PECB ISO 28000 Foundation cheat sheet

ISO 28000 is a management-system standard for security assurance in supply chains; it follows the same high-level structure (HLS) as ISO 9001 and ISO 14001, so clauses 4-10 map to the same Plan-Do-Check-Act logic.

An SeMS (Security Management System) is the set of interrelated elements an organization uses to establish security policy, objectives, and processes to achieve those objectives; it is not a physical security product or a guard force.

Core ISO 28000 principles: top-management leadership, risk-based thinking, process approach, evidence-based decision making, continual improvement, and consideration of interested parties and their security requirements.

Security risk = likelihood of a security event (theft, piracy, terrorism, fraud, contraband, cyber intrusion, unauthorized access) multiplied by its consequence for assets, people, operations, and reputation.

The SeMS scope boundary must state which activities, products, services, locations, and supply-chain interfaces are covered; anything excluded must be justified and cannot be silently omitted.

PDCA mapping: Clause 4-6 = Plan (context, leadership, planning); Clause 7-8 = Do (support, operation); Clause 9 = Check (performance evaluation); Clause 10 = Act (improvement).

Asset-based vs. process-based thinking: ISO 28000 requires a process view of security, so controls are designed around end-to-end processes (procurement, transport, storage, delivery) rather than isolated assets.

Documented information is the evidence layer of the SeMS; if a process is not recorded in a controlled way, an auditor cannot verify that it is implemented or effective.

Clause 4 (Context): determine external and internal issues, identify interested parties and their security requirements, define the SeMS scope, and establish the SeMS processes needed.

Clause 5 (Leadership): top management must set the security policy, ensure resources, assign roles and responsibilities, and integrate security requirements into business processes; the policy must include a commitment to continual improvement.

Clause 6 (Planning): identify security risks and opportunities, determine controls, set measurable security objectives with plans (what, who, when, resources, evaluation), and plan changes deliberately.

Clause 7 (Support): provide resources, competence (training and awareness of security roles), awareness, communication (internal and external), and control documented information (creation, approval, version control, retention, protection).

Clause 8 (Operation): plan and control operational processes, manage outsourced and subcontracted security activities, apply controls to identified risks, and prepare for and respond to security incidents and emergencies.

Clause 9 (Performance evaluation): monitor, measure, analyse and evaluate security performance with defined indicators, conduct internal audits at planned intervals, and hold management reviews covering inputs, outputs, and decisions.

Clause 10 (Improvement): handle nonconformities and corrective actions (identify cause, act, review effectiveness, update risks if needed) and continually improve the suitability, adequacy, and effectiveness of the SeMS.

Audit decision rule: a nonconformity is a requirement not fulfilled; a major nonconformity means the SeMS cannot achieve its intended outcome or a whole clause is unimplemented; an observation is a risk without a proven breach.

Certification logic: ISO 28000 is certifiable by third-party audit; ISO 28003 provides the audit and certification body requirements, while ISO 28001 supports security best practices and assessment for the supply chain.