Theft, tampering, smuggling and sabotage in physical supply chains are managed in most organisations by scattered site procedures, with no single system that sets objectives, assesses risk and proves to customs authorities and customers that security works. ISO 28000 is the international management system standard for exactly that: requirements for a security management system, including aspects relevant to the supply chain, that can be certified by a third party. The current edition is ISO 28000:2022 (edition 2, published March 2022 by ISO/TC 292 Security and resilience), amended in 2024 for climate action. This guide covers what the standard requires, how it differs from ISO/IEC 27001, how it connects to authorised economic operator programmes through ISO 28001, the identity and credential issues inside logistics operations, and how to implement and evidence it. It is for security managers, logistics and operations leads, compliance teams and auditors at manufacturers, carriers, ports, warehouses and freight forwarders.
Key takeaways
- It is a certifiable management system: ISO 28000:2022 specifies requirements, so an accredited body can certify conformance, unlike guidance documents such as ISO/IEC 27036.
- It is no longer only about the supply chain: the 2007 edition was a "specification for security management systems for the supply chain"; the 2022 edition covers security management generally, "including aspects relevant to the supply chain", for any type or size of organisation.
- Security means physical and operational security first: cargo integrity, facilities, people, conveyances and the information that controls them, rather than only information security.
- ISO 28001 links it to customs programmes: ISO 28001:2007, confirmed by ISO in 2021, gives requirements for supply chain security assessments and plans that support World Customs Organization authorised economic operator (AEO) criteria.
- Logistics runs on shared credentials: yard systems, port community platforms, carrier portals and EDI links depend on accounts and API keys that criminals target to redirect or release cargo.
What it is and who it applies to
ISO 28000:2022, "Security and resilience: Security management systems: Requirements", is published by ISO/TC 292, the committee that also owns ISO 22301 business continuity. ISO's abstract states that it applies to organisations of all types and sizes, including commercial enterprises, government bodies and non-profit organisations, that intend to establish, implement, maintain and improve a security management system. It is not specific to an industry or sector and can be applied to any internal or external activity at any level.
Edition history (from ISO catalogue pages)
| Document | Title | Status at 8 November 2026 |
|---|---|---|
| ISO 28000:2007 (edition 1) | Specification for security management systems for the supply chain | Withdrawn |
| ISO 28000:2022 (edition 2) | Security and resilience: Security management systems: Requirements | Published (stage 60.60) |
| ISO 28000:2022/Amd 1:2024 | Climate action changes | Published amendment |
| ISO 28001:2007 | Best practices for implementing supply chain security, assessments and plans: Requirements and guidance | Published, confirmed in 2021 |
Typical adopters
- Logistics operators: freight forwarders, third-party logistics warehouses, hauliers, rail, air and sea carriers. See the Cybersecurity for Logistics and Shipping Guide.
- Ports and terminals: container terminals and port authorities, often alongside maritime security regimes; see the Ports and Logistics Cybersecurity Guide.
- Manufacturers of high value or controlled goods: electronics, pharmaceuticals, tobacco, alcohol and dual use items where theft or diversion is a primary risk.
- Organisations outside logistics: since 2022, any organisation wanting a certifiable security management system for physical and personnel security, such as data centres, event venues and critical infrastructure operators.
Structure and key requirements
ISO 28000:2022 uses the harmonised structure shared by ISO management system standards, so clauses 4 to 10 line up with ISO/IEC 27001, ISO 22301 and ISO 9001. This makes an integrated management system practical. The headings below are the standard harmonised structure; ISO's public abstract does not detail the clause text, so read the standard itself for the exact requirements.
| Clause | Harmonised heading | What it means for supply chain security |
|---|---|---|
| 4 | Context of the organisation | Map your role in the supply chain, interested parties (customers, customs, insurers, regulators) and the scope: sites, routes, modes, partners |
| 5 | Leadership | Top management commitment, a security policy and named roles, including who may accept security risk |
| 6 | Planning | Security risk assessment covering threats such as theft, tampering, contraband insertion, sabotage, terrorism and insider collusion; objectives and plans to achieve them |
| 7 | Support | Resources, competence and vetting of security personnel, awareness, communication and documented information |
| 8 | Operation | Operational controls: facility access, cargo handling and sealing, conveyance checks, partner security requirements, incident and emergency response |
| 9 | Performance evaluation | Monitoring, measurement, internal audit and management review |
| 10 | Improvement | Nonconformity, corrective action and continual improvement |
ISO 28000 compared with ISO/IEC 27001
| Aspect | ISO 28000:2022 | ISO/IEC 27001:2022 |
|---|---|---|
| What is protected | The organisation's security broadly: people, assets, goods, facilities, conveyances and supply chain operations | Confidentiality, integrity and availability of information |
| Control catalogue | No Annex A control list; controls follow from the risk assessment | Annex A with 93 controls and a Statement of Applicability |
| Owning committee | ISO/TC 292 Security and resilience | ISO/IEC JTC 1/SC 27 |
| External programmes | Supports customs AEO evidence through ISO 28001 | Supports information security and privacy regulation evidence |
| Combined use | Same harmonised structure, so one management review, internal audit programme and document control can serve both | |
Where ISO 28001 fits
ISO 28001:2007 is narrower and more operational. According to ISO's abstract, it helps organisations in international supply chains set and document a minimum level of security for a whole supply chain or a segment of it, supports meeting the World Customs Organization authorised economic operator criteria and matching national programmes, and sets documentation requirements so compliance can be verified. Its process has five parts:
- Define the part of the supply chain being secured.
- Assess the security of that segment.
- Develop countermeasures.
- Write and implement a supply chain security plan.
- Train security personnel for their duties.
Decision guidance: choose ISO 28001 alone when the goal is a documented security plan for specific trade lanes to support a customs application. Choose ISO 28000 when you need an organisation-wide management system with leadership accountability, audits and certification, and use ISO 28001 inside it as the method for each lane. Organisations already certified to ISO/IEC 27001 or ISO 22301 usually find ISO 28000 the lower effort route, because the management system clauses are shared.
For the cyber side of supplier risk, use the ISO/IEC 27036 Supplier Relationships Guide and the NIST SP 800-161 Cyber Supply Chain Risk Management Guide; ISO 28000 is the physical and operational counterpart.
Identity and NHI requirements
Modern cargo release, tracking and booking are digital, so physical supply chain security now depends on who and what can authenticate to logistics systems. ISO 28000 does not prescribe IT controls, but a risk assessment under clause 6 that ignores these routes will miss how much cargo crime now begins.
- Cargo release credentials: container release PINs and terminal booking accounts let whoever holds them collect goods. Treat them as high value secrets: issue per shipment, limit validity, log every use and never send them in plain email.
- Carrier and broker portals: shared logins between dispatch staff hide who booked or redirected a load. Require named accounts with MFA, and review partner accounts when contracts end.
- EDI and API integrations: booking, customs filing and tracking links use service accounts and API keys. Inventory them with owners, rotate them, and restrict them by source address where the platform allows.
- Physical access systems: badge systems, gate automation and CCTV have their own administrator and service accounts; see the Physical Access Control Systems Security Guide.
- Telematics and IoT: trackers, electronic seals and yard sensors authenticate to cloud platforms with device credentials. Include them in the asset inventory and the risk assessment.
- Insiders: collusion by drivers, warehouse staff or brokers is a classic supply chain threat. Link personnel vetting to account provisioning and removal; the Insider Threat Programme Guide covers the programme side.
Implementation steps
- Buy the current documents: ISO 28000:2022 with Amendment 1:2024, and ISO 28001:2007 if you seek AEO or similar customs status.
- Define scope and context: list sites, routes, transport modes, partners and the parts of the chain you control or influence; record customer and customs requirements.
- Run the security risk assessment: walk each node (origin, consolidation, transport, transit, delivery) for theft, tampering, contraband insertion, sabotage and information compromise, including the digital release and booking routes above. The ISO 31000 Risk Management Guide covers method.
- Set objectives and controls: for example seal integrity checks at every handover, perimeter and CCTV coverage of loading bays, vetting for roles with cargo access, MFA on carrier portals.
- Set partner requirements: write security expectations into carrier, warehouse and broker contracts and verify them by questionnaire, audit or certification.
- Pilot at one site or lane: trial new procedures on a single warehouse or trade lane, measure delays and exceptions, adjust, then roll out. Keep the old procedure documented until the new one has passed an internal audit, so you can revert.
- Integrate response: align security incident and emergency procedures with the ISO 22301 Business Continuity Guide so a cargo theft, a port closure or a ransomware attack on a booking platform follows one escalation path.
- Audit, review, certify: complete an internal audit and management review, then engage an accredited certification body for stage 1 and stage 2 audits, followed by surveillance audits.
Small operator or global shipper
A single site warehouse can run ISO 28000 with a small document set focused on access control, cargo handling, vetting and partner checks, often integrated with an existing ISO 9001 system. A global shipper needs a central security function, a lane by lane risk register, partner assurance at scale and a link to customs programmes in each country it trades through.
Evidence and assessment
| Evidence | What an auditor checks | Metric to track |
|---|---|---|
| Scope statement and supply chain map | Sites, routes and partners in scope; exclusions justified | Percentage of trade lanes with a completed risk assessment |
| Security risk register | Threats, likelihood, impact and treatment per node | High risks past treatment target date |
| Seal and handover records | Seals recorded and verified at each transfer | Seal discrepancies per 1,000 shipments |
| Partner assurance records | Contracts, questionnaires, audits or certificates | Percentage of critical partners assessed in the last 12 months |
| Access and vetting records | Vetting before cargo access, removal on leaving | Portal and badge accounts of leavers still active (target zero) |
| Incident log and corrective actions | Incidents investigated, root causes addressed | Losses and security incidents per period; corrective actions closed on time |
Mapping to other frameworks
| ISO 28000 area | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 | Related programmes |
|---|---|---|---|
| Context and scope (clause 4) | Clauses 4.1 to 4.3 | GV.OC-01 | ISO 22301 clause 4 |
| Risk assessment (clause 6) | Clause 6.1.2 | GV.RM-01, ID.RA | ISO 28001 security assessment |
| Partner requirements (clause 8) | A.5.19 to A.5.22 | GV.SC-04, GV.SC-05, GV.SC-06 | WCO AEO criteria via ISO 28001 |
| Physical security of sites | A.7.1 to A.7.4 | PR.AA-06 | Physical Security Guide for Security Teams |
| Personnel vetting | A.6.1 | GV.RR | Insider threat programme |
| Digital credentials for logistics systems | A.5.17, A.8.5 | PR.AA-01 | Identity programme |
| Incident response and recovery | A.5.24 to A.5.29 | RS.MA-01, RC.RP-01 | ISO 22301 |
| Improvement (clause 10) | Clause 10 | ID.IM-01 | All harmonised structure standards |
Common pitfalls
- Working from the 2007 edition: it is withdrawn, and its supply chain only framing and older structure no longer match certification audits.
- Treating it as a cyber standard: ISO 28000 will not give you an information security control set; pair it with ISO/IEC 27001 where information risk is material.
- Ignoring digital cargo release: strong fences and seals do not stop a criminal who logs in to a carrier or terminal portal with stolen credentials and collects the load.
- Paper partner assurance: questionnaires never verified against site visits or certificates give false comfort.
- Scope that stops at the gate: most losses occur in transit and at handovers, which must be in scope even when carried out by partners.
- Skipping the 2024 amendment: certification bodies audit against ISO 28000:2022 as amended, so check that context and risk assessment records consider climate change where it is relevant, for example flooding at warehouses or disruption on key routes.
- No link between vetting and accounts: staff removed from cargo roles often keep portal and badge access for weeks.
Practitioner checklist
- Obtain ISO 28000:2022 with Amendment 1:2024 and retire the 2007 edition.
- Document scope covering sites, lanes, modes and partners.
- Assess risks per supply chain node, including digital booking and release routes.
- Set measurable security objectives and assign owners.
- Write security requirements into carrier, warehouse and broker contracts.
- Require named accounts with MFA on all carrier, terminal and customs portals.
- Inventory EDI and API credentials and rotate them on a schedule.
- Link personnel vetting and leaver processing to badge and system access.
- Align incident response with business continuity plans.
- Use ISO 28001 if you pursue AEO or equivalent customs status.
Standards and references
- ISO: ISO 28000:2022 Security and resilience, Security management systems, Requirements
- ISO: ISO 28000:2007 Specification for security management systems for the supply chain (withdrawn)
- ISO: ISO 28001:2007 Best practices for implementing supply chain security, assessments and plans
- ISO: ISO/IEC 27001 Information security management systems
- ISO: ISO 22301:2019 Business continuity management systems
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cybersecurity for Logistics and Shipping Guide · ISO/IEC 27036 Supplier Relationships Guide · Physical Security Guide for Security Teams · ISO 22301 Business Continuity Guide. This guide summarises ISO 28000 as listed by ISO at 8 November 2026 and is not legal advice.