ISO 28000:2022 in plain English: supply chain security for logistics, warehousing, and security firms

Security officer checking the seal on a lorry trailer at a warehouse loading bay at dusk

If your business moves, stores, or guards other people’s goods, your customers are trusting you with something they can’t see. They can’t watch every trailer, every loading bay, or every handover. ISO 28000 gives you a recognised way to show them that security isn’t left to luck.

This guide explains what the standard is, who it suits, how it fits with the other ISO systems you may already have, and what certification actually involves. I’ve kept it in plain English, because most of the people who ask me about ISO 28000 are operations managers and directors, not standards specialists.

What ISO 28000 actually is

The current version is ISO 28000:2022, Security and resilience: Security management systems: Requirements. It’s the second edition, published in March 2022, and it replaced ISO 28000:2007, which ISO now lists as withdrawn.

In ISO’s own words, the standard “specifies requirements for a security management system, including aspects relevant to the supply chain.” Two other points in ISO’s summary matter for smaller firms. It applies to “all types and sizes of organizations”, and it “is not industry or sector specific.” So there’s no minimum headcount, and you don’t have to be a global shipping line to use it.

There has been one amendment since 2022. ISO 28000:2022/Amd 1:2024, titled “Climate action changes”, was published in February 2024. It’s the same climate change wording that was added across a long list of ISO management system standards at the same time (more on that below). If you buy the standard, make sure you get the amendment too.

A management system, by the way, is simply the way you run things: your policies, procedures, responsibilities, records, and the habit of checking and improving them. ISO 28000 asks you to build that around security risk.

Who ISO 28000 suits

Because the standard is deliberately not sector specific, the honest answer is “anyone with security risks in how goods or services flow”. In practice, the businesses that get the most out of it tend to be:

hauliers and couriers carrying high-value or attractive loads
warehouses and distribution centres holding customers’ stock
freight forwarders and customs agents handling cargo and its paperwork
security companies protecting goods in transit, depots, ports, or logistics sites
manufacturers whose own supply chain is a target for theft or tampering

BSI describes the challenge well: organisations face ongoing difficulty managing security risks in the movement and storage of goods. If that sentence describes your day job, ISO 28000 is worth a look.

For security companies, it’s a useful partner to ISO 18788 for security operations. ISO 18788 is about how you run security operations. ISO 28000 is about managing security risk across a supply chain, which may include your client’s supply chain as well as your own.

Risk assessment sits at the centre

Every ISO management system is really a structured way of asking, over and over, what could go wrong and whether what you’re doing about it is working. With ISO 28000, the “what could go wrong” is security. Think theft from vehicles, insider collusion, cargo tampering, forged documents, unauthorised access to yards, cyber attacks on tracking systems, and weak subcontractors.

In my audits, the businesses that struggle are the ones with a generic risk register copied from somewhere else. The ones that do well have walked their own sites and routes and written down what they actually found, such as the blind spot by the trailer park or the agency staff who never had references taken. If you want a simple method for that, my guide to risk assessments that actually work sets one out.

People are a big part of supply chain security. Pre-employment screening of staff with access to goods, keys, and systems is often where gaps appear. HMRC’s own security criteria for customs authorisation (see the AEO section below) include a heading on personnel security and pre-employment screening, which tells you how seriously it’s taken.

How ISO 28000 fits with your other ISO systems

ISO explains that, under its Harmonized Structure, “management standards are structured in the same way, regardless of the domain of application”. It adds that this common format (set out in what’s known as Annex SL) is “particularly useful” for organisations that run a single integrated management system.

There’s a neat piece of evidence that ISO 28000:2022 belongs to that family. When ISO and the IAF announced the February 2024 climate amendments, they listed ISO 28000:2022 alongside ISO 9001, ISO 14001, ISO 45001, and ISO 22301. Every one of them received the same new sentences in clauses 4.1 and 4.2: that the organisation “shall determine whether climate change is a relevant issue”, and a note that interested parties “can have requirements related to climate change.” Identical text in identical clauses only works because the standards share the same skeleton.

What this means in practice is that if you already hold ISO 9001 or a tri-standard system, you won’t need a second set of everything. Your context analysis, interested parties, objectives, internal audits, management review, and corrective action process can all be extended to cover security. I’ve written more about this approach in my piece on integrated management systems.

ISO 28000 and AEO customs status

This is the question I’m asked most by freight forwarders and exporters, so I checked HMRC’s guidance directly rather than repeating what’s said online.

Authorised Economic Operator (AEO) status is a UK customs authorisation. HMRC’s Customs Technical Handbook explains there are two types: AEOC for customs simplifications, and AEOS for security and safety. The aim, in HMRC’s words, is to give businesses “an internationally recognised standard” showing that “their role in the international supply chain is secure.”

The AEOS security and safety criteria include a section on international trade accreditation schemes. It names ISO standards, “in particular ISO 28000, 22301 and 9001 (although others may also apply)”, along with TAPA certification. HMRC says the criteria in these certificates “are taken into account to the extent that” they match the AEO criteria, and that “HMRC will take this into account in determining what further checks need to be carried out.”

So, to be clear about what this does and doesn’t mean:

ISO 28000 certification does not give you AEO status automatically
it can be taken into account by HMRC and may reduce further checks where the criteria correspond
if you rely on it, you’ll be asked to produce the certificate at the pre-authorisation audit, together with the report from the independent assessor who approved it
AEO is applied for separately, through HMRC

That last point about the assessor’s report is worth noting. It’s one reason to choose a certification body whose audit reports are thorough and clear.

How ISO 28000 certification works

ISO doesn’t certify anyone. ISO’s own certification page states that “ISO does not perform certification or issue certificates.” Certification is carried out by an independent certification body that you choose, ideally one accredited by UKAS for ISO 28000. ISO’s advice is to evaluate several certification bodies and check whether each one is accredited.

The broad journey looks like this:

Gap analysis against ISO 28000:2022 and the 2024 amendment.
Build or extend your management system: security risk assessment, policy, objectives, procedures, and records.
Run it for long enough to generate real evidence, including at least one internal audit and a management review.
Stage 1 audit by the certification body, which confirms your scope and checks you’re ready for stage 2.
Stage 2 audit, which checks the system is working in practice on site.
Surveillance audits at least yearly, and recertification after three years.

UKAS describes the same stage 1, stage 2, yearly surveillance, and three-year recertification pattern in its guidance for certification bodies certifying private maritime security companies to ISO 28000 (CIS 9). That guidance is written for the maritime sector, but the audit cycle it describes is the usual one for accredited management system certification. There’s more detail on each step in my ISO certification process guide.

A common gap I see at stage 2 is that the security risk assessment was done once for the manual and never touched again, even though the business has since taken on a new depot or a new subcontractor. Auditors look for a living document.

FAQs

What is ISO 28000?

ISO 28000:2022 is the international standard that sets out requirements for a security management system, including aspects relevant to the supply chain. It applies to organisations of any type and size and is not specific to any one industry.

What is the latest version of ISO 28000?

The current version is ISO 28000:2022, the second edition, published in March 2022. It has one amendment, ISO 28000:2022/Amd 1:2024 (climate action changes), published in February 2024. It replaced ISO 28000:2007.

Does ISO 28000 give you AEO status?

No. AEO is a separate customs authorisation from HMRC. However, HMRC’s AEOS guidance names ISO 28000 as a certificate it takes into account where its criteria correspond to AEO criteria, which may reduce the further checks HMRC carries out.

Can a small business get ISO 28000 certified?

Yes. ISO states the standard is applicable to all types and sizes of organisations. A small haulier or security firm needs a system proportionate to its own risks, not a corporate-sized one.

Can ISO 28000 be combined with ISO 9001?

Yes. ISO 28000:2022 shares ISO’s common management system structure, so it can be added to an existing ISO 9001, ISO 14001, or ISO 45001 system as one integrated management system.

Who issues ISO 28000 certificates?

An independent certification body, ideally accredited by UKAS for that standard. ISO itself does not issue certificates, and a consultant who helps you prepare should not be the one certifying you.

Get help preparing for ISO 28000

If you move, store, or protect goods and want to show customers that security is managed properly, I can help you get there without building a mountain of paperwork. CAW Consultancy prepares your system and gets you ready for audit; your certification is then carried out by an independent certification body of your choice. We also offer a free gap analysis to show you where you stand.

Call 01257 824481, email Craig@cawconsultancy.co.uk, or visit www.cawconsultancy.co.uk.

If staff vetting is a weak spot, our sister company Screen My Staff provides BS 7858 screening and compliance outsourcing. And if you’d rather run your security management system without paper files, CAW Digital builds bespoke paperless management systems.

Sources

Craig Willetts is the founder of CAW Consultancy Business Solutions Ltd and a UK lead auditor with over 20 years’ experience across ISO management systems and UK security industry schemes.