How to Get ISO 28000 Certified — Step by Step

ISO 28000 guides: Overview · Requirements · Cost · How to get certified

Last updated: 10 July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao)

Philippine logistics operators typically reach ISO 28000:2022 certification in three to five months — faster where physical security practice already exists and the project formalizes rather than builds.

The 7 steps

1. Scope the chains. Which services, sites, routes and partner networks the certificate covers — scope discipline controls both cost and audit-days.
2. Security risk assessment. Threats across cargo, facilities, people, information and partners, assessed and prioritized — the document every later control traces back to.
3. Build the controls. Facility and access procedures, personnel vetting, seal and transit integrity, information security for shipment data, contractual security requirements for subcontractors.
4. Train and drill. Security-relevant roles trained; incident response exercised, not just written — auditors read drill reports before they read policies.
5. Operate and record. Two to three months of living records: inspections done, seals reconciled, incidents and near-misses handled.
6. Internal audit and management review. Close your own gaps before the certification body finds them.
7. Certification audit. Stage 1 readiness, Stage 2 effectiveness — expect auditors at the yard gate and in the seal log, not just the meeting room.

What auditors probe hardest

The subcontracted carrier problem — how you verify partners you don’t own · seal discipline in practice · whether the risk assessment matches the operation they are walking through · incident and drill records with follow-through.

What the project feels like, week by week

The realistic path through ISO 28000 certification in the Philippines has a rhythm every successful Philippine project shares. Early: honest diagnosis, and the important decision of who internally owns the system — a named coordinator with authority, not a committee. Middle: implementation sprints where our consultants bring structure and your people bring truth, because security projects must survive the yard, not the meeting room — drills, seals and partner verification carry the evidence. Late: evidence accumulates, the internal audit stress-tests everything, and audit week arrives with no surprises left in the building. Two accelerators shorten this arc more than any consultant trick: leadership that treats project milestones as commitments rather than suggestions, and existing records discipline — companies that already write things down move roughly a month faster than companies learning to.

The failure patterns — and the vaccine

A word on what certification day does and does not change. The certificate unlocks the commercial doors — tenders, vendor accreditations, client audits shortened to a document check. What it does not do is run the system: surveillance audits arrive annually, records must keep accumulating, and the internal audit programme is now yours to operate. Companies that treat certification as a finish line drift into year-two findings and the quiet embarrassment of suspension; companies that treat it as an operating license simply keep doing what the project taught them, at a fraction of the original effort. We build for the second outcome — training your internal auditor, not renting ours forever — and stay available for the maintenance support that keeps surveillance boring. Plan the whole cycle, not just the sprint.

After the certificate: the first-year operating rhythm

Certification day changes the project into a rhythm, and the first year sets whether that rhythm sustains or decays. The pattern that works across every ISO 28000 client we support: quarterly pulse — objectives reviewed against data, corrective actions checked for closure, one slice of the internal audit programme executed rather than saved for a year-end binge. Mid-year — management review with decisions and minutes, not a slideshow; refresher training where staff turnover has diluted awareness. Two months before surveillance — a focused internal review of exactly what the certification body sampled last time plus whatever changed since. The organizations that run this rhythm experience surveillance as a half-day formality; the ones that don’t rediscover the whole project every autumn. Budget roughly a tenth of the original implementation effort per year to keep the system alive — and reclaim multiples of that in avoided findings, faster audits and a credential that never wobbles during a bid.

The practical next step

Everything on this page converges on the same practical truth about ISO 28000 certification in the Philippines: the distance between where you stand and where you need to be is measurable, and measuring it is cheap. A one-week gap assessment produces the honest map — what exists, what’s missing, what it costs, how long it takes — and converts every generalization above into your organization’s specific numbers. From there the work is scheduling rather than speculation. Call +63 977 815 1204, email info@iso-philippines.com, or request the assessment online — free initial consultation, and every engagement scoped in writing before a peso is committed.

Prefer a conversation to a contact form?

Every enquiry about ISO 28000 certification in the Philippines reaches a consultant, not a queue: call +63 977 815 1204 during Philippine business hours, or email info@iso-philippines.com with your current situation and, if you have one, the client requirement or tender clause driving the question — the more specific the input, the more useful the first reply. Initial consultations are free, proposals follow written gap assessments only, and nothing gets quoted sight-unseen.

Start with certainty: a one-week gap assessment tells you the true distance, cost and timeline — request yours.