ISO 28000 Certification for Supply Chain Security Management Systems

ISO 28000 is the international standard for supply chain security management systems, and itmad audits security management systems for logistics and supply chain organisations. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 28000 in brief

The standard specifies a security management system across the supply chain: the risk assessment, controls and resilience arrangements that protect goods, people and information in logistics, storage and transport. A certificate is independent confirmation that security is managed deliberately and not assumed.

Who the standard is for

ISO 28000 applies to any organisation at any point in the supply chain, including:

• Logistics and freight companies
• Warehouse and port operators
• Manufacturers with exposed supply chains
• Any organisation whose clients or regulators require demonstrable supply chain security

It works at any scale: a single warehouse, a forwarding operation or an end-to-end logistics network. It can also sit alongside customs-driven schemes such as Authorised Economic Operator status.

Why organisations certify

Freight forwarders, logistics operators, port service providers and manufacturers use the standard as a recognised way to show that cargo, facilities and the wider supply chain are protected against theft, tampering, smuggling and disruption.

What auditors examine

• Security risk assessmentThe threats to the supply chain and the vulnerabilities they could exploit, treated in proportion.
• Security policy and objectivesA stated organisational position on supply chain security, with measurable targets.
• Physical and procedural controlsControls over facilities, cargo, access and handling that match the assessed risk.
• Personnel securityScreening, competence and awareness for people in security-critical roles.
• Information and data securityProtection of the information that moves with and about the goods.
• Business continuity and resilienceArrangements to withstand disruption to the supply chain and to recover from it.
• Supplier and partner controlSecurity requirements extended to the third parties that the supply chain depends on.
• Incident managementDetecting, responding to and learning from security incidents.

How an itmad audit runs

Stage 1 reviews the security management documentation, confirms the scope of operations and locations covered, and establishes readiness, raising gaps early enough to close them. Stage 2 tests the system in operation: whether the security risk assessment is real and current, whether physical and procedural controls operate as documented, whether people understand their security responsibilities, and whether incidents are managed and learned from.

The certificate cycle

An ISO 28000 certificate from itmad is valid for three years, with surveillance audits in each of the two intervening years and full recertification before it expires. The certificate states its scope, including the operations and locations covered.

With other management system standards

ISO 28000 shares its high-level structure with ISO 9001, ISO 22301 and ISO/IEC 27001. An integrated audit covers the common clauses once, and the security risk assessment at the heart of ISO 28000 can draw on the same analysis that feeds the continuity and information security systems.

Independence

Independence is what gives the certificate its value to the customer who asked for it. ISO/IEC 17021-1 bars itmad from designing, implementing or consulting on the system being certified, so the role of itmad is limited to the audit, the certification decision and, on request, a pre-assessment that identifies gaps against ISO 28000 without prescribing the fix.

What itmad delivers

• A Stage 1 report on readiness gaps, issued before the main audit
• A Stage 2 audit report whose findings rest on objective evidence
• Nonconformities graded by severity, each with a defined response time
• A certificate of registration naming the certified scope and locations
• The certification mark, for use under itmad's mark and seal policy
• Annual surveillance audits and reports across the three-year cycle

Frequently asked questions

What is ISO 28000?

ISO 28000 specifies a security management system across the supply chain: the risk assessment, controls and resilience arrangements that protect goods, people and information in logistics, storage and transport. A certificate confirms that security is managed deliberately and not assumed.

Who needs ISO 28000?

Logistics and freight companies, warehouse and port operators, manufacturers with exposed supply chains, and any organisation whose clients or regulators require demonstrable supply chain security. It applies at any point in the chain, from a single warehouse to an end-to-end network.

Does ISO 28000 replace Authorised Economic Operator status?

No. ISO 28000 is a security management system standard that can sit alongside customs-driven schemes such as Authorised Economic Operator status. It gives logistics operators a recognised way to show that cargo and facilities are protected.

What does ISO 28000 require?

It requires security risk assessment, a security policy and objectives, physical and procedural controls, personnel security, information security, business continuity, supplier and partner control, and incident management. Controls are proportionate to the assessed risk.

How does an ISO 28000 audit work?

itmad audits in two stages. Stage 1 reviews the security management documentation and confirms the scope of operations and locations. Stage 2 tests whether the risk assessment is real and current and whether controls operate as documented.

How long does an ISO 28000 certificate last?

An ISO 28000 certificate from itmad is valid for three years, with surveillance audits in each of the two intervening years. Recertification is completed before expiry.