ISO 28000 specifies requirements for a supply chain security management system.
The standard was first published in 2007 as “Specification for security management systems for the supply chain.” Its purpose is to help organizations identify security risks, establish controls, monitor performance, and continually improve their security arrangements across relevant operations and supply-chain activities.
ISO 28000 was revised in 2022 and is now titled “Security and resilience — Security management systems — Requirements.” The newer edition is broader than the original supply-chain focus, but it still explicitly includes security aspects relevant to supply chains. It can apply to organizations of different sizes and sectors, rather than only shipping companies or freight operators.
A common mix-up is ISO 9001, which covers quality management, ISO 14001, which covers environmental management, and ISO 45001, which covers occupational health and safety. ISO 28001 is related, but it provides best practices and guidance for implementing supply-chain security; ISO 28000 is the core requirements standard.