ISO 28000 is a certifiable international standard for security management systems that sets out requirements for organisations to identify and manage security risks. The 2007 edition focused on supply chain security. The second edition, published on 15 March 2022, was titled “Security and resilience — Security management systems — Requirements” and extended the scope to all of an organisation's activities.
History of the standard and its family
ISO 28000 first appeared in 2005 as a publicly available specification (ISO/PAS 28000) and became a full standard in 2007. The second edition, in force today, was published in 2022 and was developed by ISO/TC 292, the committee responsible for security and resilience. It is a requirements standard; it can be certified following an audit by an independent certification body.
- ISO 28001: Best practices for supply chain security, guidance on security assessment and plan preparation
- ISO 28003: Requirements for bodies providing audit and certification of ISO 28000
- ISO 28004: Implementation guidelines, with parts for different types of organisation
Which threats does it protect against?
The standard requires the organisation to identify security risks according to its own context. In logistics, this list usually includes the following:
- Cargo theft, trailers being broken into at parking areas, and fraud by fake carriers
- Smuggling: drugs, weapons or irregular migrants concealed in a vehicle or container
- Terrorism and sabotage, particularly for energy and critical infrastructure cargo
- Seal and document forgery, unauthorised access to warehouses or vehicles
- Information leaks: the shipment plan, route or customer data falling into the wrong hands
What did the 2022 revision change?
| Topic | ISO 28000:2007 | ISO 28000:2022 |
|---|---|---|
| Title | Specification for security management systems for the supply chain | Security and resilience – Security management systems |
| Scope | Limited to the supply chain | All of the organisation's activities; the supply chain remains part of the scope |
| Structure | Its own clause layout | The common structure of ISO management system standards |
| Integration | Mapping to other systems was laborious | An integrated system can be built on the same framework as ISO 9001, ISO 45001 and ISO/IEC 27001 |
Thanks to the common structure, context analysis, leadership, risks and opportunities, internal audit and management review can be run as a single process. For the boundary with information security, see the ISO 27001 entry.
How is it implemented in a logistics company?
- Define the scope: Which offices, warehouses, routes and subcontractors are included in the system?
- Identify assets and threats: High-value cargo, goods under customs control, parking points, border crossings.
- Rate the risks: Score likelihood and impact, and select those that are unacceptable.
- Put controls in place: Seal number verification, vehicle tracking, a secure parking plan, screening of staff and subcontractors, warehouse access logs.
- Prepare for incidents: Write a response and notification flow for theft, discovery of contraband or a seal breach, and test it with drills.
- Measure and audit: Keep the system continuously updated through incident records, internal audits and management review.
Certification is carried out through a two-stage audit; the certificate cycle and surveillance audits are explained in the validity period of ISO certificates entry.
Why does it matter?
It shows that security measures are run within a measurable system rather than existing only on paper. Customs administrations work on the same logic: Authorised Economic Operator programmes originated within the World Customs Organization's SAFE Framework, the current edition of which dates from 2025. The overlap with the security criteria required when applying for Authorised Obligor Status (Yetkilendirilmiş Yükümlü Statüsü), Türkiye's equivalent, is discussed in the ISO 28000 and Authorised Obligor Status entry. How the controls work in the field is illustrated in the contribution of ISO 28000 to supply chain security entry.
How does Voltim Global support this?
Voltim Global holds ISO 28000 certification together with ISO 50001 and ISO 14001. This framework ensures that, particularly in customs-bonded and transit transport, seal checks, vehicle tracking and incident reporting are carried out under a single procedure.
Frequently Asked Questions
Is ISO 28000 certification a legal requirement?
Is an ISO 28000:2007 certificate still valid?
Sources
- ISO 28000:2022 Security and resilience — Security management systems — Requirements (ISO/TC 292)
- World Customs Organization – SAFE Package (SAFE Framework of Standards, 2025 edition)