ISO 28000 was rewritten in 2022 from a narrow transport security standard into a general supply chain security management system – broader in scope, aligned to the common management system structure, and applicable to any organisation in a supply chain rather than only to shippers. 29 editable files, downloadable the moment you check out. On this page:
- What is in the supply chain security management pack
- The 2022 rewrite changed what ISO 28000 is for
- Who needs supply chain security management
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the supply chain security management pack
Documents are numbered in implementation order, with the security management system manual at the front:
- 00 Toolkit index and 01 SMS Manual – the security management system scope, structure and context
- 02 Security Policy
- 03 Security risk assessment – the methodology covering threats to goods, people, facilities, information and transport
- 04 Security risk treatment – the controls selected and the justification for them
- 05 Operational planning and control
- 06 Physical security – perimeter, access control, surveillance and secure areas
- 07 Transport and logistics security – in-transit controls, conveyance security, seals and route risk
- 08 Personnel security – screening, access rights and insider threat
- 09 Facility security – site-specific arrangements and layered protection
- 10 Cyber-physical security – the convergence of information security with physical operations, which the 2022 revision brought forward
- 11 Supplier and contractor security requirements and their flow-down
- Incident management, emergency preparedness and business continuity of supply
- Performance evaluation – security monitoring, internal audit, management review and improvement
- Registers and workbooks – the security risk register, asset and site registers, incident log and audit programme
The 2022 rewrite changed what ISO 28000 is for
ISO 28000:2022 is the second edition, amended in 2024 to add consideration of climate change. It replaced the 2007 original, which was written primarily around transport and shipping.
The rewrite did two things. It aligned the standard to the Harmonized Structure, so it integrates with ISO 9001, ISO 14001 and ISO 27001 rather than standing apart. And it broadened the scope from transport security to supply chain security management generally, covering manufacturers, warehouses, ports, distributors and service providers.
The addition that matters most now is cyber-physical convergence. Cargo tracking systems, warehouse automation, port infrastructure and vehicle telematics are all attack surfaces where a compromise has physical consequences, and a security management system that treats information security as somebody else problem is no longer credible.
Who needs supply chain security management
Manufacturers, distributors, freight forwarders, warehouse operators and port facilities. Organisations with high-value or high-risk cargo where loss and tampering are material. Companies whose customers impose supply chain security requirements contractually. And organisations holding an Authorised Economic Operator status or similar customs security accreditation who want an underlying management system.
How the supply chain security management maps to the framework
Because ISO 28000 now shares the common management system structure, an organisation already certified to ISO 9001 or ISO 27001 reuses context, leadership, competence, internal audit and management review and adds only the security-specific content. That is a substantially smaller undertaking than the 2007 edition implied.
Frequently asked questions
Which edition is this written to?
ISO 28000:2022, the second edition, with the 2024 climate amendment. The 2007 original was much narrower in scope.
Is it only for transport companies?
No – that was the 2007 edition. The 2022 revision applies to any organisation in a supply chain, including manufacturers, warehouses and service providers.
Does it cover cyber security?
It covers cyber-physical convergence – where information systems control physical operations. For a full information security management system see the ISO 27001 Toolkit.
Does it help with AEO or C-TPAT?
It provides a management system that supports customs security programmes, though those have their own specific criteria and application processes.
How many documents are included?
29 editable files – 19 Word documents and 10 Excel workbooks – plus guidance and a licence file.
Related toolkits
Supply chain security overlaps with several systems. See the ISO 27001 Toolkit for information security, the ISO 22301 Toolkit for continuity of supply, the ISO 9001 Toolkit for the quality system and the ISO 45001 Toolkit for warehouse and transport safety. The third-party risk toolkit covers the supplier assessment and contracting side of the same problem.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your supply chain security management downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files behind the supply chain security management are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.