ISO 28000

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Cocoa ruto (talk | contribs) at 09:30, 4 December 2019 (Undid revision 924552495 by 2405:205:C8CA:3674:0:0:237A:20A0 (talk)). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

ISO 28000:2007 (Specification for security management systems for the supply chain) is an ISO standard published by International Organization for Standardization which includes requirements of a security management system particularly dealing with security assurance in the supply chain[1]. The standard was developed by ISO/TC 8 on "Ships and maritime technology" and published in 2007 [2]. In 2015 the responsibility for the ISO 28000 series was transferred to ISO/TC 292 on "Security and resilience" who in 2019 decided to start a revision which is expected to take 3 years. A justification study for the revision has already been accepted by ISO TMB (Technical Management Board).[3]

Scope

ISO 28000:2007 was developed to codify operations of security within the broader supply chain management system. The PDCA management systems structure was adopted in developing ISO 28000:2007 to bring the elements of this standard in congruence with related standards such as ISO 9001:2000 and ISO 14001:2004.[4][5]

The scope of the revised document will be changed only in so far as its new wording will be in conformity to today's way of writing standards: "[The standard] specifies requirements for a security management system, including those aspects crucial to security assurance of the supply chain"[6]

History

ISO 28000 was first developed as a Publicly Available Specification and published in 2005 [7]. In 2007, ISO/PAS 28000:2005 was withdrawn and replaced by a full ISO standard under the title ISO 28000:2007. In 2014, ISO 28000:2007 was reviewed and confirmed. [8]

Improved risk management integration

The development of an international standard addressing security risk management improves the broader interface with existing enterprise risk management in a common integrated platform. This integrated approach to risk management is often employed to better coordinate cross functional risk management mechanisms, improve performance measurement, ensure continual improvement and reducing misalignment of risk management objectives between silos.[9]

Application

ISO 28000:2007 was developed such that organizations of varying scale could apply the standard to supply chains of various degrees of complexity.

The general rational for organizations to adopt ISO 28000:2007 pertains to:

  • developing a security management system,
  • internal compliance with objectives of a security management policy,
  • external compliance with best practice benchmarks,
  • ISO accreditation.

Benefits

Adopting the ISO 28000 has broad strategic, organisational and operational benefits that are realized throughout supply chains and business practices.[10]

Benefits include, but are not limited to:

  • Integrated enterprise resilience
  • Systematised management practices
  • Enhanced credibility and brand recognition
  • Aligned terminology and conceptual usage
  • Improved supply chain performance
  • Benchmarking against internationally recognisable criteria
  • Greater compliance processes

The revision

ISO/TC 292 has established a Working Group on Supply chain security (WG 8) to review and update the standard. ISO 28000 will be restructured to align it with other Management System Standards of ISO in accordance with Annex SL (to support the integration of the security management system of an organization with its other management systems (e.g. quality management, energy management, environmental management, information security management, business continuity management, ...)).[11]

It is not planned to delete any of the requirements in the existing standard nor is it planned to add new requirements so that organizations certified in accordance with ISO 28000 will not encounter any difficulties due to the revision. The countries with the highest number of certificates in 2016 were India (425), Japan (299), Spain (231), US (223) and UK (197).[12]

Experts interested to support the revision should inquire with their national standardization organization how to join ISO/TC 292 WG 8. A list of the participating member organizations is provided by ISO.[13]

Accreditation

ISO 28000:2007 is a certifiable standard.[14]

Supporting standards

ISO 28000 is the first of a series of ISO standards including[15]

  • ISO 28001:2007 Security management systems for the supply chain – Best practices for implementing supply chain security, assessments and plans – Requirements and guidance
  • ISO 28002:2011 Security management systems for the supply chain – Development of resilience in the supply chain – Requirements with guidance for use
  • ISO 28003:2007 Security management systems for the supply chain – Requirements for bodies providing audit and certification of supply chain security management systems
  • ISO 28004-1:2007 Security management systems for the supply chain – Guidelines for the implementation of ISO 28000 Part 1: General principles
  • ISO 28004-2:2014 Security management systems for the supply chain - Guidelines for the implementation of ISO 28000 - Part 2: Guidelines for adopting ISO 28000 for use in medium and small seaport operations[16]
  • ISO 28004-3:2014 Security management systems for the supply chain – Guidelines for the implementation of ISO 28000 Part 3: Additional specific guidance for adopting ISO 28000 for use by medium and small businesses (other than marine ports)
  • ISO 28004-4:2014 Security management systems for the supply chain – Guidelines for the implementation of ISO 28000 Part 4: Additional specific guidance on implementing ISO 28000 if compliance with ISO 28001 is a management objective

See also

References

  1. ^ https://www.iso.org/standard/44641.html
  2. ^ https://www.iso.org/committee/45776.html
  3. ^ http://isotc292online.org/news-archive/the-revision-of-iso-28000-will-begin-in-september-in-bangkok/
  4. ^ ISO 28004: 2007 Guidelines for implementation of ISO 28000
  5. ^ Siegal, M. Standards Changing the World of Security Professionals. ASIS International: Virtual Seminar. 2008
  6. ^ isotc292online.org/news-archive/the-revision-of-iso-28000-will-begin-in-september-in-bangkok/
  7. ^ ISO/PAS 28000:2005
  8. ^ ISO, ISO 28000:2007 Specification for security management systems for the supply chain
  9. ^ Integrated Risk Management
  10. ^ Building SRM into Business Practice
  11. ^ https://iso.org/management-system-standards.html
  12. ^ http://isotc292online.org/news-archive/the-revision-of-iso-28000-will-begin-in-september-in-bangkok/
  13. ^ https://iso.org/committee/5259148.html?view=participation
  14. ^ ISO 28000: 2007 Specifications for security risk management systems for the supply chain http://www.iso.org/iso/iso_catalogue/catalogue_ics/catalogue_detail_ics.htm?csnumber=44641
  15. ^ https://www.sriregistrar.com/standards/iso-28000/
  16. ^ https://www.iso.org/standard/60905.html
Retrieved from "https://en.wikipedia.org/w/index.php?title=ISO_28000&oldid=929208076"