Skip to main content

ISO 28000:2022

ISO 28000 certification for security management

Independent certification of how your organisation assesses and controls security risks to its operations and supply chain.

Request a quoteTransfer a certificate
Strands of fibre-optic light suggesting a secure network
Valid for
3 years
Surveillance
Years 1 and 2
Verification
Public register

Accredited and empanelled

What is ISO 28000?

ISO 28000 specifies requirements for a security management system. It asks an organisation to understand the security threats to its people, assets, operations and supply chain, assess the risks, and put in place proportionate controls, plans and response capabilities.

The 2022 edition widened the standard's reach. Earlier editions were framed around supply chain security; ISO 28000:2022 applies to any organisation managing security risks, follows the harmonised structure and aligns its risk process with ISO 31000. Supply chain security remains a central use.

Ports, freight forwarders, logistics providers and manufacturers of high-value goods use ISO 28000 to show customers, insurers and authorities that cargo, facilities and people are protected. It complements customs programmes such as Authorised Economic Operator, though it does not replace them.

Who it is for

  • Ports, terminals and freight hubs
  • Freight forwarders, 3PL and warehousing companies
  • Manufacturers of high-value or controlled goods
  • Cash and valuables logistics companies
  • Security service providers
  • Operators of critical infrastructure

What sets audit time and cost

Application to certification decision usually takes ten to fourteen weeks, with Stage 2 covering a sample of facilities and operational security in practice.

  • Number of personnel in scope
  • Number of facilities, terminals and warehouses
  • Number of supply chain partners within scope
  • Threat level of the operating environment
  • Integration with ISO 9001 or ISO 22301

Why it matters

What ISO 28000 gives you

  1. 01

    Fewer losses

    Assessed threats and matching controls reduce theft, tampering and unauthorised access.

  2. 02

    Confidence for customers and insurers

    An audited security system supports customer due diligence and insurance discussions.

  3. 03

    Secure supply chain partners

    Security requirements reach carriers, subcontractors and other partners who handle your goods.

  4. 04

    Prepared response

    Security plans and exercises shorten the response to incidents and limit disruption.

The audit

What our auditors examine

  1. 01

    Security risk assessment

    Identification of threats, vulnerabilities and consequences across facilities, people, information and supply chain.

  2. 02

    Security controls

    Physical, personnel, procedural and information security measures selected from the risk assessment.

  3. 03

    Supply chain partners

    Security requirements for carriers, subcontractors and partners, and how compliance is checked.

  4. 04

    Security plans

    Plans for responding to security incidents and threats, including communication with authorities.

  5. 05

    Exercises and evaluation

    Testing of security plans and controls, and evaluation of their effectiveness.

How certification works

Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.

  1. 01

    Application and quote

    Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.

  2. 02

    Stage 1 audit

    We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.

  3. 03

    Stage 2 audit

    Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.

  4. 04

    Certification decision

    Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.

  5. 05

    Surveillance audits

    Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.

  6. 06

    Recertification

    Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.

Related standards and audits

Often certified or audited alongside this one, sometimes in a single combined audit.

Industries we audit for

ISO 28000 questions

We audit; we do not consult.

To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.

Plan your ISO 28000 certification

Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.

Request a quoteTalk to our team