Supply Chain Security Foundations
The Foundations domain tests whether you can describe a supply chain as a system of nodes and links, name the flows that move across it, and explain why security is managed as a repeatable management system rather than a set of guards and cameras. Expect questions that separate security from resilience and ask which control belongs at which layer.
Nodes, links and flows
- Nodes are the fixed points where goods stop and are handled: supplier plants, ports, container yards, transload and cross-dock sites, distribution centres, high-value cages, retail backrooms.
- Links are the moves between nodes - road, rail, ocean, air and last mile - where custody changes hands.
- Each handoff is a custody event: someone signs for the goods, and that is the moment accountability either exists or evaporates.
- Three flows run in parallel: goods, information and money. Attacks ride the flows - a forged invoice (money) enables a fictitious pickup (goods); a spoofed email (information) diverts a load.
Design principles
- Layered defence: perimeter, facility, zone, item. No single control is trusted alone.
- Deter, detect, delay, respond, recover: each function needs an owner and evidence.
- Proportionality: spend follows consequence and likelihood, not habit.
- Security as enabler: trusted-trader status buys fewer inspections and faster release, so security pays back in velocity.
- Total cost of risk: loss, insurance premium, expediting, penalties and reputation - not just stolen value.
Management system
- PDCA: plan the controls, operate them, check with audits and metrics, act on gaps.
- ISO 28000 provides the supply chain security management system structure; ISO 28001 covers assessment and planning good practice.
- Document policy, risk assessment, control standards, training records and review minutes. Auditors test evidence, not intentions.
Worked example
An importer's seal-tamper reports triple at a third-party transload site. The intuitive fix is stronger seals. Reasoning through the system: the seals fail only at one node and only on night shifts, so the vulnerability is a custody gap - no seal log, temporary staff, no dock camera - not the seal grade. The proportionate response is dual-custody seal recording, contractor vetting, a dock audit at that node, and a seal-compliance metric reviewed monthly. Stronger seals alone would move the loss rather than stop it.
Traps
Treating C-TPAT or AEO membership as proof of control performance; equating security with physical measures only; ignoring information flows; recording seal numbers on some documents but not all; and writing a policy with no evidence trail.