How to tackle the ISO 28000
Securing the Flow: Real-World Supply Chain Resilience Under ISO 28000
Over my twenty years of auditing, I have stood on the docks of major international ports, walked the aisles of massive distribution centers, and traced the routes of global cargo carriers. If there is one thing this experience has taught me, it is that a supply chain is not a chain at all—it is a complex, living web. And like any web, a pull on a single thread in one corner of the world can cause the entire structure to vibrate, or even collapse, thousands of miles away.
ISO 28000 is the international standard for Supply Chain Security Management Systems.
Historically, many companies viewed supply chain security as a matter of physical barriers: high fences, security guards, and heavy padlocks on shipping containers. But in today’s hyper-connected, just-in-time global economy, physical security is only a fraction of the equation. ISO 28000 (especially with its modern update, **ISO 28000:2022**) shifts the focus from simple asset protection to holistic organizational resilience.
The Vulnerability of the "Just-in-Time" Model
The modern supply chain is built for efficiency, not necessarily for resilience. To keep costs low, organizations have spent decades stripping out redundancy. They rely on single-source suppliers, minimal warehouse inventory, and tightly scheduled logistics corridors.
While this "just-in-time" model is fantastic for the balance sheet during stable times, it makes organizations incredibly vulnerable to disruptions.
When I audit an organization against ISO 28000, I look for a fundamental shift in mindset. You cannot prevent geopolitical conflicts, labor strikes, extreme weather, or cyberattacks on shipping lines. Therefore, your security management system must be designed to absorb these shocks and keep your goods moving.
Beyond Padlocks: The Three Pillars of Supply Chain Security
A robust ISO 28000 system must address security across three distinct but deeply interconnected pillars:
* **Physical Security:** This is the traditional domain. Are your warehouses secure? Are cargo containers sealed and tracked? Are access controls robust? While basic, these controls must be disciplined and continuously verified.
* **Information and Cyber Security:** Modern logistics relies entirely on data. If a hacker breaches your enterprise resource planning (ERP) system or alters shipping manifests digitally, your physical cargo can be stolen or redirected without a single lock being broken.
* **Operational Security:** This involves your processes and people. Who has access to shipping schedules? How do you vet your logistics partners? Are your employees trained to spot internal conspiracies or cargo tampering?
During an audit, I look for integration. If your physical security team does not talk to your IT security team, or if your procurement department is onboarding suppliers without assessing their security risks, your ISO 28000 system has a critical gap.
The Power of the 2022 Update: Aligning with Resilience
The release of **ISO 28000:2022** brought a major, welcome change: it adopted the Harmonized Structure (formerly High-Level Structure) used by other major standards like ISO 9001, ISO 14001, and ISO 27001.
This update was not just administrative. It officially merged the concepts of *security* and *resilience*.
When I audit a company under the 2022 version, I want to see that supply chain risk is treated as an enterprise-level business risk. It should be discussed in the same boardroom meetings where financial performance and market growth are analyzed. The standard now explicitly requires organizations to assess not just immediate security threats (like theft or terrorism), but also wider disruptive events that could threaten the continuity of the entire supply chain.
Vetting the Ripple Effect: Supplier Relationships
You are only as secure as your weakest supplier. You could have a flawless security posture at your own facilities, but if your tier-one supplier packages your products in an unsecured warehouse, your brand is exposed.
Under ISO 28000, you must extend your security expectations outward.
During audits, I pay close attention to purchasing and supplier management controls. I look for:
* **Risk-Based Supplier Evaluations:** Do you audit your suppliers' security practices, or do you take their word for it?
* **Security Agreements:** Are security expectations clearly defined in your contracts with third-party logistics (3PL) providers and freight forwarders?
* **Chain of Custody Verification:** Can you prove who had physical and digital custody of your goods at every single point of transit, from origin to destination?
If you treat logistics providers as cheap commodities rather than partners in security, you lose control of your product the moment it leaves your loading dock.
A Living System for a Volatile World
Preparing for an ISO 28000 audit is not about proving that your supply chain is invulnerable—no such supply chain exists.
Instead, it is about proving to the auditor, your clients, and your stakeholders that you have mapped your vulnerabilities, secured your data and physical assets, vetted your partners, and built a system capable of adapting to a rapidly changing world. When you achieve that, security ceases to be a cost center and becomes a powerful competitive advantage.
Over my twenty years of auditing, I have stood on the docks of major international ports, walked the aisles of massive distribution centers, and traced the routes of global cargo carriers. If there is one thing this experience has taught me, it is that a supply chain is not a chain at all—it is a complex, living web. And like any web, a pull on a single thread in one corner of the world can cause the entire structure to vibrate, or even collapse, thousands of miles away.
ISO 28000 is the international standard for Supply Chain Security Management Systems.
Historically, many companies viewed supply chain security as a matter of physical barriers: high fences, security guards, and heavy padlocks on shipping containers. But in today’s hyper-connected, just-in-time global economy, physical security is only a fraction of the equation. ISO 28000 (especially with its modern update, **ISO 28000:2022**) shifts the focus from simple asset protection to holistic organizational resilience.
The Vulnerability of the "Just-in-Time" Model
The modern supply chain is built for efficiency, not necessarily for resilience. To keep costs low, organizations have spent decades stripping out redundancy. They rely on single-source suppliers, minimal warehouse inventory, and tightly scheduled logistics corridors.
While this "just-in-time" model is fantastic for the balance sheet during stable times, it makes organizations incredibly vulnerable to disruptions.
When I audit an organization against ISO 28000, I look for a fundamental shift in mindset. You cannot prevent geopolitical conflicts, labor strikes, extreme weather, or cyberattacks on shipping lines. Therefore, your security management system must be designed to absorb these shocks and keep your goods moving.
Beyond Padlocks: The Three Pillars of Supply Chain Security
A robust ISO 28000 system must address security across three distinct but deeply interconnected pillars:
* **Physical Security:** This is the traditional domain. Are your warehouses secure? Are cargo containers sealed and tracked? Are access controls robust? While basic, these controls must be disciplined and continuously verified.
* **Information and Cyber Security:** Modern logistics relies entirely on data. If a hacker breaches your enterprise resource planning (ERP) system or alters shipping manifests digitally, your physical cargo can be stolen or redirected without a single lock being broken.
* **Operational Security:** This involves your processes and people. Who has access to shipping schedules? How do you vet your logistics partners? Are your employees trained to spot internal conspiracies or cargo tampering?
During an audit, I look for integration. If your physical security team does not talk to your IT security team, or if your procurement department is onboarding suppliers without assessing their security risks, your ISO 28000 system has a critical gap.
The Power of the 2022 Update: Aligning with Resilience
The release of **ISO 28000:2022** brought a major, welcome change: it adopted the Harmonized Structure (formerly High-Level Structure) used by other major standards like ISO 9001, ISO 14001, and ISO 27001.
This update was not just administrative. It officially merged the concepts of *security* and *resilience*.
When I audit a company under the 2022 version, I want to see that supply chain risk is treated as an enterprise-level business risk. It should be discussed in the same boardroom meetings where financial performance and market growth are analyzed. The standard now explicitly requires organizations to assess not just immediate security threats (like theft or terrorism), but also wider disruptive events that could threaten the continuity of the entire supply chain.
Vetting the Ripple Effect: Supplier Relationships
You are only as secure as your weakest supplier. You could have a flawless security posture at your own facilities, but if your tier-one supplier packages your products in an unsecured warehouse, your brand is exposed.
Under ISO 28000, you must extend your security expectations outward.
During audits, I pay close attention to purchasing and supplier management controls. I look for:
* **Risk-Based Supplier Evaluations:** Do you audit your suppliers' security practices, or do you take their word for it?
* **Security Agreements:** Are security expectations clearly defined in your contracts with third-party logistics (3PL) providers and freight forwarders?
* **Chain of Custody Verification:** Can you prove who had physical and digital custody of your goods at every single point of transit, from origin to destination?
If you treat logistics providers as cheap commodities rather than partners in security, you lose control of your product the moment it leaves your loading dock.
A Living System for a Volatile World
Preparing for an ISO 28000 audit is not about proving that your supply chain is invulnerable—no such supply chain exists.
Instead, it is about proving to the auditor, your clients, and your stakeholders that you have mapped your vulnerabilities, secured your data and physical assets, vetted your partners, and built a system capable of adapting to a rapidly changing world. When you achieve that, security ceases to be a cost center and becomes a powerful competitive advantage.
