ISO 28000 Certification for Security Management Systems
ISO 28000 certification shows shippers, insurers, customs authorities, and government buyers that you manage security risk in a structured way. It covers your sites and your supply chain. Your system is audited against ISO 28000:2022 with senior-led audits and fixed-fee quotes. Most organizations certify in 6–12 weeks.
What Is ISO 28000 Certification?
ISO 28000 certification is independent confirmation that your security management system meets ISO 28000:2022. An auditor checks how you identify security threats to people, assets, cargo, facilities, and information. They also check how you reduce those threats and respond when something goes wrong. If you meet the standard, you receive a certificate valid for three years.
The standard was written for supply chain security, and logistics, ports, and exporters still use it most. Since the 2022 edition, any organization can use it to run security in a structured, auditable way.
The audit looks at your system on site, including the controls you rely on from suppliers and service providers. Ports, warehouses, and carriers are all in view. You get findings you can act on, not just a certificate.
ISO 28000:2022: What Changed From the 2007 Edition
ISO 28000:2022 is the only edition you can certify to. It was published in March 2022 and replaced ISO 28000:2007, which is now withdrawn. Its full title is Security and resilience — Security management systems — Requirements.
The scope widened. The 2007 edition was framed around the supply chain. The 2022 edition applies to any type and size of organization that wants a security management system, while still covering supply chain aspects. It also uses the same harmonized structure as ISO 9001, ISO 27001, and ISO 22301, so integrated audits are simpler.
A 2024 amendment added climate change. Like other ISO management system standards, ISO 28000 now asks whether climate change is a relevant issue for your organization.
Source: ISO 28000:2022 (ISO)
Who Needs ISO 28000 Certification?
Organizations whose customers, insurers, or regulators need proof that security is managed, not improvised.
Freight forwarders, warehouses, and hauliers moving high-value or bonded goods. See ISO certification for logistics.
Container terminals, airports, and cargo handlers with access and cargo security risks.
Companies shipping internationally that face customs and buyer security checks.
Guarding, cash-in-transit, and secure transport companies.
Suppliers handling sensitive goods or working on secure sites. See ISO certification for defence.
Energy, water, and telecom operators protecting sites and supply.
ISO 28000 Certification Requirements, Clause by Clause
ISO 28000:2022 follows the harmonized structure. This is what each clause asks for, and what the auditor will look at.
| Clause | What it requires | What the auditor looks at |
|---|---|---|
| 4. Context | Security-related issues, interested parties, and the system's scope | A scope that covers the sites, activities, and supply chain links that matter |
| 5. Leadership | A security policy and clear roles | Management involvement, and named owners for security |
| 6. Planning | Risks and opportunities, and security objectives | Objectives that are measured and tied to real threats |
| 7. Support | Resources, competence, awareness, communication, documented information | Training, vetting, and controlled security procedures |
| 8. Operation | Security risk assessment and treatment, controls, security plans, and incident response | Access control, cargo handling, seals, partner checks, and drills |
| 9. Performance | Monitoring, internal audit, and management review | Incident trends and audit results acted on |
| 10. Improvement | Nonconformity, corrective action, and continual improvement | Root causes found and fixes that held |
ISO 28000 vs ISO 28001, CTPAT, AEO, ISO 27001, and ISO 22301
ISO 28000 overlaps with several programs. This is how they relate, and which one proves what.
| Program | What it is | How it relates to ISO 28000 |
|---|---|---|
| ISO 28001 | Best practice for supply chain security assessments and plans | Guidance you can use inside an ISO 28000 system; not certified on its own here |
| CTPAT and AEO | Customs trusted-trader programs | Granted by customs authorities; ISO 28000 evidence supports your application |
| ISO 27001 | Information security management | Covers data and IT; ISO 28000 covers physical, people, and cargo security too |
| ISO 22301 | Business continuity management | Keeps you running after disruption; ISO 28000 works to prevent security incidents |
| ISO 9001 | Quality management | Same structure, so both can be audited together |
How ISO 28000 Certification Works
Six stages from first call to a certificate valid for three years. Our ISO certification process guide has more detail.
Facing a customer, insurer, or customs deadline? Tell us in the scoping review and we will plan audit dates around it.
Book a free scoping reviewCommon ISO 28000 Audit Findings
The gaps that most often hold up certification, so you can check them first.
System findings
- A security risk assessment done once and never updated
- Scope that leaves out a site or a key subcontractor
- Security objectives with no measures behind them
- Incidents logged, but no root cause analysis
- No management review of security performance
Site findings
- Visitor and contractor access not recorded
- Seal numbers not verified at dispatch or receipt
- Key and access card control not reconciled
- Business partner security checks overdue
- Emergency and security drills not tested
ISO 28000 Certification Cost and Timeline
There is no list price. The cost follows the audit man-days your scope needs, and you get a fixed fee in a tailored proposal.
What sets the audit man-days
- People: total headcount within the scope
- Sites: offices, warehouses, terminals, and depots
- Risk: high-value, hazardous, or sensitive goods
- Supply chain: activities and partners in scope
- Integration: combined with ISO 9001, 27001, or 22301
How long it takes
| Proposal | Days after scoping |
|---|---|
| To certificate | Usually 6–12 weeks |
| Surveillance | Once a year |
| Recertification | Before the end of year three |
How to Choose an ISO 28000 Certification Body
The questions worth asking before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Who issues our certificate? | Your proposal names the certification body, before you commit. |
| Do you audit to the 2022 edition? | Yes. ISO 28000:2022 is now the only edition used for audits. |
| Will you visit our sites? | Yes. Sites are sampled in line with IAF multi-site rules, and the central function is audited every time. |
| Can you combine standards? | Yes. ISO 28000 can be audited together with ISO 9001, 27001, and 22301. |
| Will you also write our procedures? | No. We do not consult, so every audit stays impartial. |
| How is it priced? | A fixed fee, set by audit man-days, in a tailored proposal after a free scoping review. |
Frequently Asked Questions About ISO 28000 Certification
Straight answers on the 2022 edition, scope, CTPAT and AEO, cost, and timeline.
What is ISO 28000 certification?
ISO 28000 certification is independent confirmation that your security management system meets ISO 28000:2022. A certification body audits how you assess security risks to people, assets, cargo, facilities and information. That includes risks in your supply chain, and how you control them.
What is the latest version of ISO 28000?
ISO 28000:2022, published in March 2022, is the current edition. It replaced ISO 28000:2007. A 2024 amendment added climate change considerations, in line with ISO's update across its management system standards.
Is ISO 28000 only for supply chain companies?
No. The 2022 edition applies to any organization that wants a security management system, of any type and size. It still covers supply chain aspects, which is why logistics, ports and exporters use it most.
What is the difference between ISO 28000 and ISO 28001?
ISO 28000 sets the requirements for a certifiable security management system. ISO 28001 gives best practice for supply chain security assessments and plans, and is often used with customs trusted-trader programs.
Does ISO 28000 help with CTPAT or AEO?
Yes. Both programs expect documented security risk assessment, physical and procedural controls, and business partner checks. An ISO 28000 system gives you much of that evidence, although CTPAT and AEO status are granted only by customs authorities.
How is ISO 28000 different from ISO 27001?
ISO 27001 covers information security. ISO 28000 covers security more broadly, including physical security, cargo, people, facilities and supply chain partners. Many organizations certify to both and run them as one integrated system.
Who needs ISO 28000 certification?
Freight forwarders, 3PL and warehousing providers, ports and terminals, exporters of high-value goods, security service providers, and critical infrastructure operators. It is often requested by shippers, insurers and government buyers.
How long does ISO 28000 certification take?
Most organizations with a working security program certify in 6 to 12 weeks from Stage 1 to the certificate. More sites, a wider supply chain scope, or a new system take longer.
How much does ISO 28000 certification cost?
The cost follows the audit man-days your scope needs. Headcount, number of sites, security risk level and the activities in scope all set the man-days. A free scoping review gives you a tailored, fixed-fee proposal.
How long is an ISO 28000 certificate valid?
Three years. Surveillance audits take place each year, and a recertification audit comes before the certificate expires.
Can ISO 28000 cover several sites?
Yes. Sites that run the same security management system can share one multi-site certificate. The certification body audits a sample of sites, set in line with IAF audit-time rules, and the central function every time.
What documents does ISO 28000 require?
Expect a security policy, security objectives, a risk assessment and treatment record, and security plans and procedures. You also need records of training, monitoring, incidents, internal audit and management review.
Can ISO 28000 be combined with ISO 9001 or ISO 22301?
Yes. ISO 28000:2022 uses the same harmonized structure as ISO 9001, ISO 27001 and ISO 22301, so they can be audited together in one integrated audit.
Does Accredify Global help us write our security procedures?
No. Certification must stay impartial, so neither we nor the certification body can design or write your system. We can explain the standard and the audit process.
Show Your Customers Security Is Managed, Not Improvised
Tell us about your sites, activities, and deadlines. We'll confirm your ISO 28000 certification scope and send a fixed-fee proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.