ISO/PAS 28000:2007 (Specification for security management systems for the supply chain) is an International Organization for Standardization publicly available specification on requirements of a security management system particularly dealing with security assurance in the supply chain.
Scope
ISO 28000:2007 was developed to codify operations of security within the broader supply chain management system. The PDCA management systems structure was adopted in developing ISO 28000:2007 to bring the elements of this standard in congruence with related standards such as ISO 9001:2000 and ISO 14001:2004.
Application
ISO 28000:2007 was developed such that organizations of varying scale could apply the standard to supply chains of various degrees of complexity.
The general rational for organizations to adopt ISO 28000:2007 pertains to:
- developing a security management system,
- internal compliance with objectives of a security management policy,
- external compliance with best practice benchmarks,
- ISO accreditation.