ISO 28000 Supply Chain Security Management System Certification in Sri Lanka
itmad audits ISO 28000 supply chain security systems in Sri Lanka: two-stage audit, three-year certificate, Sri Lanka-based and travelling auditors.
ISO 28000 is the international standard for supply chain security management systems, and itmad audits ISO 28000 security management systems for logistics and supply chain organisations in Sri Lanka. itmad audits with both Sri Lanka-based auditors and a travelling team, and has worked in Sri Lanka for more than 5 years. ISO 28000 certification from itmad follows a two-stage audit and produces a certificate that runs for three years with annual surveillance audits.
What ISO 28000 is
ISO 28000 specifies requirements for a security management system across the supply chain: the risk assessment, controls and resilience arrangements that protect goods, people and information in logistics, storage and transport. ISO 28000 certification is independent confirmation that security is managed deliberately rather than assumed.
Who ISO 28000 applies to
An organisation in Sri Lanka needs ISO 28000 certification when a customer or supplier programme asks for independent proof of its supply chain security management system. ISO 28000 applies to any organisation at any point in the supply chain, including:
- Logistics and freight companies
- Warehouse and port operators
- Manufacturers with exposed supply chains
- Any organisation whose clients or regulators require demonstrable supply chain security
ISO 28000 applies at any point in the chain: a single warehouse, a forwarding operation, or an end-to-end logistics network. ISO 28000 can sit alongside customs-driven schemes such as Authorised Economic Operator status. itmad audits ISO 28000 for logistics and supply chain organisations in Sri Lanka.
Why organisations certify to ISO 28000
ISO 28000 gives freight forwarders, logistics operators, port service providers and manufacturers a recognised way to demonstrate that cargo, facilities and the wider supply chain are protected against theft, tampering, smuggling and disruption.
What ISO 28000 requires
- Security risk assessmentIdentifying threats to the supply chain and the vulnerabilities that the threats could exploit, and treating the threats proportionately.
- Security policy and objectivesA stated organisational position on supply chain security, with measurable targets.
- Physical and procedural controlsControls over facilities, cargo, access and handling appropriate to the assessed risk.
- Personnel securityScreening, competence and awareness for people in security-critical roles.
- Information and data securityProtecting the information that moves with and about the goods.
- Business continuity and resilienceArrangements to withstand and recover from disruption to the supply chain.
- Supplier and partner controlExtending security requirements to the third parties that the supply chain depends on.
- Incident managementDetecting, responding to and learning from security incidents.
Certification in Sri Lanka
An ISO 28000 certificate states the certified scope, including the operations and locations covered, and a Sri Lankan buyer or supplier programme checks that scope wording. Each Sri Lankan buyer or supplier programme sets acceptance conditions for ISO 28000 certificates.
How itmad delivers ISO 28000 in Sri Lanka
itmad delivers ISO 28000 audits in Sri Lanka through Sri Lanka-based auditors and a travelling team, for logistics and supply chain organisations. ISO/IEC 17021-1 prevents a certification body from designing, implementing or consulting on the management system that the body certifies, and itmad does not. itmad provides the audit, the certification decision, and optional pre-assessment that identifies gaps without prescribing how an organisation closes those gaps.
The ISO 28000 certification process
Stage 1 of an itmad ISO 28000 audit reviews the security management documentation, confirms the scope of operations and locations covered, and establishes readiness, raising gaps early enough to be closed. Stage 2 of an itmad ISO 28000 audit assesses implementation: whether the security risk assessment is real and current, whether the physical and procedural controls operate as documented, whether personnel understand their security responsibilities, and whether incidents are managed and learned from.
ISO 28000 timeline
An ISO 28000 certificate from itmad is valid for three years, with surveillance audits in each intervening year and full recertification before the certificate expires.
ISO 28000 with other management system standards
ISO 28000 shares its high-level structure with ISO 9001, ISO 22301 and ISO/IEC 27001. Integrated auditing covers the common clauses once rather than repeatedly, and the security risk assessment at the heart of ISO 28000 can draw on the same analysis that feeds the continuity and information security systems.
What itmad provides
- Stage 1 report identifying readiness gaps before the main audit
- Stage 2 audit report with findings supported by objective evidence
- Nonconformities classified by severity with defined response timescales
- Certificate of registration stating the certified scope and locations
- Certification mark for use under the terms of itmad's mark and seal policy
- Annual surveillance audits and reports through the three-year cycle
Frequently asked questions
What is ISO 28000?
ISO 28000 specifies requirements for a security management system across the supply chain: the risk assessment, controls and resilience arrangements that protect goods, people and information in logistics, storage and transport. ISO 28000 certification is independent confirmation that security is managed deliberately rather than assumed.
How does ISO 28000 certification work with itmad in Sri Lanka?
itmad audits ISO 28000 in two stages. Stage 1 reviews the security management documentation, confirms the scope of operations and locations covered, and establishes readiness. Stage 2 assesses whether the security risk assessment is real and current, and whether the physical and procedural controls operate as documented. The ISO 28000 certificate is valid for three years, with surveillance audits in each intervening year.
Does itmad use auditors based in Sri Lanka?
itmad uses both Sri Lanka-based auditors and a travelling team for ISO 28000 audits in Sri Lanka. itmad has worked in Sri Lanka for more than 5 years.
Who needs ISO 28000?
ISO 28000 applies to logistics and freight companies, warehouse and port operators, manufacturers with exposed supply chains, and any organisation whose clients or regulators require demonstrable supply chain security. ISO 28000 applies at any point in the chain: a single warehouse, a forwarding operation, or an end-to-end logistics network.
What does ISO 28000 require?
ISO 28000 requires security risk assessment, a security policy and objectives, physical and procedural controls, personnel security, information and data security, business continuity and resilience, supplier and partner control, and incident management. Controls are proportionate to the assessed risk.
Does ISO 28000 replace Authorised Economic Operator status?
No. ISO 28000 is a security management system standard that can sit alongside customs-driven schemes such as Authorised Economic Operator status. ISO 28000 gives freight forwarders, logistics operators and port service providers a recognised way to demonstrate that cargo and facilities are protected.