ISO 28000 guides: Overview · Requirements · Cost · How to get certified
Last updated: 10 July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao)
ISO 28000 certification cost follows your operational footprint — sites, fleet, chains in scope and how much security infrastructure already exists — and for Philippine logistics operators it competes with two quiet offsets: insurance conversations and AEO benefits.
What drives the number
Up: multiple yards and warehouses, subcontracted carrier networks needing contractual and verification work, thin existing security procedures, and 24/7 operations that complicate assessment logistics. Down: single-site operations, existing CCTV/access-control/vetting practice, an AEO application already in motion (the overlap does double duty), and disciplined incident records.
Cost components
Security risk and gap assessment across the chain · control development (procedures, partner requirements, seal and transit protocols) · training and drills · internal audit · certification body fees per audit-day, scaled to sites and scope · optional physical upgrades only where the risk assessment justifies them — the standard requires proportionate control, not a fortress.
The offsets worth pricing
Cargo crime losses and pilferage shrinkage drop where certified controls operate; insurers increasingly recognize audited security management in premium discussions; AEO status — substantiated by the same controls — buys customs facilitation; and 3PL bids to multinationals score demonstrated chain security. Price those against the project before calling it a cost.
How ISO 28000 pricing works in the Philippine market
Understanding how ISO 28000 pricing actually works in the Philippine market saves companies more money than any discount ever will. Consulting proposals worth taking seriously itemize four things: the assessment and implementation work, the training component, the internal audit, and — separately, because it is billed separately — the certification body’s audit fees, which are quoted per assessor-day and rise with headcount, sites and scope complexity. Supply chain security prices by sites, fleet and partner networks — subcontracted carriers add verification work that owned assets do not. When a quotation arrives as a single mysterious number with no gap assessment behind it, you are looking at a template price for a template system, and template systems are exactly what fail Stage 2 audits and get expensively rebuilt. The cheapest credible path is unglamorous: assess first, scope tightly around what your customers actually demand, and do more of the routine work internally with our coaching rather than outsourcing every keystroke.
Where companies overspend — and underspend
Where companies overspend on ISO 28000 is rarely where they fear: it is almost never the certification body, and almost always over-engineered implementation — hundred-page manuals nobody reads, consultants embedded for months doing work your coordinator could own after one training course, and controls implemented wall-to-wall instead of scoped to risk. Where they underspend is subtler and costlier: skipping the pre-certification internal audit to save a week, then paying for it at Stage 2 with findings, delays and repeat audit fees; or choosing an unaccredited certificate mill whose paper fails the first tender verification, converting the entire spend to zero. Right-sizing in both directions is precisely what a gap assessment is for — and why we refuse to quote without one. Request yours and the numbers become yours instead of a brochure’s.
Questions to ask before signing any ISO 28000 proposal
Put every ISO 28000 proposal through the same six questions and the market sorts itself quickly. Is a gap assessment included before the fixed price commits — and if not, what is the price actually based on? Are certification body fees inside or outside the figure, and has the proposer named which accredited bodies they would shortlist for your scope? How many on-site consultant-days, in which phases, delivered by whom by name? Where does documentation authorship sit — because ‘we write everything’ produces systems your team cannot defend in interviews, and ‘you write everything’ produces projects that stall in month two? Is a pre-certification internal audit in scope, with findings closure before the external body arrives? And what exactly happens — contractually — if the certification audit still raises major findings? Providers comfortable answering all six in writing are worth comparing on price; providers who deflect any of them are telling you where the project would eventually hurt. Our proposals answer them by default, because these are the questions we would ask.
The practical next step
Everything on this page converges on the same practical truth about ISO 28000 certification in the Philippines: the distance between where you stand and where you need to be is measurable, and measuring it is cheap. A one-week gap assessment produces the honest map — what exists, what’s missing, what it costs, how long it takes — and converts every generalization above into your organization’s specific numbers. From there the work is scheduling rather than speculation. Call +63 977 815 1204, email info@iso-philippines.com, or request the assessment online — free initial consultation, and every engagement scoped in writing before a peso is committed.
Talk to a Sterling consultant, not a call centre: our lead auditors Mark Santos (Metro Manila), Zia Bautista (Cebu) and Ann Reyes (Davao) deliver every project on-site across the Philippines. Book a free consultation →
ISO 28000 cost — quick answers
Is ISO 28000 expensive compared to ISO 9001?
Broadly comparable for the same operation — the security risk assessment replaces 9001’s process mapping as the heavy lift. Costs diverge upward only when physical security genuinely needs building, which the risk assessment decides, not the standard.
Do we need new security equipment to certify?
Only what your risks justify. Auditors verify proportionate control — documented procedures, working seals discipline, vetted people — before hardware. Buying cameras to impress an auditor is exactly backwards; let the risk assessment write the shopping list, if any.
Does pursuing AEO at the same time save money?
Substantially — the security criteria overlap so heavily that one project produces both evidence sets. Sequence them together: gap-assess once against both frameworks, build once, then face Customs and the certification body with the same controls.
What does maintaining certification cost?
Annual surveillance audit-days plus the internal discipline of drills, partner verification and incident reviews — modest against initial certification, and the parts that cost money are the parts cutting your losses anyway.
Start with certainty: a one-week gap assessment tells you the true distance, cost and timeline — request yours.