ISO 28000:2022, Security and resilience – Security management systems – Requirements, is a management system standard published by International Organization for Standardization (ISO) that specifies requirements for a security management system including aspects relevant to the supply chain.[1]
The standard was originally developed by ISO/TC 8 on "Ships and maritime technology" and published in 2007.[2] In 2015 the responsibility for the ISO 28000 series was transferred to ISO/TC 292 on "Security and resilience", who in 2019 decided to start a revision.
A justification study for the revision was accepted by ISO TMB (Technical Management Board).[3]
The revised version of ISO 28000 was published on March 15, 2022.
Similar to other management system standards by ISO, the requirements specified in ISO 28000 are generic and intended to be applicable to all organizations, regardless of type, size, and industry. However, the extent of applicability of the requirements depends on the organization's environment and complexity.
ISO 28000:2022 is divided into 10 main clauses and has adopted the harmonized structure and standardized text set out by Annex SL.
The standard is divided as follows:
Scope
Normative references
Terms and definitions
Context of the organization
Leadership
Planning
Support
Operation
Performance evaluation
Improvement
ISO 28000:2007 was developed to standardize security within the broader supply chain management system. In the revision the PDCA management systems structure was adopted in expanding ISO 28000 to bring the elements of this standard in congruence with related standards such as ISO 9001:2000, ISO 14001:2004 and in particular ISO 22301:2018. Also the limitations of security within the supply chain were eliminated so that now it is clear that it can be used throughout all aspects of security of the organization.
The international standard addresses specifically the assessment and treatment of security-related risks (risks that relate to the security of the organization and its interested parties) and in this context refers to ISO 31000. This improves the broader interface with existing enterprise risk management in a common integrated platform. This integrated approach to risk management is recommended by ISO 31000 to better coordinate cross functional risk management mechanisms, improve performance measurement, ensure continual improvement and prevent silo thinking within the organization.
ISO 28000:2007 was initially developed so that organizations of varying scale could apply the standard to their supply chains of various degrees of complexity. Now, after the revision, ISO 28000:2022 can be applied beyond the supply chain to all aspects of the organization.
The general rational for an organization to adopt ISO 28000:2022 pertains to:
developing a security management system,
internal compliance with objectives of a security management policy,
external compliance with best practice benchmarks,
conformity assurance with the standard,
enhancing the organization's resilience by an effective, coordinated and integrated application of its security management system.
ISO 28000:2022 is a certifiable standard.[4] In 2016, the countries with the highest number of certificates were India (425), Japan (299), Spain (231), US (223) and UK (197).[3]
ISO 28000 was originally developed as a Publicly Available Specification by ISO technical committee ISO/TC 8 on Ships and marine technology [2] and published in 2005. In 2007, ISO/PAS 28000:2005 was withdrawn and replaced by a full ISO standard under the title ISO 28000:2007. In 2014, ISO 28000:2007 was reviewed and confirmed.[5]
In 2015, ISO/TC 292 Security and resilience took over the responsibility of the standard and decided later in 2019 to initiate a revision of the standard.[6] In March 2022 the revised second edition of the standard was published.[7]
ISO 28000 is the first of a series of ISO security management standards including:[8]
ISO 28001:2007 Security management systems for the supply chain – Best practices for implementing supply chain security, assessments and plans – Requirements and guidance
ISO 28002:2011 Security management systems for the supply chain – Development of resilience in the supply chain – Requirements with guidance for use
ISO 28003:2007 Security management systems for the supply chain – Requirements for bodies providing audit and certification of supply chain security management systems
ISO 28004 Security management systems for the supply chain – Guidelines for the implementation of ISO 28000
