ISO 28000:2022 – Security Management System - Lead Implementation Training

This lesson provides an introduction to ISO 28000:2022 – Security Management Systems, explaining its purpose, scope, key requirements and importance in managing security-related risks. It covers security threats, supply chain security, organisational responsibilities, the PDCA approach, integration with other management systems and the benefits of implementation. Participants will gain an understanding of how organisations can establish and maintain an effective security management system to protect people, assets, infrastructure and supply chain operations.

ISO 28000:2022 – Clause 4: Context of the Organization

This lesson introduces how organizations establish the foundation of a supply chain security management system by understanding their operating environment. It covers identifying internal and external issues, recognizing stakeholder expectations, defining the scope, and establishing the overall structure of the system to support effective security management.

Clauses Covered under Clause 4

Clause 4.1 – Understanding the organization and its context
Clause 4.2 – Understanding the needs and expectations of interested parties
Clause 4.2.1 – General
Clause 4.2.2 – Legal, regulatory and other requirements
Clause 4.2.3 – Principles
Clause 4.3 – Determining the scope of the security management system
Clause 4.4 – Security management system

ISO 28000:2022 – Clause 5: Leadership

This lesson explains the critical role of leadership in establishing and maintaining an effective supply chain security management system. It focuses on top management’s responsibility to demonstrate commitment, establish a security policy, and assign clear roles, responsibilities, and authorities to ensure the system is effectively implemented and aligned with organizational objectives.

Clauses Covered under Clause 5

Clause 5.1 – Leadership and commitment
Clause 5.2 – Security policy
Clause 5.3 – Roles, responsibilities and authorities

ISO 28000:2022 – Clause 6: Planning

This lesson focuses on how organizations plan their supply chain security management system using a risk-based approach. It covers identifying and addressing security risks and opportunities, establishing measurable security objectives, and planning changes to ensure the system remains effective and aligned with evolving threats and business needs.

Clauses Covered under Clause 6

Clause 6.1 – Actions to address risks and opportunities
Clause 6.1.1 – General
Clause 6.1.2 – Determining security-related risks and identifying opportunities
Clause 6.1.3 – Addressing security-related risks and exploiting opportunities
Clause 6.2 – Security objectives and planning to achieve them
Clause 6.2.1 – Establishing security objectives
Clause 6.2.2 – Planning to achieve security objectives
Clause 6.3 – Planning of changes

ISO 28000:2022 – Clause 7: Support

This lesson explains the support elements required to effectively implement and maintain the supply chain security management system. It covers resources, competence, awareness, communication, and control of documented information to ensure that personnel, infrastructure, and information systems support security objectives and operational effectiveness.

Clauses Covered under Clause 7

Clause 7.1 – Resources
Clause 7.2 – Competence
Clause 7.3 – Awareness
Clause 7.4 – Communication
Clause 7.5 – Documented information
Clause 7.5.1 – General
Clause 7.5.2 – Creating and updating
Clause 7.5.3 – Control of documented information

ISO 28000:2022 – Clause 8: Operation

This lesson focuses on the operational implementation of the supply chain security management system. It explains how organizations identify critical processes, establish operational controls, conduct risk assessments at the operational level, implement security measures, and develop security plans to effectively manage and respond to security threats and disruptions.

Clauses Covered under Clause 8

Clause 8.1 – Operational planning and control
Clause 8.2 – Identification of processes and activities
Clause 8.3 – Security risk assessment and treatment
Clause 8.4 – Controls
Clause 8.5 – Security strategies, procedures, processes and treatments
Clause 8.5.1 – Identification and selection of strategies and treatments
Clause 8.6 – Security plans
Clause 8.6.1 – General
Clause 8.6.2 – Requirements for security plans
Clause 8.6.3 – Testing and updating of security plans
Clause 8.6.4 – Content of security plans

ISO 28000:2022 – Clause 9: Performance Evaluation

This lesson explains how organizations evaluate the performance and effectiveness of the supply chain security management system. It covers monitoring and measurement, internal audits, and management review to ensure that security controls are functioning as intended and that continual improvement is achieved.

Clauses Covered under Clause 9

Clause 9.1 – Monitoring, measurement, analysis and evaluation
Clause 9.2 – Internal audit
Clause 9.3 – Management review

ISO 28000:2022 – Clause 10: Improvement

This lesson focuses on how organizations improve the effectiveness of their supply chain security management system. It explains the processes for handling nonconformities, taking corrective actions, and driving continual improvement to enhance security performance and resilience against evolving threats.

Clauses Covered under Clause 10

Clause 10.1 – Nonconformity and corrective action
Clause 10.2 – Continual improvement