Protected cargo and assets
Theft, tampering and unauthorised access controlled.
Certification support
ISO 28000 Security Management
Current edition: ISO 28000:2022
The security management system standard for organisations that need to protect people, assets, cargo and operations, especially across supply chains, ports and logistics. The 2022 edition broadened its scope beyond the supply chain and adopted the harmonized structure.
What the standard covers
Requirements, clause by clause
ISO 28000 applies risk-based security management to your operations and the parts of the supply chain you depend on.
4
Context
Security issues, interested parties, legal requirements, scope.
5
Leadership
Commitment, security policy, roles and responsibilities.
6
Planning
Security risk assessment, objectives, planning of changes.
7
Support
Resources, competence, awareness, communication, documented information.
8
Operation
Security controls, security strategies and plans, incident response and recovery.
9
Performance evaluation
Monitoring, internal audit, management review.
10
Improvement
Nonconformity, corrective action and continual improvement.
Clauses 4 to 10 follow the harmonized structure shared with ISO 9001 and ISO/IEC 27001, so the systems integrate cleanly.
Why organisations implement it
What a working security management system delivers
Customs facilitation
A structured basis for AEO and C-TPAT style programmes.
Partner confidence
Security evidence for shippers, carriers and port authorities.
Incident readiness
Response and recovery plans for security incidents.
Supplier security
Security expectations set and checked with partners.
Integrates with resilience
Works alongside ISO 22301 and ISO/IEC 27001.
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO 28000, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
Integration with ISO 22301, ISO/IEC 27001 or ISO 9001.
Typically 3 to 5 months
Who certifies
Independent certification, chosen to fit your market
Your ISO 28000 certificate is issued by an independent certification body accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We are not tied to one certification body and help you select one that your customers and regulators recognise.
Audit-ready
Exercises, mock audit and closed corrective actions before Stage 1 and Stage 2.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO 28000 by industry
Shipping & ports · terminals, freight and port security
Transport & logistics · warehousing, forwarding and haulage
Manufacturing · exporters and high-value goods
Oil & gas · facilities and offshore logistics
Government · customs and border operations
Related standards
Questions
ISO 28000 FAQ
Does AEC issue the ISO 28000 certificate?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for that audit.
Does ISO 28000 give us AEO status?
No. AEO and C-TPAT status are granted by customs authorities. An ISO 28000 system provides much of the security management those programmes look for, and we map it to their criteria.
What changed in the 2022 edition?
ISO 28000:2022 adopted the harmonized structure and broadened its scope from supply chain security to security management for any organisation, while keeping its supply chain relevance.
Is ISO 28000 only for ports and logistics?
No. Any organisation with significant security risk can use it, though ports, logistics providers and exporters are the most common users.
Start your ISO 28000 programme
Tell us your sites, cargo and supply chain partners. We reply with a proposal covering security risk assessment, implementation and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.