ISO 28002-2011 PDF

Full title and description

ISO 28002:2011 — Security management systems for the supply chain — Development of resilience in the supply chain — Requirements with guidance for use. This document specifies requirements for a resilience management system in the supply chain to help organizations develop and implement policies, objectives and programs to identify and manage supply‑chain risks, protect assets and processes, and manage disruptive incidents.

Abstract

ISO 28002:2011 defines a resilience management system for the supply chain: it sets out requirements and guidance enabling organizations to consider legal and regulatory obligations, identify significant risks, hazards and threats affecting the organization and its supply chain, protect assets and processes, and prepare for, respond to and recover from disruptive incidents. The standard was published as a full International Standard in August 2011 and later withdrawn.

General information

• Status: Withdrawn (withdrawal stage).
• Publication date: August 2011 (Edition 1, 2011-08).
• Publisher: International Organization for Standardization (ISO).
• ICS / categories: 03.100.01, 03.100.70 (security and resilience related fields).
• Edition / version: Edition 1 (2011).
• Number of pages: 55 (ISO bibliographic record).

Scope

The standard applies to organizations of any type or size that are responsible for part or all of a supply chain and that need a structured management approach to build, maintain and improve supply‑chain resilience. It covers the design, implementation, operation, monitoring, review and continual improvement of a resilience management system to reduce the likelihood and impact of disruptive incidents affecting the supply chain. ISO/PAS 28002:2010 was the predecessor specification that led to the 2011 International Standard.

Key topics and requirements

• Establishing a resilience management system: policy, roles, responsibilities and leadership.
• Risk and threat identification, assessment and treatment across the supply chain.
• Protection of assets, information and processes that support continuity of supply.
• Incident preparedness, response, recovery and lessons‑learned processes.
• Integration with legal, regulatory and stakeholder requirements.
• Monitoring, measurement, internal audit and continual improvement of resilience performance.

Typical use and users

Used by supply‑chain managers, security and continuity professionals, risk and resilience practitioners, certification bodies and auditors when establishing or assessing a formal resilience management system for supply‑chain operations. Relevant for organizations across manufacturing, logistics, transport, distribution, retail and public sector supply functions seeking a structured approach to manage disruptive risks.

Related standards

ISO 28002:2011 is part of the broader set of ISO guidance and standards addressing supply‑chain and security management. Related documents include ISO 28000 (security management systems for the supply chain), ISO 28001 / ISO 28004 series (guidance on implementing supply‑chain security systems) and other resilience and business continuity standards developed under ISO/TC 292 and related committees (for example standards in the ISO 22300 series on business continuity and resilience).

Keywords

supply chain, resilience, security management system, supply‑chain risk, business continuity, incident response, ISO 28002, ISO/PAS 28002

FAQ

Q: What is this standard?

A: ISO 28002:2011 is an ISO International Standard that specified requirements and guidance for a resilience management system tailored to the supply chain, helping organizations manage disruptive risks and maintain continuity of supply operations.

Q: What does it cover?

A: It covers the establishment, implementation, operation, monitoring and continual improvement of a supply‑chain resilience management system, including risk assessment, asset protection, incident preparedness and recovery, and compliance with legal and stakeholder requirements.

Q: Who typically uses it?

A: Supply‑chain managers, security and resilience professionals, compliance teams, and organizations in logistics, manufacturing, transport and distribution seeking a formal, system‑based approach to reduce supply‑chain disruption risk.

Q: Is it current or superseded?

A: ISO 28002:2011 is recorded as withdrawn in the ISO bibliographic record. It was published in August 2011 and later withdrawn; users should consult current ISO catalogues or national standards bodies for present, active standards or replacements covering supply‑chain resilience and security.

Q: Is it part of a series?

A: Yes. ISO 28002 relates to the family of supply‑chain security and resilience standards (for example ISO 28000, ISO 28001 and ISO 28004 series) and sits alongside business continuity and resilience standards developed under ISO/TC 292 and associated technical committees.

Q: What are the key keywords?

A: Supply chain resilience, security management system, risk assessment, incident response, business continuity, ISO 28002.