PECB ISO 28000 LI cheat sheet

ISO 28000 is a management system standard for security assurance in supply chains; it follows the same high-level structure (Annex SL) as ISO 9001 and ISO 14001, so clauses 4-10 map to context, leadership, planning, support, operation, performance evaluation and improvement.

A Security Management System (SeMS) is the set of interrelated or interacting elements of an organization used to establish security policy and security objectives and to achieve those objectives; the standard does not prescribe specific security controls or technologies.

ISO 28000 applies to organizations of any size that are involved in purchasing, manufacturing, service provision, storage, distribution, transport or disposal of goods and products at any stage of the supply chain, including intermediaries.

Key terms: 'security' means resistance to intentional, unauthorized acts directed to cause harm; this distinguishes SeMS scope from safety (unintentional harm) and from pure quality management.

Risk-based thinking is foundational: security risk is the effect of uncertainty on security objectives, assessed as a combination of likelihood of an event and its consequences, including threat, vulnerability and impact.

The Plan-Do-Check-Act (PDCA) cycle underpins the standard: Plan = clauses 4-6, Do = clauses 7-8, Check = clause 9, Act = clause 10; certification audits test that the cycle operates, not merely that documents exist.

Documented information replaces the older terms 'documents' and 'records'; the organization decides what documented information is necessary for the effectiveness of the SeMS, subject to any explicit standard requirements.

Continual improvement is a recurring objective, not a one-time project: the standard requires improvement of security performance, not only of the management system's paperwork.

A typical initiation sequence: obtain top-management commitment, define the SeMS scope and boundaries, map interested parties and their security requirements, perform a gap analysis against ISO 28000 clauses, then build the implementation plan.

Scope definition must state the products/services, the supply-chain stages covered, physical and organizational boundaries, and any exclusions with justification; the scope cannot exclude a clause that affects the ability to achieve security objectives.

A gap analysis compares current practices with each ISO 28000 requirement and rates maturity (e.g., absent, informal, documented, monitored, improved); its output feeds the implementation roadmap and resource request.

Interested parties typically include customers, regulators, insurers, employees, contractors, carriers, port/terminal operators, customs authorities and local communities; their requirements become compliance obligations.

Context analysis (clause 4.1) covers external issues (regulatory, market, geopolitical, criminal threat landscape, technology) and internal issues (culture, structure, capability, ICT systems, facilities).

Top management must appoint roles and responsibilities for the SeMS; a management representative or security manager is common, but accountability for the SeMS remains with top management.

Implementation planning should sequence: awareness and training, risk assessment methodology, documentation development, operational control rollout, internal audit, management review, then certification readiness.

A common initiation failure is treating the SeMS as a security-guard project rather than a cross-functional management system involving procurement, HR, logistics, IT and legal.

Clause 6.1 requires the organization to plan actions to address risks and opportunities, integrating and implementing them into SeMS processes and evaluating their effectiveness; the actions must be proportionate to the potential impact.

Security risk assessment must determine risks associated with identified security threats, assess likelihood and consequences, and determine risk levels against defined criteria; the methodology, criteria and acceptable risk levels must be documented.

Risk treatment options include avoiding the risk, taking the risk to pursue an opportunity, removing the risk source, changing likelihood or consequence, sharing the risk, or accepting the risk by informed decision.

Security objectives (clause 6.2) must be consistent with the security policy, measurable where practicable, monitored, communicated, and updated; they should be assigned to functions, levels and timeframes with a plan of what, who, when, resources and evaluation.

The security policy must be appropriate to the organization's purpose, include a commitment to satisfy applicable requirements and to continual improvement, be documented, communicated and available to interested parties as appropriate.

Legal and other requirements (clause 6.1.3 in ISO 28000 lineage) include customs and trade-security programmes, transport security regulations, contractual security clauses, insurance conditions and international sanctions.

Planning must address planned changes (clause 6.3-style thinking): changes to scope, facilities, carriers or ICT systems are assessed for security risk before implementation.

Risk criteria should define likelihood and consequence scales, risk matrix thresholds, and who has authority to accept residual risk; without documented criteria, risk registers become subjective and unauditable.

Support (clause 7) covers resources, competence, awareness, communication and documented information; competence means the ability to apply knowledge and skills, verified by education, training or experience records.

Operational planning and control (clause 8.1) requires criteria for processes, implementation of control according to criteria, and control of outsourced processes; outsourced security-relevant processes (e.g., guarding, transport) remain the organization's responsibility.

Operational controls commonly include access control to facilities, screening and vetting of personnel, cargo inspection and sealing, tamper-evident packaging, tracking and traceability, incident reporting and investigation, and business continuity arrangements.

Emergency preparedness and response requires planned responses to identified potential security incidents and emergencies, periodic testing of those responses, and review and revision after tests or actual events.

Documented information control requires identification, format, review and approval for suitability, availability where needed, protection from loss or misuse, and retention/disposition rules; version control prevents obsolete procedures being used.

Communication (clause 7.4) must determine what, when, with whom and how to communicate internally and externally, including reporting to authorities, customers and insurers, and receiving complaints or threat intelligence.

Implementation should be rolled out through procedures and work instructions tied to the risk register, so each significant risk has an identified control owner, control activity, and evidence of operation.

Contractor and supplier security requirements should be defined, communicated and monitored; supplier selection and re-evaluation criteria are part of operational control, not procurement convenience.

Monitoring, measurement, analysis and evaluation (clause 9.1) requires determining what to monitor, the methods, when monitoring and measurement occur, when results are analysed, and who evaluates them; results are retained as documented information.

Security performance indicators should be leading (training completion, drill frequency, supplier assessments, control coverage) and lagging (incidents, losses, nonconformities, corrective action closure time).

Internal audit (clause 9.2) must be planned at intervals, use defined criteria and scope, be conducted by objective and impartial auditors, and report results to relevant management; auditors should not audit their own work.

The audit programme considers the importance of processes, changes affecting the organization, and results of previous audits; findings are graded as conformities, observations, minor nonconformities and major nonconformities.

Management review (clause 9.3) inputs include audit results, nonconformities and corrective actions, monitoring and measurement results, risk assessment status, interested party feedback, and resource adequacy; outputs include improvement and resource decisions.

A nonconformity is non-fulfilment of a requirement; corrective action addresses the cause, while correction addresses the symptom; containment or immediate action limits impact before root-cause analysis.

Root-cause analysis tools (5 Whys, fishbone, fault-tree) should lead to changes in the SeMS, and effectiveness of corrective action must be verified, not assumed on closure of the record.

Evaluation compares results against security objectives and acceptable risk levels; unfavourable trends trigger re-planning under clause 6 rather than being recorded and ignored.

Clause 10 requires the organization to determine opportunities for improvement and implement necessary actions to achieve intended outcomes; improvement covers both security performance and SeMS suitability, adequacy and effectiveness.

Sources of improvement include internal and external audit findings, incidents and near misses, management review outputs, threat-intelligence updates, drills and exercises, supplier performance data and benchmarking.

Improvement can be incremental (corrective action, process tweak) or breakthrough (new technology, redesigned logistics route, changed supplier base); both are legitimate under clause 10.

Lessons learned from incidents, near misses, drills and industry events should be captured, analysed and fed back into risk assessment, training and operational controls.

Corrective action records should show the problem, containment, root cause, chosen action, responsible person, due date, verification of effectiveness and any resulting change to risk assessment or documented information.

Security risk assessments must be reviewed when significant changes occur or at planned intervals; an unchanged risk register over multiple cycles is a warning sign of a static SeMS.

Management commitment to improvement is demonstrated by resourcing actions and integrating improvements into business processes, not by issuing a policy statement alone.

Maturity progression (e.g., from ad hoc to managed to optimized) can be tracked with a capability model, giving top management a trend line beyond pass/fail audit results.

Certification is a multi-stage process: application and contract review, Stage 1 (readiness/documentation and scope review), Stage 2 (implementation effectiveness), then surveillance audits (typically annually) and recertification before the three-year cycle ends.

Stage 1 typically checks scope, policy, objectives, risk assessment and register, internal audit and management review evidence, and readiness for Stage 2; it is not a full conformity audit.

Stage 2 samples evidence of implementation and effectiveness across all clauses and the defined scope; auditors look for objective evidence, not opinions, and may raise nonconformities requiring correction and corrective action.

Major nonconformity usually blocks certification until corrected and verified; minor nonconformities normally require an accepted corrective action plan with verification at the next audit.

Internal audit must be completed and management review held before Stage 2; the audit programme and impartiality of auditors are commonly checked.

Certification body selection considers accreditation (e.g., IAF member, national accreditation body), scope competence in supply-chain security, auditor availability, and fee structure; the body must not consult and certify the same client.

Preparation includes a documentation map (manual or equivalent, procedures, risk register, legal register, records), evidence sampling packs per clause, and briefing of interviewees so answers reflect actual practice.

Certificates state the scope of certification and the standard; scope changes (new sites, new services) must be communicated to the certification body, which decides on a special audit.