ΕΛ Certification cost

All readiness checks

Readiness for ISO 28000 — Supply Chain Security

Assess how close your business is to the requirements of ISO 28000:2022.

22 questions · ~6 min

Anonymous: we don't ask for a name, email or company details. Only the answers are kept, with nothing that identifies you, for statistics.

How to answer

Choose “Yes” only when the requirement is applied in practice and there is documentation or records. “Partly” means it is done informally or not everywhere.

4 Context of the organization

4.1 Have you recorded the internal and external issues (e.g. market, competition, technology, legislation) that affect your security management system?

4.2 Have you identified the interested parties (customers, employees, authorities, suppliers, etc.) and their requirements?

4.3–4.4 Has the scope of your security management system been defined in writing (activities, sites, any exclusions), and have the main processes been mapped?

5 Leadership

5.1 Is top management actively involved in the security management system, providing resources and building it into business decisions?

5.2 Is there an approved security management policy that suits the business, has been communicated to staff and is available to those who need it?

5.3 Have roles, responsibilities and authorities for the system been defined and communicated?

6 Planning

6.1 Have you assessed the risks and opportunities related to your security management system and planned actions to address them?

6.1 Have you assessed security threats across the whole supply chain (theft, smuggling, cargo tampering, cyber attacks)?

6.2 Are there measurable security objectives with owners, resources, a timeline and a way of monitoring them?

7 Support

7.1–7.2 Have you defined the competence required for each relevant role, and do you keep records of training, experience or qualifications?

7.3–7.4 Are staff aware of the security management policy and of their contribution to the system, and is there a defined way of communicating internally and externally?

7.5 Are the system's documents and records controlled (approval, versions, distribution, storage, retention)?

8 Operation

8 Are physical security measures applied at your premises (fencing, access control, CCTV) and for cargo security (seals, integrity checks)?

8 Are the security requirements of supply chain partners (carriers, warehouses, agents) controlled through contracts and assessments?

8 Is supply chain information protected (bills of lading, routes, customs data)?

8 Are staff in sensitive roles screened and given security training?

8 Are there security incident response and recovery plans that are tested with exercises?

9 Performance evaluation

9.1 Do you monitor, measure and analyse indicators of supply chain security and evaluate the results?

9.2 Is there an internal audit programme, and has at least one full internal audit of the system been completed by a competent person?

9.3 Has a management review of the system been held and recorded, with decisions and actions?

10 Improvement

10 Are nonconformities recorded, their causes analysed, and corrective actions taken and checked for effectiveness?

10 Are there documented examples of continual improvement of the system?

Answered 0 of 22