Key Facts
- Regulator
- ISO/TC 292 Security and resilience (published by the International Organization for Standardization, ISO)
- Latest version
- ISO 28000:2022, Edition 2, with Amendment 1:2024 (Climate action changes)
- Effective
- 15 March 2022
- Official text
- www.iso.org ↗
What is ISO 28000?
ISO 28000 is the international standard for a security management system, including aspects relevant to the supply chain. ISO publishes it through technical committee ISO/TC 292 Security and resilience. It applies to organisations of any type and size that want to establish, implement, maintain and improve such a system, in any industry or sector.
The current version is ISO 28000:2022, Security and resilience — Security management systems — Requirements. It is the second edition, published in March 2022, and it is a short document of 20 pages. ISO also lists one amendment, ISO 28000:2022/Amd 1:2024, "Climate action changes", as published.
The 2022 edition replaced ISO 28000:2007, which ISO now lists as withdrawn.
Searches for ISO 28000 supply chain security tend to expect a supply chain checklist. The standard is something wider: supply chain aspects sit inside a security management system, not in a standalone list of controls.
A security management system is a system. A folder of site procedures isn't one.
The full text is paywalled, and ISO's public page does not show the clause structure. This entry describes the standard at the level of the public abstract and does not reproduce its text. The official page is on iso.org.
Why it matters
The tender asks which security management standard you hold. You have site procedures, a few supplier clauses and no single system that ties them together. ISO 28000 gives that system a recognised name and a defined scope.
Three things make it worth knowing:
- It is not sector specific. ISO describes the standard as holistic and common, so a buyer in any industry can name it in a tender or supplier questionnaire.
- Edition control. The 2022 edition replaced the 2007 edition, so any contractual reference should name ISO 28000:2022, and ideally its 2024 amendment.
- The word "certification". Buyers often ask for ISO 28000 certification, but they may mean a certificate or documented conformity. Ask which evidence they accept before you commit to a route.
A requirement written into a customer contract is a commercial fact. A line in a questionnaire may be only a question.
Who it applies to
ISO 28000 applies to all types and sizes of organisation that want to establish, implement, maintain and improve a security management system. ISO states that it is not industry or sector specific. A logistics operator, a manufacturer and a software supplier fall within the same scope wording.
It is a standard, not a law. ISO's page does not make it mandatory for anyone, and we have not found a UK or EU statute that requires it. Treat it as voluntary unless a customer contract or tender says otherwise. Where it is required, the requirement comes from that document, not from the standard itself.
ISO 27001 is the information security management system standard, while ISO 28000 specifies a security management system with supply chain aspects. Holding one does not by itself show conformity to the other.
The UK position
We have not found a UK statute or regulator that names ISO 28000. A UK firm usually meets it commercially: a customer, a tender or a supplier review names the standard and asks whether you hold it or work to it.
That makes the contract wording the thing to read. Check which edition is cited and whether the request covers your whole organisation or one site or service.
BSI, the UK national standards body, publishes it as BS ISO 28000:2022, identical to the ISO text.
Key requirements
ISO 28000:2022 specifies requirements for a security management system. ISO's public abstract gives the shape of those requirements, not the clause wording. What it does establish:
- A management system, not a one-off project. The requirements are for a system that an organisation establishes, implements, maintains and improves.
- Supply chain aspects are included. The scope names aspects relevant to the supply chain. They sit within the system rather than replacing it.
- A common approach. The standard is holistic and not tied to any industry or sector, so the organisation decides what security means for its own activities.
- Whole-life use. The standard can be used throughout the life of the organisation.
- Reach across activities. It can be applied to any activity, internal or external, at all levels.
A standard written for every sector can't tell you what your threats are. That judgement stays with you.
Frequently asked questions
ISO 28000:2022, the second edition, is current, together with Amendment 1:2024, "Climate action changes", published in February 2024. ISO shows the 2022 edition as published, with no revision under way. A contract that still cites ISO 28000:2007 is citing a withdrawn edition, so ask for the reference to be updated.
No. ISO 28000 is voluntary, and we have not found a UK or EU statute that requires it. ISO 28000 is written for commercial enterprises, government or other public agencies and non-profit organisations alike, so a public-sector buyer can name it in a tender as readily as a private one. The obligation then sits in that tender or contract.
No. Earlier versions, ISO/PAS 28000:2005 and ISO 28000:2007, were titled Specification for security management systems for the supply chain. The 2022 edition dropped "for the supply chain" from its title: ISO 28000 now specifies a security management system that can cover any activity, with supply chain aspects included as part of it rather than as the whole subject.
ISO does not perform certification or issue certificates; external certification bodies do. ISO 28000:2022 is written as requirements, so a certification body can audit an organisation against it. ISO's page for ISO 28000 describes no scheme of its own, so a customer asking for ISO 28000 certification should say whether it wants a certificate from an accredited body.
ISO 28000 sets requirements for the security management system itself. ISO 28001:2007, from the same committee, gives requirements and guidance for organisations in international supply chains to assess security and plan for their segment of a supply chain. ISO 28001 is also written to help meet authorised economic operator (AEO) criteria under the World Customs Organization Framework of Standards.