---
title: "ISO 28000 security management systems for the supply chain | Standards Academy"
url: https://standards.academy/insights/iso-28000
description: "ISO 28000 explained: security management system requirements for the supply chain, the 2022 edition, customs programme links and the PECB training route."
lang: en
---

We value your privacy

We use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Read our Cookie Policy (https://standards.academy/cookies) to learn more.

Insights (https://standards.academy/insights)

Image: ISO 28000 security management systems for the supply chain (https://standards.academy/insights/images/iso-28000.jpg)

Guide

# ISO 28000 security management systems for the supply chain

Author: Standards Academy Reviewed by the Managing Partner 23 October 2026 11 min read

Share

ISO 28000 is the international standard that specifies requirements for a security management system, including aspects relevant to the supply chain (ISO, 2022). It is produced by ISO/TC 292 (https://www.iso.org/committee/5259148.html), the ISO technical committee for security and resilience, whose page on 23 October 2026 listed 69 published standards and 16 under development (ISO, no date). The committee's scope opens: "Standardization in the field of security to enhance the safety and resilience of society" (ISO, no date). The current edition, ISO 28000:2022, is the second edition, published in March 2022, and it replaced ISO 28000:2007 (ISO, 2022). Port authorities, logistics providers and energy operators in the Caribbean and elsewhere face contractual and regulatory expectations about cargo security, access control and partner vetting, and a certified security management system is one documented answer to those expectations.

Standards Academy teaches ISO 28000 as one of the systems through which management gives effect to the governing body's risk governance duty. ISO 37000, written in ISO/TC 309/WG 1 under the convenorship of Standards Academy's director, requires the governing body to ensure that it considers the effect of uncertainty on the organizational purpose and the associated strategic outcomes (ISO, 2021, Clause 6.9); security risk across the supply chain is one such effect.

## Scope and purpose of ISO 28000

ISO 28000:2022, _Security and resilience, Security management systems, Requirements_, specifies requirements for establishing, implementing, maintaining and continually improving a security management system (ISO, 2022). The 2007 first edition carried the title _Specification for security management systems for the supply chain_ and treated supply chain security as its defining subject. The 2022 second edition widened the scope to security management in general, with the supply chain remaining the primary field of application, restructured the requirements around ISO's harmonized structure for management system standards, added recommendations on principles in Clause 4 for coordination with ISO 31000, and added recommendations in Clause 8 on security strategies, procedures, processes, treatments and security plans for consistency with ISO 22301 (ISO, 2022, Foreword). An organization that certified against the 2007 edition therefore holds a certificate against a withdrawn document; the current reference is the 2022 text.

The standard is applicable to any type of organization, regardless of type, size or nature: commercial businesses, public authorities and non-profit organizations (ISO, 2022, Clause 1). It is sector-independent. A container terminal, a petroleum storage operator, a freight forwarder and a customs brokerage can each use the same clause structure, because the requirements describe what a security management system is to achieve, and leave the selection of controls to the organization's own security risk assessment.

Amendment 1 to the 2022 edition was published in February 2024 under the title _ISO 28000:2022/Amd 1:2024, Amendment 1: Climate action changes_ (ISO, 2024). The amendment forms part of a coordinated set of climate action changes applied across ISO management system standards, adding consideration of climate change to the clauses on organizational context and interested parties (ISO, 2024). Organizations maintaining a certified system incorporate the amendment at their next review of context.

ISO 28001:2007, _Security management systems for the supply chain, Best practices for implementing supply chain security, assessments and plans, Requirements and guidance_, published in October 2007, sits alongside the main standard. It supplies best practice for implementing supply chain security and a method for assessing it, and supports organizations seeking to demonstrate partner security to counterparties (ISO, 2007).

## PECB credentials and training routes for security management

Certification to ISO 28000 is organizational: an accredited certification body audits the security management system and issues the certificate to the organization. PECB does not certify organizations against ISO 28000, and neither does Standards Academy. A PECB credential attests the competence of an individual person, whether a security manager, consultant or auditor. The two certificates answer different questions: one says the system conforms, the other says the person is competent.

Four ISO 28000 training routes are available through Standards Academy, a PECB-authorized training partner. The Foundation route introduces the concepts and requirements of a security management system. The ISO 28000 Lead Implementer route develops the competence to establish, implement, maintain and improve such a system, which suits the security manager or consultant responsible for building one. The ISO 28000 Lead Auditor route covers audit preparation, execution, reporting and audit programme management, which suits internal auditors and those auditing suppliers or working towards certification body roles. The Transition route addresses the movement of an existing system from the 2007 edition to the 2022 edition.

| Role | Credential | Course | Formats |
| --- | --- | --- | --- |
| New entrant, team member needing awareness | PECB Certified ISO 28000 Foundation | ISO 28000 Foundation: https://standards.academy/courses/iso-28000-foundation | Self-Study and eLearning |
| Security manager, implementation consultant | PECB Certified ISO 28000 Lead Implementer | ISO 28000 Lead Implementer: https://standards.academy/courses/iso-28000-lead-implementer | Self-Study and eLearning |
| Internal auditor, supplier auditor, certification audit role | PECB Certified ISO 28000 Lead Auditor | ISO 28000 Lead Auditor: https://standards.academy/courses/iso-28000-lead-auditor | Self-Study and eLearning |
| Practitioner updating a 2007-based system | PECB Certified ISO 28000:2022 Transition | ISO 28000:2022 Transition: https://standards.academy/courses/iso-28000-transition | eLearning |

The division between implementer and auditor follows the division of labour inside a certification cycle. The person who designs the security plan and the person who audits it against the standard hold separate responsibilities, and the two credential tracks reflect that separation.

## Organizations and roles within scope

ISO 28000:2022 names no sectors in its requirements, and its applicability statement covers organizations of all types and sizes (ISO, 2022). In practice the organizations adopting it are those whose operations or dependencies create security exposure along a supply chain: manufacturers, logistics providers, transport operators, port and terminal operators, warehouse and distribution businesses, retailers, energy companies with import or export dependencies, and government bodies with cargo or border responsibilities.

For Caribbean port and logistics operators, the exposure is concrete. Transhipment hubs, cruise terminals and petroleum facilities handle cargo and passengers for counterparties who ask for documented security arrangements in contracts and tenders. A certified security management system gives those counterparties third-party evidence that threats are identified, risks assessed and controls maintained under a managed cycle.

Within an adopting organization, the standard assigns obligations across several roles. Top management shall demonstrate leadership and commitment, set the security policy and allocate resources. Security managers own the day-to-day operation of the system, including the security risk assessment and the security plan. Risk owners and process owners carry responsibility for controls inside their own areas. Employees and contractors shall be competent and aware of their part in the system, and suppliers and other supply chain partners fall within scope where the organization's risk assessment identifies dependencies on them (ISO, 2022).

The training routes map onto those roles. Operational staff who need awareness of the system sit at Foundation level. The person accountable for building and running the system holds the implementer track. The person who examines the system against the standard, internally, across suppliers, or for a certification body, holds the auditor track.

## Requirements of a security management system

Clauses 4 to 10 of ISO 28000:2022 follow ISO's harmonized structure for management system standards: context of the organization, leadership, planning, support, operation, performance evaluation and improvement (ISO, 2022). The harmonized structure is the same clause structure used by other certifiable management system standards, which allows an organization to integrate security management with existing certified systems under shared governance, document control and audit arrangements.

Under context, the organization determines internal and external issues relevant to its security purpose, a set that now includes climate change under Amendment 1:2024 (ISO, 2024), identifies interested parties and their requirements, and defines the scope of the security management system. Leadership requirements place accountability with top management for a security policy, assigned roles and authorities, and visible commitment to the system.

Planning covers risks and opportunities to the system and the setting of security objectives with plans to achieve them (Clause 6). The assessment of the security environment, including threats, vulnerabilities, dependencies and interdependencies in the supply chain, and the treatment of security risks sit in operation (Clause 8.3) (ISO, 2022). Support addresses resources, competence, awareness, communication and documented information. Operation requires the organization to plan and control the processes needed to meet security requirements, including the security plans that put risk treatment decisions into effect (Clause 8.6).

Performance evaluation requires monitoring and measurement, internal audit and management review. Improvement requires the correction of nonconformities and continual improvement of the system. Legal, regulatory and voluntary obligations run through the requirements: the organization shall identify what it is bound to meet (port security regulation, customs conditions, contractual security clauses) and demonstrate how the system meets it (ISO, 2022). Certification bodies audit against all of these clauses, so gaps in any one of them surface as findings during the certification cycle.

## Security risk assessment, security plans and the supply chain

The security risk assessment, the security plan and the security objectives form the operational core of ISO 28000. Everything else in the clause structure exists to govern, resource and review these three elements.

The security risk assessment requires the organization to examine its security environment, including upstream and downstream supply chain relationships, and to determine whether existing measures adequately control the identified risks (ISO, 2022). For a terminal operator this means assessing threats to cargo integrity, access points, vessel interfaces and information about shipments; for an energy operator it extends to pipeline corridors, storage facilities and the carriers and contractors who touch product in transit. Dependencies and interdependencies matter here. A security failure at a trucking subcontractor or a feeder port becomes the organization's exposure when the assessment identifies the dependency.

Security plans translate risk treatment decisions into operational form: responsibilities, procedures, resources, controls, response arrangements and performance measures. A plan that assigns no owner or sets no measure does not satisfy the standard, because performance evaluation requirements demand evidence that the plan is monitored and reviewed. Security objectives connect the plans back to the policy, and management review tests whether the objectives are being met.

ISO 28001:2007 supports this work in the supply chain context. It sets out best practices for implementing supply chain security, assessments and plans, and provides requirements and guidance for organizations seeking to document the security of their supply chain and to assess it against defined criteria (ISO, 2007). An organization certified to ISO 28000 can use ISO 28001 as its method for conducting the supply chain portion of the security risk assessment and for structuring partner security declarations.

## Relationship with ISO 22301, ISO 31000 and customs security programmes

ISO 22301 specifies requirements for business continuity management, the capability to continue operations during a disruptive incident and to recover from it. ISO 28000 addresses security risks before and during such incidents. Both standards use the harmonized management system structure, so an organization can run them as an integrated system with shared context analysis, shared management review and a single internal audit programme. Many port and energy operators hold both, since a security incident and a continuity event often share the same scenario.

ISO 31000 provides general principles and guidelines for risk management across any domain. It is guidance, and no organization certifies against it. ISO 28000 applies risk assessment to the security and supply chain context under certifiable requirements; ISO 31000 supplies the general vocabulary and process model that the security risk assessment can draw on.

ISO/IEC 27001 is a separate standard for information security management. It governs the confidentiality, integrity and availability of information. ISO 28000 governs the security of operations, assets, people and cargo, including the supply chain. An organization moving sensitive shipment data may need both systems, and the harmonized structure permits integration, but a certificate against one does not cover the scope of the other.

On the customs side, Authorized Economic Operator programmes and the WCO SAFE Framework of Standards are the complementary references. ISO 28000 can support an AEO application by providing documented risk controls, partner security processes and evidence of continual improvement, but certification does not grant customs authorization. The customs authority applies its own legal criteria, and the organization satisfies them directly.

Standards Academy teaches ISO 28000 from the governing body's risk governance duty downwards, so that the security risk assessment and the security plans can be shown to address the uncertainties that bear on the organization's purpose.

## Frequently asked questions

### What changed in ISO 28000:2022?

The 2022 second edition replaced the 2007 edition, adopted ISO's harmonized structure for management system standards, and widened the scope from supply chain security to security management in general, with the supply chain as the primary application (ISO, 2022). Certificates now reference the 2022 text, as amended in 2024.

### Who certifies an organization to ISO 28000?

An accredited certification body audits the organization's security management system and issues the certificate. PECB and Standards Academy do not certify organizations against ISO 28000. PECB credentials attest the competence of individual professionals, which is a separate matter from the conformity of an organizational system.

### Which credential suits a security manager and which an auditor?

The person accountable for establishing, operating and improving the security management system holds the Lead Implementer credential. The person who examines the system against the standard, internally, across suppliers, or within a certification body audit team, holds the Lead Auditor credential. The two tracks reflect separate responsibilities.

### How does ISO 28000 relate to supply chain security programmes such as Authorized Economic Operator?

ISO 28000 supports Authorized Economic Operator applications by documenting risk controls, partner security processes and continual improvement. The WCO SAFE Framework is the customs-side reference behind such programmes. Certification does not grant customs authorization; the organization meets the customs authority's own legal criteria.

### Is ISO 28000 the same as ISO/IEC 27001?

ISO/IEC 27001 specifies requirements for information security management, which protects the confidentiality, integrity and availability of information. ISO 28000 specifies requirements for security management of operations, assets, people and cargo, including the supply chain. The two standards share the harmonized structure and can be integrated, but neither covers the other's scope.

### What does ISO 28000 cover?

ISO 28000:2022 specifies requirements for establishing, implementing and maintaining a security management system (ISO, 2022). It applies to organizations of all types and sizes in every sector. The supply chain is its primary application. The standard requires an organization to identify threats, assess security risks, set security objectives and continually improve its security controls (ISO, 2022).

## References

International Organization for Standardization (2022) _ISO 28000:2022 Security and resilience, Security management systems, Requirements_. Geneva: ISO. Available at: https://www.iso.org/standard/79612.html (Accessed: 23 October 2026).

International Organization for Standardization (2024) _ISO 28000:2022/Amd 1:2024 Security and resilience. Security management systems. Requirements. Amendment 1: Climate action changes_. Geneva: ISO. Available at: https://www.iso.org/standard/88413.html (Accessed: 23 October 2026).

International Organization for Standardization (2007) _ISO 28001:2007 Security management systems for the supply chain, Best practices for implementing supply chain security, assessments and plans, Requirements and guidance_. Geneva: ISO. Available at: https://www.iso.org/standard/45654.html (Accessed: 23 October 2026).

International Organization for Standardization (2021) ISO 37000:2021 Governance of organizations. Guidance. Geneva: ISO. Available at: https://www.iso.org/standard/65036.html (Accessed: 23 October 2026).

International Organization for Standardization (no date) _ISO/TC 292 Security and resilience_. Available at: https://www.iso.org/committee/5259148.html (Accessed: 23 October 2026).

## Related articles

Guide

### ISO/IEC 42001 and the AI management system standards
https://standards.academy/insights/iso-iec-42001

Guide

### ISO 31000 risk management: principles, framework and process
https://standards.academy/insights/iso-31000

Guide

### ISO 22301 business continuity management systems
https://standards.academy/insights/iso-22301

## Ready to learn more?

Explore the courses behind this guide.

Browse courses (https://standards.academy/courses)

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Article",
    "headline": "ISO 28000 security management systems for the supply chain",
    "description": "ISO 28000 explained: security management system requirements for the supply chain, the 2022 edition, customs programme links and the PECB training route.",
    "image": "https://standards.academy/insights/images/iso-28000.jpg",
    "datePublished": "2026-10-23T21:14:21.085642+00:00",
    "dateModified": "2026-10-23T21:14:21.085642+00:00",
    "author": {
      "@type": "Organization",
      "name": "Standards Academy"
    },
    "publisher": {
      "@type": "Organization",
      "name": "Standards Academy",
      "logo": {
        "@type": "ImageObject",
        "url": "https://standards.academy/favicon.png"
      }
    },
    "mainEntityOfPage": "https://standards.academy/insights/iso-28000"
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "What changed in ISO 28000:2022?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The 2022 second edition replaced the 2007 edition, adopted ISO's harmonized structure for management system standards, and widened the scope from supply chain security to security management in general, with the supply chain as the primary application (ISO, 2022). Certificates now reference the 2022 text, as amended in 2024."
        }
      },
      {
        "@type": "Question",
        "name": "Who certifies an organization to ISO 28000?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "An accredited certification body audits the organization's security management system and issues the certificate. PECB and Standards Academy do not certify organizations against ISO 28000. PECB credentials attest the competence of individual professionals, which is a separate matter from the conformity of an organizational system."
        }
      },
      {
        "@type": "Question",
        "name": "Which credential suits a security manager and which an auditor?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The person accountable for establishing, operating and improving the security management system holds the Lead Implementer credential. The person who examines the system against the standard, internally, across suppliers, or within a certification body audit team, holds the Lead Auditor credential. The two tracks reflect separate responsibilities."
        }
      },
      {
        "@type": "Question",
        "name": "How does ISO 28000 relate to supply chain security programmes such as Authorized Economic Operator?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "ISO 28000 supports Authorized Economic Operator applications by documenting risk controls, partner security processes and continual improvement. The WCO SAFE Framework is the customs-side reference behind such programmes. Certification does not grant customs authorization; the organization meets the customs authority's own legal criteria."
        }
      },
      {
        "@type": "Question",
        "name": "Is ISO 28000 the same as ISO/IEC 27001?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "ISO/IEC 27001 specifies requirements for information security management, which protects the confidentiality, integrity and availability of information. ISO 28000 specifies requirements for security management of operations, assets, people and cargo, including the supply chain. The two standards share the harmonized structure and can be integrated, but neither covers the other's scope."
        }
      },
      {
        "@type": "Question",
        "name": "What does ISO 28000 cover?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "ISO 28000:2022 specifies requirements for establishing, implementing and maintaining a security management system (ISO, 2022). It applies to organizations of all types and sizes in every sector. The supply chain is its primary application. The standard requires an organization to identify threats, assess security risks, set security objectives and continually improve its security controls (ISO, 2022)."
        }
      }
    ]
  }
]
```