; ISO 28004-4 guides that combination.
Does ISO 28000 certification give us AEO or C-TPAT status?
No. AEO is a customs status granted by a customs authority, in the EU by the AEO-competent customs authority of a member state, and C-TPAT is a voluntary partnership programme run by U.S. Customs and Border Protection. Neither is issued by an ISO certification body, and an ISO 28000 certificate replaces neither application. What the system does is put the criteria those programmes check into one owned, evidenced system, so each application, validation and renewal draws on existing records.
How does ISO 28000 relate to TAPA FSR and TSR?
TAPA's Facility Security Requirements and Trucking Security Requirements are the standards of the Transported Asset Protection Association, with their own levels, audits by TAPA-approved independent audit bodies, a self-certification route for the lowest level and a three-year review cycle. They specify the security a facility or a road carrier must meet; ISO 28000 specifies how the organisation manages security as a whole. Many logistics providers hold both.
We hold ISO/IEC 27001. Does it cover supply chain security?
Only in part. ISO/IEC 27001 manages information security risks; its controls touch supplier and physical security, but its object is information. ISO 28000 manages the security of the organisation and its supply chain as such: cargo, premises, conveyances, people and the processes between them. One risk method can serve both; the risk assessment, controls and plans still have to be done for ISO 28000.
Keep exploring
Related to this video
The complete guide
Everything on ISO 28000
Start with the ISO 28000 page, or go straight to the guide you need.
On the ISO 28000 page
- What are the main ISO 28000 requirements?
- How do you get ISO 28000 certified?
- How much does ISO 28000 certification cost?
- How long does ISO 28000 certification take?
- Who needs ISO 28000 certification?
- How ISO 28000 protects the operation and the business around it
- Frequently asked questions about ISO 28000
More videos: Supply chain, logistics and customs
Talk to a consultant
Plan your ISO 28000 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice