ISO 28000 Supply Chain Security Management: Beyond C-TPAT
Supply Chain Security · 2026-06-23 · 1 min read · CR Global Assurance Editorial Team
Theft, tampering, smuggling and cyberattacks can all disrupt a supply chain. ISO 28000 gives organisations a certifiable management system to manage security risks end to end.
ISO 28000 specifies requirements for a security management system with a focus on the supply chain. It is relevant to manufacturers, freight forwarders, warehouses, ports and transport companies. Where C-TPAT sets specific security criteria, ISO 28000 provides a management framework that can be certified. CR Global Assurance audits ISO 28000 and supply chain security management (SCSM) systems.
What ISO 28000 requires
- Context and scope — which parts of the supply chain and which security threats are covered.
- Security risk assessment — physical, procedural, personnel and cyber threats.
- Security objectives and plans — controls proportionate to risk.
- Competence and awareness — trained security staff and general staff awareness.
- Emergency preparedness and response — incident response and business continuity.
- Monitoring, internal audit and management review.
ISO 28000 vs C-TPAT
| C-TPAT | ISO 28000 | |
|---|---|---|
| Type | US customs partnership programme | International management system standard |
| Focus | Minimum security criteria for US-bound cargo | Security risk management across the supply chain |
| Outcome | Supplier audit report for importers | Third-party certification |
| Integration | Stand-alone | Integrates with ISO 9001, 14001 and 45001 |
A facility with strong C-TPAT controls already has much of the operational content; ISO 28000 adds the management system around it.
Who benefits most
- Exporters serving multiple markets with different security programmes.
- Logistics providers and warehouses seeking a recognised credential.
- Organisations that have experienced theft, tampering or cargo contamination incidents.
Certification with CR Global
CR Global Assurance — formerly CR Team Ltd — audits ISO 28000 alone or integrated with other ISO standards. Apply now.
Frequently asked questions
Can ISO 28000 replace a C-TPAT audit?
Not automatically. US importers may still require a C-TPAT audit, but an ISO 28000 system makes meeting C-TPAT criteria easier and more consistent.
Who can be certified to ISO 28000?
Any organisation involved in the supply chain, including manufacturers, warehouses, freight forwarders, ports and transport companies.
Does CR Global Assurance audit ISO 28000?
Yes. ISO 28000 supply chain security management auditing is part of CR Global Assurance's security services.