Guide
ISO 28000 — in brief
ISO 28000 is an international standard for security management systems. It helps organisations assess security risks — theft, substitution of goods, deliberate damage, unauthorised access, information leaks — and manage them systematically, both at their own sites and along the entire supply chain.
The current version is ISO 28000:2022. It follows the common structure of ISO management system standards and covers the security of the organisation more broadly, not just transport and logistics. The transition from the 2007 version ended in 2025.
Who is ISO 28000 for
The standard is suitable for any organisation through whose hands goods, documents or shipment data pass:
- Warehouses and logistics centres
- Carriers and freight forwarders
- Ports, airports and terminals
- Manufacturers with international shipments
- Customs agents and importers
- Security companies transporting valuables
What ISO 28000 requires
At the heart of the standard is the assessment of security risks: what the threats are, where the organisation is vulnerable and what the consequences would be. The measures are chosen on that basis and typically cover six areas: physical security (fences, access, lighting, video surveillance and key control), personnel (pre-employment screening, training and clear responsibilities), information (protection of documents, shipment data and systems), partners (requirements for and checks on suppliers, carriers and subcontractors), transport (seals, routes, monitoring and rules for stops) and incidents.
The standard also requires incident response plans — reporting, response, investigation and recovery — as well as staff training, monitoring of the measures, internal audits and management review. In this way security does not depend on a few individuals but becomes part of how the organisation is managed.
The benefits
Losses from the theft or substitution of cargo are rarely limited to the value of the goods: penalties, late deliveries and lost trust follow. The system reduces the likelihood of an incident and shows customers that their shipments are in safe hands.
ISO 28000 is also a useful foundation for Authorised Economic Operator (AEO) status under the Union Customs Code, which brings facilitations in customs controls. The authorisation is issued by the Customs Agency after checking a set of criteria, including compliance with customs and tax legislation, a system for managing commercial and transport records, proven financial solvency and appropriate safety and security standards. The measures, documents and records required by ISO 28000 support the last criterion most of all.
How implementation works
- Current-state analysisWe walk through your sites and routes and review the existing measures, contracts and documents.
- Risk assessmentWe identify threats, vulnerabilities and consequences for each site and process.
- Measures and proceduresAccess control, seals, personnel screening, information security, partners and transport.
- Incident responseAn action plan, reporting, investigation and recovery.
- Training and internal auditWe train your staff and check that the measures work in practice.
- Certification auditWe prepare the organisation for the audit by an independent certification body.
What you get
- Security policy and objectives
- Security risk assessment
- Procedures for access, seals and transport
- Requirements for partners and subcontractors
- Incident response plan
- Trained staff
- Internal audit and management review
- Preparation for the certification audit