Iso 28000

INTERNATIONAL STANDARD

ISO 28000
First edition 2007-09-15

Specification for security management systems for the supply chain
Spécifications pour les systèmes de management de la sûreté pour la chaîne d'approvisionnement

Reference number ISO 28000:2007(E)

© ISO 2007

ISO 28000:2007(E)

PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe'slicensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe SystemsIncorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address givenbelow.

COPYRIGHT PROTECTED DOCUMENT
© ISO 2007 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body in the country of the requester. ISO copyright office Casepostale 56 • CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyright@iso.org Web www.iso.org Published in Switzerland

ii

© ISO 2007 – All rights reserved

ISO 28000:2007(E)

Contents

Page

Foreword............................................................................................................................................................ ivIntroduction ........................................................................................................................................................ v 1 2 3 4 4.1 4.2 4.3 4.4 4.5 4.6 Scope ..................................................................................................................................................... 1 Normative references........................................................................................................................... 1 Terms and definitions........................................................................................................................... 1 Security management system elements ............................................................................................ 3 Generalrequirements........................................................................................................................... 3 Security management policy ............................................................................................................... 4 Security risk assessment and planning ............................................................................................. 4Implementation and operation ............................................................................................................ 7 Checking and corrective action ........................................................................................................ 10 Management review and continual improvement ........................................................................... 12Annex A (informative) Correspondence between ISO 28000:2007, ISO 14001:2004 and ISO 9001:2000...................................................................................................................................... 13 Bibliography ..................................................................................................................................................... 16...