Requirements of ISO 28000 Certification

ISO 28000 guides: Overview · Requirements · Cost · How to get certified

Last updated: 10 July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao)

ISO 28000:2022 requires a security management system built on a supply-chain-wide risk assessment — protecting cargo, facilities, information and people from origin to delivery, on the same harmonized clause 4–10 structure as ISO 9001 and 27001.

The security-specific requirements

Security risk assessment across the chain: theft and pilferage, tampering and smuggling exposure, personnel risks, information and tracking-system vulnerabilities, and disruption scenarios — assessed for likelihood and consequence, and kept current. Security objectives and controls proportionate to those risks: physical security of yards and warehouses, personnel vetting and access control, seal and transit integrity procedures, information security for shipment data. Incident preparedness and response: plans, drills and investigation for security events. Interested parties and partners: control over contractors, subcontracted carriers and upstream/downstream links whose failures become your incident.

The management-system spine

Context and scope (which chains, sites and services); leadership and a security policy; competence and awareness for security-relevant roles; documented information; performance evaluation with internal audit; management review; and improvement driven by incidents, drills and audit findings.

Documents auditors expect

Security policy and scope · supply chain security risk assessment · control procedures (facilities, personnel, seals and transit, information) · contractor and partner security requirements · incident response plans with drill records · training and vetting records · internal audit and management review records.

How auditors read these requirements in practice

Reading the ISO 28000 requirements as an auditor reads them changes how you implement every one of them. Auditors do not grade documents against clause numbers; they sample reality against your own claims. Security auditors test seal discipline at the yard and control over the subcontracted truckers you do not own. That is why the requirements that look easiest on paper — records, competence evidence, internal audit — produce the most findings in practice: they are where a system reveals whether it lives or was assembled for audit week. When we implement, every requirement is built with its future audit test in mind: what will the assessor ask, whom will they ask, and which record answers before anyone has to improvise. Systems built that way make external audits feel almost scripted — because the questions were anticipated by design.

Implementing without over-engineering

The documentation trap deserves its own warning for anyone approaching ISO 28000 certification in the Philippines. The standard mandates surprisingly few documents; tradition, template vendors and nervous consultants mandate the rest. Every unnecessary document you adopt becomes a permanent liability — it must stay current, consistent and followed, or it becomes audit evidence against you. The discipline that works: document what genuinely steers the work, record what proves the system ran, and resist everything else however official it looks in someone’s sample manual. When auditors encounter a lean, accurate system they read it as maturity; when they encounter binder theatre they start digging, because bloat and fiction usually travel together. Our documentation reviews cut volume as often as they add it — ask for one before your system calcifies.

The requirements nobody budgets time for

Experienced implementers watch three requirement families in ISO 28000 that consume more calendar than their clause length suggests. Competence evidence: proving people are competent — records of training, experience, and evaluated effectiveness — reaches into HR files that most Philippine SMEs have never organized for audit, and backfilling takes weeks. Externally provided processes: suppliers and subcontractors touch your conformity, so evaluation criteria, records and controls must exist for them too — and supplier cooperation moves at supplier speed, not project speed. Management review: not the meeting itself but the inputs — data assembled from monitoring, audits, complaints and objectives — which requires those upstream records to have accumulated first. All three share a dependency on time and third parties, which is why they anchor the project plan’s critical path in our engagements, started early while documentation work proceeds in parallel. Projects that discover them late are the projects that slip a quarter.

Where to go from here

If ISO 28000 certification in the Philippines touches your business this year, the efficient path is conversation before commitment: bring us the client questionnaire, tender clause or compliance letter that raised the question, and we will map it to what your organization actually needs — which is sometimes less than you fear and occasionally more than you hoped, but always specific once assessed. The revision tracker keeps every deadline current, the news page catches developments weekly, and a gap assessment turns any of it into a dated plan. No pressure mechanics, no template quotes — evidence first, always.

Misconceptions worth correcting

Three beliefs about ISO 28000 certification in the Philippines cost Philippine companies real money, and each dissolves under one honest look. The first: that it is a documentation exercise — when every credible assessment samples operating reality, and paper without practice fails precisely when it matters. The second: that smaller organizations face diluted scrutiny — when in truth the requirements scale but the evidence standard never does, and a ten-person firm’s records must be as real as a factory’s. The third: that the cheapest provider and the best value ever coincide by accident — when the market’s persistent bargain, an unaccredited or unimplemented outcome, converts one hundred percent of its price into loss at the first verification. Companies that shed these three beliefs before starting save more than any negotiation afterward recovers.

Start with certainty: a one-week gap assessment tells you the true distance, cost and timeline — request yours.