Skip to content
SecureKnots
Book a call

Management Systems · ISO 28000:2022 Security and Resilience: Security Management Systems

A management system standard for security across your operations and supply chain. The 2022 edition widened its scope from supply chains to security risk across the whole organization.
Book a ISO 28000 assessment

Issued by

ISO

Typical timeline

12-18 weeks

Assessed by

Accredited certification body

Validity

3-year certificate, annual surveillance

Overview

  • 01Logistics, freight, ports and warehousing operators
  • 02Manufacturers and exporters with critical supply chains
  • 03Suppliers to defense, aviation and critical infrastructure

Requirements

  1. 01Security risk assessmentThreats to people, assets, information and the supply chain identified and evaluated.
  2. 02Policy & objectivesLeadership commitment, a security policy and measurable security objectives.
  3. 03Operational controlsControls over sites, suppliers, outsourced processes and goods in transit.
  4. 04Incident response & recoveryEmergency preparedness, response and recovery, tested and reviewed.

Our approach

Week 1

01

Scope

We learn your product, your buyers and your deadlines, then fix the exact frameworks, boundaries and systems in scope.

Weeks 2-3

02

Assess

Control-by-control gap assessment against every target framework at once, with a single prioritized findings register.

Weeks 3-10

03

Remediate

Policies written, controls implemented, evidence automated. We work inside your tools, Jira, GitHub, AWS, Google Workspace.

Weeks 10-14

04

Audit

Mock audit, auditor selection and fieldwork coordination. Your independent auditor issues the report; we sit beside you until they do.

Year-round

05

Sustain

Continuous monitoring, quarterly testing and a renewal calendar that never surprises you.

Customer story

PHParallax HealthBoston, US
Sample

3

Frameworks in one program

Three frameworks, one fieldwork window, zero engineering fire drills.

SOC 2ISO 27001HIPAA

FAQ

Typical timeline: 12-18 weeks, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.

Yes, that's our specialty. ISO 28000 shares substantial control overlap with ISO 22301 and ISO 27001, so we build one control set and map evidence across all of them.

Next framework

ISO 41001

Management SystemsISO

End of the thread

A 30-minute call with a senior practitioner. You leave with a plan either way.

Book a consultationcontact@secureknots.com

We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.

Cookies, tied neatly

We use essential cookies to run this site and, with your permission, analytics to improve it. Privacy policy