标准简介
ISO 28000:2022 是安全与韧性——安全管理体系的国际标准，为组织建立、实施、维护和持续改进供应链安全管理体系提供了要求框架。2022 年第二版取代了 2007 年的第一版，采用了 ISO 高级结构（HLS），与 ISO 9001、ISO 14001、ISO 27001 等管理体系标准保持一致。该标准适用于供应链中的所有组织，包括制造商、物流服务提供商、仓储运营商、零售商和贸易公司。
ISO 28000:2022 要求组织识别和评估供应链安全威胁和风险，建立安全管理目标和计划，实施安全控制措施，监控和评审安全绩效，并持续改进安全管理体系。标准涵盖的安全领域包括物理安全、人员安全、信息安全、货物安全、运输安全和危机管理。该标准与世界海关组织（WCO）的经认证经营者（AEO）计划、美国海关和边境保护局（CBP）的 C-TPAT 计划以及欧盟的 AEO 计划等国际贸易安全倡议密切相关。获得 ISO 28000 认证可以支持 AEO 资质申请，简化海关手续，增强供应链伙伴的信任。在全球供应链面临日益复杂威胁的背景下，ISO 28000 的重要性持续增加。
Supply Chain Security
Provides a comprehensive framework for managing security threats across the entire supply chain, from procurement through manufacturing to final delivery and distribution.
HLS Aligned
The 2022 revision adopts the ISO Harmonized Structure (HLS), enabling seamless integration with ISO 9001, ISO 14001, ISO 27001, and other management system standards.
Multi-Threat Coverage
Addresses modern security threats including cyber attacks, terrorism, organized crime, natural disasters, pandemics, and geopolitical instability affecting supply chains.
list_alt Security Management Elements
- Security threat and risk assessment
- Security management policy and objectives
- Organizational context and interested parties
- Leadership commitment and security roles
- Operational planning and control
- Supply chain partner security requirements
- Incident management and business continuity
- Performance evaluation and continual improvement
Who Needs to Comply?
Organizations involved in supply chain management — manufacturers, logistics providers, freight forwarders, port operators, warehousing companies, and any organization seeking to protect its supply chain from security threats.
Key Requirements
Security Threat Assessment
Identify, analyze, and evaluate security threats and vulnerabilities across the supply chain. Consider physical, cyber, personnel, and information security risks relevant to the organization's operations.
Security Management Plan
Develop and implement security management plans that address identified threats, define response procedures, assign responsibilities, and establish communication protocols for security incidents.
Supply Chain Partner Management
Establish security requirements for supply chain partners, contractors, and service providers. Verify partner compliance and maintain oversight of outsourced security-relevant activities.
Incident Response and Recovery
Establish procedures for detecting, reporting, and responding to security incidents. Implement business continuity plans to minimize disruption and recover from security events.
Penalties & Enforcement
No direct legal penalties — ISO 28000 is a voluntary standard. However, certification can be required by customs authorities for trusted trader programs (e.g., C-TPAT, AEO) and by business partners in high-security supply chains. Loss of certification may affect trade facilitation benefits.