ISO 28000 — Supply Chain Security Management System

Why does it matter?

The Introduction describes an increasing uncertainty and volatility in the security environment and notes that supply chains are dynamic, so some organizations that manage multiple supply chains look to their providers to meet related security standards as a condition of being included. ISO 28000:2022 gives both sides a common management system to point to.

Key benefits include:

• One system across the supply chain

The organization assesses its security environment including supply chain dependencies and interdependencies, and aligns upstream and downstream processes and controls with its objectives (Introduction and Clause 4.1).

• Obligations managed in one place

Clause 4.2.2 covers legal, regulatory and other requirements, and the Introduction requires the organization to manage compliance with statutory, regulatory and voluntary obligations.

• Risk assessment tied to treatment

Security-related risks and opportunities are determined and addressed in Clauses 6.1.2 and 6.1.3, and carried into operation through risk assessment and treatment in Clause 8.3.

• Plans for response and recovery

Clause 8.6 requires security plans with a response structure, warning and communication, defined content and recovery; the 2022 edition added these for consistency with ISO 22301.

• Fits other ISO management systems

The Introduction names ISO 9001, ISO 14001, ISO 22301, ISO/IEC 27001 and ISO 45001 as standards with which it supports consistent and integrated implementation.

How does it work?

ISO 28000:2022 applies the Plan-Do-Check-Act model (Introduction, Table 1). Plan establishes the security policy, objectives, targets, controls, processes and procedures; Do implements and operates them; Check monitors and reviews performance against the policy and objectives and reports results to management; Act maintains and improves the system through corrective action and management review.

The requirements run from Clause 4 to Clause 10. The organization determines its context, interested parties, legal, regulatory and other requirements, principles and scope (Clause 4), sets a security policy with top management commitment and assigned roles (Clause 5), and plans actions for security-related risks and opportunities, security objectives and changes (Clause 6). Clause 7 covers resources, competence, awareness, communication and documented information.

Clause 8 is where the system operates. The organization identifies its processes and activities (8.2), assesses and treats security risks (8.3), applies controls (8.4), selects security strategies and treatments with the resources they need (8.5) and maintains security plans (8.6). Clause 9 evaluates performance through monitoring, internal audit and management review, and Clause 10 handles nonconformity, corrective action and continual improvement.

Key Elements

• Context and principles (Clause 4)

Understanding the organization and its context (4.1), interested parties and their legal, regulatory and other requirements (4.2.1 and 4.2.2), principles (4.2.3), the scope (4.3) and the security management system (4.4).

• Leadership and security policy (Clause 5)

Top management commitment (5.1), establishing the security policy and its requirements (5.2.1 and 5.2.2) and roles, responsibilities and authorities (5.3).

• Planning (Clause 6)

Determining and addressing security-related risks and opportunities (6.1.2 and 6.1.3), establishing and determining security objectives (6.2.1 and 6.2.2) and planning of changes (6.3).

• Risk assessment, treatment and controls (Clauses 8.2 to 8.4)

Identification of processes and activities, risk assessment and treatment, and controls.

• Security strategies and plans (Clauses 8.5 and 8.6)

Selection of strategies and treatments (8.5.1), resource requirements (8.5.2), implementation (8.5.3), and security plans covering the response structure (8.6.2), warning and communication (8.6.3), content (8.6.4) and recovery (8.6.5).

• Evaluation and improvement (Clauses 9 and 10)

Monitoring, measurement, analysis and evaluation (9.1), the internal audit program (9.2.2), management review inputs and results (9.3.2 and 9.3.3), continual improvement (10.1) and nonconformity and corrective action (10.2).

What does it cover?

ISO 28000:2022 specifies requirements for a security management system, including aspects relevant to the supply chain (Clause 1). It applies to all types and sizes of organizations, such as commercial enterprises, government or other public agencies and non-profit organizations, can be used throughout the life of the organization and can be applied to any activity, internal or external, at all levels. The terms in ISO 22300 and in Clause 3 apply; ISO 22300 is the only normative reference (Clause 2).

What are its objectives?

The standard defines a security management system as a system of coordinated policies, processes and practices through which an organization manages its security objectives (Clause 3.5). Its aims, taken from the Introduction, are to:

Assess the security environment, including the supply chain and its dependencies and interdependencies.

Determine whether adequate security measures are in place to manage security-related risks.

Manage compliance with statutory, regulatory and voluntary obligations.

Align security processes and controls, including upstream and downstream supply chain controls, with the organization's objectives.

Maintain and improve the system through the Plan-Do-Check-Act model, with conformity verified by audit where the organization wants it.

Framework in Context

ISO 28000:2022 is the second edition. It cancels and replaces ISO 28000:2007, technically revised but maintaining the existing requirements so that organizations using the previous edition have continuity, and the Foreword lists two main changes: principles added to Clause 4 for better coordination with ISO 31000, and recommendations added to Clause 8 for consistency with ISO 22301, covering security strategies, procedures, processes and treatments and security plans. ISO/TC 292 prepared it. Amendment 1:2024, published February 23, 2024, adds ISO's climate change statements to Clauses 4.1 and 4.2.

Common Framework Mappings

Organizations map ISO 28000:2022 to the other ISO 28000-series standards listed below and to the information security and cybersecurity frameworks they run alongside it, so that one set of evidence serves several audits.

Mapped frameworks include:

ISO 28001

ISO 28002

ISO 28003

ISO 28004

ISO 28005

ISO/IEC 27001

ISO/IEC 27017

NIST Cybersecurity Framework

NIST SP 800-53