ISO 28000 · Security management systems
ISO 28000 certification consulting for security that holds from your suppliers to your customers.
Achieve ISO 28000 certification from an independent, accredited body, first time, with a security management system built around the goods, information and people that actually move through your operation and supply chain. Sterling's expert and experienced consultants work with your operations, security and logistics people: the security environment assessed, risks treated, controls running in daily work, security plans exercised and the records an auditor will test kept as work is done, in 60+ countries. We ensure successful certification for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced supply chain security consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO 28000 client experience
What it is
What is ISO 28000 and what is it used for?
ISO 28000 is the international standard for security management systems, developed by ISO/TC 292 (security and resilience). It specifies the requirements for a management system that assesses the security environment an organisation operates in, including its supply chain and its dependencies, decides whether the security measures in place are adequate for the security-related risks, manages compliance with the statutory, regulatory and voluntary obligations the organisation has accepted, and aligns security processes and controls, upstream and downstream, with its objectives.
The practical question for your business is where a breach of security would hurt: a container that leaves a terminal with something added or removed, stock that walks out with a contractor, a data feed that tells a criminal which truck carries what. Most organisations manage those exposures through a guarding contract, a customs status and a customer's questionnaire, each in a different file. ISO 28000 puts them into one managed system with an owner, a risk assessment, controls, plans and evidence.
Current edition. ISO 28000:2022, published 15 March 2022, is the second edition. It replaced ISO 28000:2007, "Specification for security management systems for the supply chain", withdrawn the same day, moved the standard on to the harmonised structure of the ISO management system standards, added principles in clause 4 for coordination with ISO 31000 and added security strategies, treatments and plans in clause 8 for consistency with ISO 22301. Amendment 1:2024, published 23 February 2024, adds the requirement to determine whether climate change is a relevant issue and a note that interested parties can have climate-related requirements; it is treated as a clarification, with no transition programme. No revision is in progress; ISO/TC 292 is preparing guidance on applying ISO 28000 in the supply chain (ISO 28018) and on security management system processes (ISO 28022). Certificates are issued to ISO 28000:2022; if yours still refers to the 2007 edition, confirm the arrangements with your certification body.
Who it is for
Who needs ISO 28000 certification?
ISO 28000 applies wherever a security failure would damage the organisation or the supply chain it serves: manufacturers and exporters, forwarders and customs brokers, carriers, warehouses, ports, terminals and ground handlers, security and cash-in-transit companies, and the shippers of pharmaceuticals, electronics and other goods that criminals target. The certificate's scope should name the sites and supply chain segments the system will actually secure. Organisations come to Sterling for ISO 28000 from four starting points:
- Nobody has asked, and the loss record says something must change. Pilferage, tampered seals, a hijacked consignment, a smuggling attempt through your facility or an insurer's letter after a claim. ISO 28000 replaces reaction with a system that assesses, treats and checks.
- A shipper, customer or tender asks for it. Shippers of pharmaceuticals, electronics and high-value goods expect their logistics providers to show a managed security system before they award lanes or contracts. Clarify the scope, sites and accreditation they expect before you invest.
- You are applying for, or renewing, a customs or industry status. AEO, C-TPAT and TAPA each check security criteria on their own terms and calendar. A management system gives those criteria one home, so the evidence for each is a by-product of daily work, not a separate project.
- You hold ISO/IEC 27001, ISO 22301 or ISO 9001 and supply chain security is the gap. Information is protected, continuity is planned and quality is managed, but cargo, premises, people and partners are covered by a guarding contract and a few procedures. The system needs a security layer built on a risk assessment, not another policy.
The intended benefit is fewer security incidents, smaller consequences when one occurs, and the evidence that security is managed deliberately across your sites and the partners you depend on. The certificate records that; the result comes from implementation, and from the people who run operations keeping ownership of the system.
Business benefits
How ISO 28000 protects the operation and the business around it
A security management system should reduce the losses, disruptions and liabilities that come from theft, tampering, unauthorised access and misuse of your supply chain. We start where your exposure and your incident history meet, and build the system around those flows and partners.
- Fewer incidents, smaller consequencesRisks assessed on the real flows of goods, information and people, treatments chosen and resourced, and security plans that say who does what when something happens.
- Security decided on evidence, not on the last eventIncidents, inspection results and partner performance read together, so investment goes to the exposure that matters, not the one that made the news.
- One evidence base for every audienceShipper audits, customs validations, TAPA audits and insurer reviews answered from the same records, kept current because they are used.
- Partners managed on stated requirementsSecurity expectations for carriers, warehouses, forwarders and contractors written into agreements, verified and reviewed, with the boundary of your control explicit.
- Obligations kept in viewStatutory, regulatory and voluntary security requirements identified, allocated to processes and checked, so a change in customs rules is a task, not a surprise.
- A stronger position with shippers and tendersThe scope of your certificate matched to the sites, lanes and services a customer needs to see secured, so qualification becomes a conversation about evidence.
Pick a few measures that reflect these priorities: losses per thousand consignments, seal discrepancies, access violations or the time taken to close incident actions. Judge the system by what changes on the dock and on the road. A longer security manual is not a business result.
Requirements
What are the main ISO 28000 requirements?
Your system needs to connect leadership, the security environment, operations and improvement. ISO 28000:2022 is organised on the harmonised structure shared by the ISO management system standards, clauses 4 to 10, with the security content inside it: principles in 4.2.3, security-related risks and opportunities in 6.1, and in clause 8 risk assessment and treatment, controls, security strategies and treatments, and security plans. The table is a plain-language map; during the programme your system is checked against the text of the standard, clause by clause.
| Clause | What it requires of you | What it looks like in practice |
|---|---|---|
| 4 Context of the organisation | Understand the organisation and its context, the interested parties, the legal, regulatory and other requirements, the principles the system follows, and the scope of the security management system | A scope naming the sites, flows and supply chain segments covered, a register of customs, transport and contractual security obligations, and the parties from shippers to guarding contractors |
| 5 Leadership | Top management commits to the system, establishes a security policy and assigns roles, responsibilities and authorities | A policy the board can defend after an incident, an accountable owner for security, and security on the management agenda beside cost and service |
| 6 Planning | Determine and address security-related risks and opportunities, establish security objectives and plan how to achieve them, and plan changes to the system | A risk register with owners, objectives with measures and dates, and change handled before a new lane, site or partner goes live |
| 7 Support | Provide resources, competence, awareness and communication, and create, update and control documented information | Competence records for security roles, awareness for everyone who handles cargo or access, communication that reaches partners, and procedures with versions and owners |
| 8 Operation | Plan and control operations; identify the processes and activities to secure; assess and treat risks; put controls in place; select, resource and implement security strategies, procedures, processes and treatments; and establish security plans covering response structure, warning and communication, content and recovery | Access, cargo, seal, vehicle and personnel controls running in daily work; treatments resourced; security plans that name the response team, the alerting route and the recovery steps, and are exercised |
| 9 Performance evaluation | Monitor, measure, analyse and evaluate security performance, run an internal audit programme and hold management reviews with defined inputs and results | Incident and inspection dashboards, an audit programme that reaches the yards and the partners, and a management review that decides |
| 10 Improvement | Improve the system continually, and act on nonconformities with correction and corrective action | Corrective actions closed with evidence that the fix held, and the risk assessment revisited when incidents prove it wrong |
What makes ISO 28000 different from a set of security procedures is the chain through clauses 6 and 8: risks determined, processes and activities identified, risks assessed and treated, controls put in place, strategies and treatments selected, resourced and implemented, and security plans covering response, warning and communication, and recovery. There is no annex of prescribed controls: the control set is yours to justify from your own assessment, not a checklist to tick, so the assessment has to be done on your real flows and partners.
What does useful ISO 28000 evidence look like?
A scope that states which supply chain segments you secure and where your control ends, a risk assessment built on the flows of goods, information and people, the controls and treatments in place with owners and resources, security plans with exercise records, incident reports with their actions, access and seal records, partner verifications, competence records for security roles, and internal audit and management review outputs. We agree which records your operation genuinely needs, leave out the ones that would only fill a folder, and keep them in Effivity from the first workshop.
ISO 28000 requirements explained, clause by clauseCertification process
How do you get ISO 28000 certified?
No audit can certify a system that is not yet running at the gate, in the yard and with the partners, so implementation comes first and the assessment follows. Sterling's part is the preparation and the implementation; the certification decision is the certification body's alone, and that separation is what a shipper or an insurer is relying on.
- 01Decide what the certificate must cover.Confirm the sites, flows, supply chain segments and partners in scope, the parties who will rely on the certificate and the intended certification scope.
- 02Gap analysis: measure the current security arrangements against the standard.The gap analysis compares your risk assessment, controls, plans, partner requirements and records with the standard, keeps what works and agrees actions, owners and dates.
- 03Implement, and let the records accumulate.Assess the security environment, treat the risks, put controls and security plans into daily operation, set requirements for partners, train the people and keep the records that show the system running.
- 04Find the weaknesses before the certification body does.Internal audit and management review test the system at the sites and with the partners; we raise the findings first and close them on evidence.
- 05Complete the independent assessment.The certification body conducts its Stage 1 readiness review and then the Stage 2 audit at your sites and yards; you answer any findings and it makes the decision.
- 06Operate, and stay ready for surveillance.Monitoring, incident handling, exercises, audits, reviews and improvement carry on, with the body's surveillance audits at least once a year and recertification in year three.
Look at the route before the price. Ask which certification body will audit you, whether ISO 28000 is on its accreditation schedule, what scope it proposes and how the audit will run, then check the answers with the certification body and the accreditation body directly; accreditation for ISO 9001 or ISO/IEC 27001 does not extend to ISO 28000. An offer with no implementation and no real audit produces a certificate that fails the first shipper's check. How to choose a credible ISO 28000 provider · The certification buyer's checklist
Cost
How much does ISO 28000 certification cost?
There is no useful universal price for ISO 28000 implementation. A single bonded warehouse needs a different programme from a forwarder securing lanes through several countries with subcontracted carriers. Sterling's commitment is a proposal in which every component is itemised and nothing is added later before any work begins.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity, the number of sites, flows and partners in scope, existing programmes such as AEO, C-TPAT or TAPA, and how much of the work your team takes on (Design™ or Drive™) |
| Independent certification | The certification body's assessment scope, audit days, sites visited, travel and the annual surveillance arrangements |
| Internal resources | Time from operations, security, logistics and HR people, management involvement, training, and any physical, procedural or contractual changes the treatment calls for |
| Software and learning | Included in a Sterling engagement: Effivity for the system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, system upkeep, refresher learning and future transitions under Sustain™ |
What moves the price
- Number of sites and countries, and whether one certificate or several
- The partners in scope: carriers, warehouses, forwarders, guarding contractors
- What exists today: a risk assessment, controls, security plans, a customs status or a TAPA certificate
- The deadline, and how much of the work your team can carry
- Regulated or high-value cargo, bonded operations, airside or port access, shipper-specific requirements
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 28000 certification take?
The realistic timeline depends on your starting point, the number of sites and partners, the changes the treatment calls for and the certification body's calendar. It is measured in months, not days, typically four to eight: the security environment has to be assessed properly, the controls and plans have to run and be exercised, and the incident, monitoring and review records have to exist before an auditor can test them. We plan backwards from that evidence, and your team tracks the milestones in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to sites, operations and security people, partner agreements and incident history |
| Build and implementation | The extent of change to controls, partners and plans, approval times, training and internal capacity |
| Evidence and review | Controls operating and plans exercised long enough to show effect, followed by internal audit and management review |
| Certification assessment | The certification body's calendar, the dates of Stage 1 and Stage 2, and the time needed to close any findings |
If a shipper's audit, a customs validation or a tender deadline is fixed, share it at the start. You will get a straight answer on what can be done by then, which controls can show evidence in time and which decisions cannot wait. A certificate date promised before anyone has walked your yard is not a project plan.
Challenges
Common ISO 28000 implementation challenges
ISO 28000 programmes lose momentum for five recurring reasons. None of them is hard to fix once it is named.
Security means the guarding contract, and nobody else owns it.
We start by making security a management responsibility with a scope, a policy and an accountable owner, then bring operations, HR, IT and procurement into the risk assessment. The guarding contractor becomes one control among many, reviewed like any partner.
Much of the supply chain you are asked to secure is not yours.
Carriers, warehouses, forwarders and agents sit inside what a shipper expects you to answer for. Agree the requirements you will set, how you will verify them and where your control ends, write the scope around it, and record the verification so the boundary is visible.
The risk assessment is a list of threats with no link to the controls.
Rebuild it on the flows: what moves, where it stops, who touches it and what could go wrong at each point. Each risk gets a treatment decision, each treatment an owner and a resource, and each control points back to the risk that justifies it.
Security plans exist on paper and have never been exercised.
Reduce the plans to what people will use: the response structure, the warning and communication route, the content each role needs and the recovery steps. Then exercise them on a plausible scenario and fix what failed before the auditor asks.
AEO, C-TPAT, TAPA and customer audits each want their own file.
Map every programme's criteria to the processes and records of one system, so the same access log, seal record or partner verification answers each of them. Renewals and validations then draw on evidence the operation produces anyway.
Your engagement
What your ISO 28000 engagement includes
Your agreed scope covers everything a working security management system and a prepared team need. Buying consulting, software and training separately means three suppliers and a gap between each; a Sterling engagement brings them together as one programme under one all-inclusive proposal.
Scope, gap analysis and implementation plan
With responsibilities, dates and decision owners, agreed before work starts, and the sites, flows and partners in scope fixed early.
Risk assessment, controls and security plans
The security environment assessed with your operations and security people, treatments and controls selected and resourced, and security plans written for use and exercised.
Effivity ISO & GRC software
Your security management system runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted by Sterling or led with your own auditors, as the proposal states, and no finding left open when the certification body arrives.
Certification readiness and support
Your team prepared for Stage 1 and Stage 2, and Sterling beside you through any findings until the certificate is issued.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO 28000 implementation
Every ISO 28000 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. How much of the work your own people take on is your choice; the method, the software and the accountability stay the same whichever you choose.
- 01Design™Guided implementation: your operations and security people build the system with Sterling's structure, templates, workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants take on the agreed consulting and documentation work with your site and security owners.
- 03Sustain™Post-certification operation: surveillance readiness, internal audits, exercises, refreshers and new-hire training, year after year.
- 04Automate™The security management system running in Effivity: risks, controls, incidents, partner records, audits, actions and management review in one workspace.
- 05Revise™Future editions of ISO 28000, and changes in scope, sites, partners, customs rules or customer requirements.
In the first session we agree the engagement team, the weekly rhythm, the deliverables and the decision owners, and every week after that progress is measured against them, so an untested plan is visible in month one rather than at Stage 1.
How Sterling OS™ worksOften combined with
Standards organisations pair with ISO 28000
- AEOAuthorised Economic Operator (AEO) readiness: what customs examines, who can apply and how Sterling prepares your controls and evidence for the customs visit.
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- BRCGS Storage and Distribution · Agents and BrokersBRCGS Storage and Distribution certification and Agents and Brokers: Issue 4 and Issue 3 requirements, scopes, audits and cost factors, with Sterling's support.
- C-TPATC-TPAT requirements and validation readiness for US importers and overseas suppliers: the Minimum Security Criteria, CBP's process and how Sterling helps.
- CBAMCBAM compliance and requirements explained: authorised declarant status, the 50-tonne threshold, verified embedded emissions and how Sterling helps you prepare.
- COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
Effivity · ISO 28000 security management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO 28000:2022.
Every Sterling ISO 28000 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the security policy and objectives, the risk register with its treatments, controls and their checks, security plans and exercises, incidents, partner verifications, competence records, internal audits, corrective actions and management review live in one place, the system runs in daily operations and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope, security context, obligations and interested parties
The scope, the sites and supply chain segments covered, the legal, regulatory and other requirements and the parties from shippers to customs authorities, kept in one register and reviewed on a schedule rather than rewritten before each audit.
Security policy, roles and objectives
The policy, the accountable roles and the security objectives with their measures, owners and dates live where the operations and security managers work; progress is reported from the system, not a spreadsheet.
Security-related risks, opportunities and change
A risk register built on your flows, with treatment decisions, owners, resources and review dates; changes to lanes, sites and partners planned before they go live.
Competence, awareness and documented information
Competence records for every security role and awareness records for everyone who handles cargo or access, linked to Sterling Academy; procedures and plans with versions and approvals, so only the current version is in use.
Controls, treatments, partners and security plans
Access, cargo, seal, vehicle and personnel controls with their checks recorded as they are done; treatments tracked to implementation; partner requirements and verifications; security plans with their exercises and outcomes.
Incidents, monitoring, internal audit and review
Incidents reported from the gate and the road, investigated in a workflow and driven to conclusion; loss, access and inspection dashboards; audit programmes and findings; a management review with its inputs, decisions and results recorded.
Nonconformity and corrective action
Each one raised, traced to its root cause and closed with proof that the action held; repeat causes visible to management before the next incident.
Your own processes, forms and reports
Forms, fields, workflows and reports adapted to how you work, without code; customs, shipper and TAPA requirements tracked to the records that answer them.
What this means at the audit
The certification auditor asks for the risk assessment and its treatments, the last incidents and what was done about them, the exercise records for the security plans, the partner verifications, the internal audit programme and the last management review. Each is a screen in Effivity, with its dates, owners and evidence, rather than a folder compiled the week before Stage 1. Sustain™ then carries on in the same workspace, so each surveillance audit meets a system that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your risk assessments, security plans, partner records and procedures migrated, not retyped
- Admin and user training for your team
- Modules for QMS, ISMS, EMS, OHSMS, FSMS and more when you integrate other standards
ISO 28000 client experience
Client letters on file, available on request.
Signed client letters for ISO 28000 are available on request. The client feedback wall lists every letter by standard.
Integrated programmes with ISO 28000 in scope
How supply chain security runs inside an integrated programme.
- 01Read the case study
Logistics and transportation: end-to-end traceability and a smaller footprint
A logistics and transportation company needed end-to-end traceability and a smaller environmental footprint. It implemented ISO 9001, ISO 14001, ISO 45001 and ISO 28000 with GDP and GWP, using Sterling's software tailored to its operation. Live tracking, recorded quality checks and simpler reporting to customers raised satisfaction and won more contracts, and data-led fuel efficiency and better routes cut its environmental impact; its operations director said the company had achieved its certifications and transformed how it operates.
Sterling Academy · ISO 28000 e-learning
Train everyone who handles cargo or access on ISO 28000, not just the security team.
Sterling Academy takes the whole workforce, and the people who run the system, through online video lessons with practice checkpoints and a final exam; each learner receives a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- ISO 28000 awareness for every employee at the gate, on the dock and on the road, with the evidence of competence the standard requires
- Practitioner courses for security managers, site leads and the management representative
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by site and a training status report for the auditor
- New hires trained as they arrive, so evidence is current at every surveillance audit
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for an ISO 28000 programme
The courses your people take, and who takes them.
ISO 28000 Awareness
What the standard requires of the organisation and of each person who receives, stores, moves or releases goods and controls access, why security management matters to customers and the business, and how the controls, incident reporting and security plans show up in daily work. The competence evidence for the whole workforce in scope.
View the courseDocumented Information Management
Creating, controlling and using the documented information a security management system needs, from the risk assessment to security plans and incident records, so procedures and evidence stay usable and audit-ready.
View the courseNonconformity Management
Raising, investigating and closing nonconformities from audits, inspections and incident reviews, root cause and corrective action, and the evidence that a fix reduced the exposure.
View the courseRisk Management
Identifying, evaluating and treating security-related risks and opportunities in the management system, with the register, ownership, treatment decisions and review that clauses 6 and 8 expect.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the security management system, with practical exercises on your own sites, flows and records and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO 9001, ISO 14001, ISO 45001, ISO 22000 and HACCP, IATF 16949 and more, so an integrated system trains one workforce on one platform.
See all coursesSterling consulting clients obtain access through their consultant. An Academy certificate records a person's training; certification of the management system itself remains with the independent certification body.
Keep exploring
Explore more about ISO 28000
Watch a video on how to implement ISO 28000 here.
Watch a video on ISO 28000 requirements here.
Why Sterling
Want successful ISO 28000 certification? Come to Sterling.
Whether you secure one warehouse or lanes through several countries, Sterling helps you establish shared security requirements with clear local ownership, working through differences in customs regimes, transport law, port rules and shipper expectations so that the system fits every market you serve.
Management systems in 60+ countries since 2003
Security, continuity, information security and integrated systems built for logistics providers, manufacturers, ports and security companies, and a single engagement team answerable for every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access priced together in a single proposal, and the certification body's fees listed apart from it, so you know the cost of the whole programme before you start. No surprises, ever.
A system your gate, dock and drivers can use
Fewer documents and more effect: controls, training and software wired into receiving, storage, dispatch and transport, so supervisors and drivers use the system because it helps them.
Expert and experienced consultants
Consultants who have built management systems across sectors and countries since 2003 and who get the security management system right first time, so the certification audit confirms what already works.
The Sterling Promise
What our ISO 28000 certification success guarantee means
We stay with you until your agreed ISO 28000 certification outcome is achieved, through implementation, preparation and the resolution of assessment findings. Clear explanations, practical delivery and the software and learning that come with the engagement mean the fee buys a more secure operation, not a certificate on a wall.
The engagement letter sets out the standard, the scope, the intended outcome and the responsibilities on each side. Your organisation supplies accurate information and runs the agreed controls. The independent certification body alone assesses conformity and makes the certification decision. Our commitment covers the agreed certification support; it does not promise that no security incident will occur or that every tender will be won.
After certification
What happens after ISO 28000 certification?
Your security management system should keep working as lanes, sites, partners, customs rules and threats change. Incidents are investigated, controls checked, plans exercised, partners re-verified and the risk assessment revisited when the environment moves. The certification body returns for a surveillance audit at least once a year and a recertification audit before the certificate expires in the third year.
The system should grow with the operation. Under Sterling OS™ Sustain™ we review your incident trends, control checks, exercise results and partner performance with you alongside the planned internal audits, management reviews and surveillance preparation, so the system stays alive between audits.
FAQs
Frequently asked questions about ISO 28000
Is ISO 28000 only for logistics and transport companies?
No. The 2022 edition is written for all types and sizes of organisation and is not sector specific; the supply chain is one aspect it covers, not its only subject. Logistics providers, ports and carriers are the most frequent users, but a manufacturer or a security company implements it on the same clauses.
What is the difference between ISO 28000 and ISO 28001?
ISO 28000 is the certifiable management system standard. ISO 28001:2007 is best practice for implementing supply chain security, assessments and plans in international supply chains, written to help meet the authorised economic operator criteria of the World Customs Organization's SAFE Framework. A programme can apply ISO 28001 to the supply chain segment while the system is certified to ISO 28000; ISO 28004-4 guides that combination.
Does ISO 28000 certification give us AEO or C-TPAT status?
No. AEO is a customs status granted by a customs authority, in the EU by the AEO-competent customs authority of a member state, and C-TPAT is a voluntary partnership programme run by U.S. Customs and Border Protection. Neither is issued by an ISO certification body, and an ISO 28000 certificate replaces neither application. What the system does is put the criteria those programmes check into one owned, evidenced system, so each application, validation and renewal draws on existing records.
How does ISO 28000 relate to TAPA FSR and TSR?
TAPA's Facility Security Requirements and Trucking Security Requirements are the standards of the Transported Asset Protection Association, with their own levels, audits by TAPA-approved independent audit bodies, a self-certification route for the lowest level and a three-year review cycle. They specify the security a facility or a road carrier must meet; ISO 28000 specifies how the organisation manages security as a whole. Many logistics providers hold both.
We hold ISO/IEC 27001. Does it cover supply chain security?
Only in part. ISO/IEC 27001 manages information security risks; its controls touch supplier and physical security, but its object is information. ISO 28000 manages the security of the organisation and its supply chain as such: cargo, premises, conveyances, people and the processes between them. One risk method can serve both; the risk assessment, controls and plans still have to be done for ISO 28000.
Does Sterling issue the ISO 28000 certificate?
No. Sterling consults and prepares. An independent, accredited certification body, which has had no part in the implementation, conducts the certification audit and makes the decision. Anyone who offers to do both is selling you a piece of paper.
Can we combine ISO 28000 with ISO 22301, ISO/IEC 27001 or ISO 9001?
Yes. ISO 28000:2022 uses the harmonised structure and was revised for consistency with ISO 22301 in its treatment of strategies and plans. Shared context, document control, internal audit and management review support an integrated system; the security-specific requirements still have to be met in full.
Our certificate refers to ISO 28000:2007. What do we need to do?
ISO 28000:2007 was withdrawn when the 2022 edition was published on 15 March 2022, and certificates are now issued to ISO 28000:2022. Ask your certification body what arrangement applies to your certificate and by when, then have the differences reviewed: the harmonised structure, the principles in clause 4, planning of changes, and the strategies, treatments and plans in clause 8. Sterling's Revise™ service runs the review.
What do you need to prepare an ISO 28000 proposal?
The sites, flows and countries to be covered, the partners in scope, the number of people, whether a risk assessment, a customs status, a TAPA certificate or another ISO certificate exists today, any shipper or tender requirement, and your deadline. That is all a scoped, all-inclusive proposal needs.
Before the first call
Prepare a useful ISO 28000 readiness brief
You do not need a security manual before the first discussion. Bring a short account of what moves through your operation and where the certificate should help. Seven questions are enough:
- Who is asking for ISO 28000, a shipper, a tender, an insurer or your own board, and which sites, flows and segments should the certificate cover?
- What moves through the operation, at what value and under which regimes: bonded, dangerous goods, airside?
- Which partners handle your goods or access your sites, and what do your agreements require of them?
- What do recent losses, seal discrepancies, access violations and claims tell you, and how were they investigated?
- Which controls and programmes already work: access control, CCTV, seals, driver vetting, AEO or C-TPAT status, a TAPA certificate, another ISO system?
- Who can make decisions and contribute time to implementation, exercises, internal review and learning?
- Is there an existing certificate, a shipper's audit, a customs validation or a contract deadline to plan around?
With these answers we can scope the work and write a proposal that reflects your operation. They are preparation for a discussion, not a scored assessment, and they play no part in any certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO 28000 certification.
A certificate is useful when its scope and accreditation answer the shipper's real requirement and the system behind it can stand up to review after a loss. The market is full of paper: certificates from bodies nobody accredits for security management, consultants who manage everything while your gate and your drivers change nothing. They cost less, until a shipper checks.
How to choose a credible ISO 28000 provider
- Find out which body will issue the certificate and where on its public register you can check the certificate's status and scope.
- Confirm that ISO 28000 is named on the body's accreditation schedule with the accreditation body itself, one recognised under the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA.
- Ask how the programme will use your incident history, your partner agreements and your site walks. A system with no risk assessment on your own flows is a policy, not a management system.
- Get the division of labour in writing, with the assessment costs that sit outside the fee and the support you will have when a finding needs corrective action.
- Ask what your gate and transport people will learn and what software the system will run in. If the answer is nothing and none, the system will last exactly as long as the consultant's contract.
- "Certified in 7 to 10 days", "we manage everything", one invoice for consulting and certificate, and "ISO 28000 gets you AEO or C-TPAT" are each a reason to walk away. A system has to operate before it can be audited, and customs status is decided by customs, not by a certificate.
Talk to a consultant
Plan your ISO 28000 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice