Compliance FrameworksInternational
ISO 28000
Security and resilience - Security management systems for the supply chain.
Security and resilience - Security management systems for the supply chain.
| Region | International |
| Country or scope | International |
| Sector | Supply Chain |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 28000
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ISO 28000.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for ISO 28000 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO28000-4 Context and Supply Chain Scope | The organisation must determine the scope of the security management system including its supply chain context, which for software means the system under review is named and its contents enumerated (ISO 28000:2022 clause 4, context of the organization) | Scan |
ISO28000-6 Security Risk Assessment Planning | Planning requires assessing security risks and opportunities across the supply chain, which is only possible when components are unambiguously identifiable for threat matching (ISO 28000:2022 clause 6, planning and security risk assessment) | Scan |
ISO28000-7.5 Documented Information | The management system must maintain controlled documented information, which for software supply chains means identifiable, timestamped bills of materials (ISO 28000:2022 clause 7.5, documented information) | Scan |
ISO28000-8 Operational Security Controls | Operational planning and control must implement the security measures identified, including protecting goods and artifacts in the chain against tampering, evidenced by cryptographic hashes on software components (ISO 28000:2022 clause 8, operation) | Scan |
ISO28000-SUP Upstream Supplier Visibility | Managing supply chain security requires knowing the parties upstream in the chain, which for software means a named supplier for each component (ISO 28000:2022 supply chain security management requirements) | Scan |
ISO28000-DEP Chain Relationship Mapping | Security management across the supply chain presumes understanding how elements of the chain depend on one another, which for software means documented dependency relationships (ISO 28000:2022 supply chain context and interdependency considerations) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
4.1 | Understanding the Organisation and Its Context |
5.1 | Leadership and Commitment |
6.1 | Supply Chain Security Risk Assessment |
7.1 | Resources, Competence and Awareness |
7.4 | Communication |
7.5 | Documented Information |
8.1 | Operational Planning and Control |
8.2 | Supply Chain Security Plan |
8.5 | Emergency Preparedness and Response |
8.6 | Management of Change in Supply Chain Security |
9.1 | Performance Evaluation and Monitoring |
10.1 | Continual Improvement |
Policy templates
Written for ISO 28000:
- Supply Chain Security Management System (SCSMS) Manual
- Supply Chain Security Risk Assessment Procedure
- Supply Chain Emergency Preparedness and Response Plan
And 22 from the standard set, adapted to ISO 28000.