ISO 28000:2022 Security Management Certification for Supply Chains in Dubai & UAE

Dubai sits at the centre of global trade, with major ports, free zones, airports and warehouses moving goods to every region. That position brings expectations: customers, customs authorities and insurers want to know that cargo and facilities are protected from theft, tampering, smuggling and disruption. ISO 28000:2022 is the international standard for security management systems. BRSM Global helps logistics providers, freight forwarders, warehouse operators and manufacturers in the UAE implement and certify a security management system that protects people, assets and goods.

What is ISO 28000 Supply Chain Security Management Certification?

ISO 28000:2022, Security and resilience - Security management systems - Requirements, specifies requirements for a security management system, including aspects relevant to the supply chain. It replaced the 2007 edition, which was titled Specification for security management systems for the supply chain. The 2022 edition was revised to follow the ISO high-level structure and to align with the family of security and resilience standards, and organisations certified to the 2007 edition have been required to transition.

The standard is not limited to physical guarding. It covers the identification of security threats, risk assessment, controls that are proportionate to the risk and continual improvement, across areas such as facilities, cargo, transport modes, information, personnel and subcontractors. It applies to any organisation, from a small freight forwarder to a port operator, and it integrates with ISO 9001 and ISO 27001.

Benefits of ISO 28000 Certification for UAE Businesses

Reduced theft, loss and tampering

Structured threat assessment and controls cut losses, claims and downtime.

Smoother customs and customer approvals

Documented security supports trusted-trader and customer security assessments.

Insurance and risk benefits

Insurers and shippers value independent evidence of security controls.

Resilience to disruption

Planning for security incidents and continuity protects delivery performance.

Strong credentials for logistics tenders

Many global shippers include security management in supplier selection.

ISO 28000 Requirements

For ISO 28000:2022 certification, your organisation must show the following:

Context (clause 4): the internal and external issues, interested parties and the scope of the security management system.
Leadership (clause 5): a security policy and clear authorities and responsibilities.
Planning (clause 6): security-related risk assessment and treatment, legal requirements, objectives and planning for changes.
Support (clause 7): resources, competence of security personnel, awareness, communication and documented information.
Operation (clause 8): security risk assessment and treatment, operational controls, and security plans, including access control, cargo handling, personnel screening and subcontractor control.
Performance evaluation (clause 9): monitoring, internal audit and management review.
Improvement (clause 10): incident response, corrective action and continual improvement.

ISO 28000 Supply Chain Security Management Certification Process: How BRSM Global Gets You Certified

Our approach follows the four-stage process that BRSM Global applies to every management system project: guidance, implementation, auditing and post-certification. For ISO 28000 Supply Chain Security Management Certification, that translates into the following eight practical steps.

Step 1: Free consultation and scope definition

We start with a conversation about your business, sites, activities and customers. We confirm whether ISO 28000 fits your goals, define the scope of certification and agree a realistic timeline.

Step 2: Gap analysis

Our consultants compare your current practices, documents and records with the requirements of ISO 28000:2022. You receive a clear gap report with priorities, so effort goes where it matters.

Step 3: Planning and fixed quote

Based on the gap analysis we prepare a project plan with responsibilities and milestones and a fixed written quote, so you know the investment before work begins.

Step 4: Documentation and implementation

We help you develop the policies, procedures, registers and records the standard requires, in plain language and sized to your organisation, and we help your team put them into daily practice. This is the 'Guidance' and 'Implementation' stage of our process.

Step 5: Training and awareness

Management and staff are trained on their responsibilities under ISO 28000. Where relevant we also train internal auditors, who will later audit your system.

Step 6: Internal audit and management review

Once the system has been operating, we help you run an internal audit and a management review. These are mandatory and give you the chance to fix issues before the external audit.

Step 7: Independent certification audit (Stage 1 and Stage 2)

The certification audit is carried out by an independent certification body, never by your consultant. Stage 1 reviews documentation and readiness. Stage 2 verifies implementation on site through interviews, observation and records. We prepare your team and support you during the audit; this is the 'Auditing' stage of our process.

Step 8: Certificate issue and post-certification support

After any nonconformities are closed, the certificate is issued, normally for three years with annual surveillance audits. We stay with you after certification, advising on changes, standard updates and surveillance audit preparation, which is our 'Post-certification' stage. Our article on leading ISO transitions with people at the centre explains why this support matters.

Documents Required for ISO 28000

Typical documented information includes:

Security policy and scope of the management system
Security threat and risk assessment
Security plans for each facility and transport mode
Access control and visitor management records
Cargo handling, sealing and chain-of-custody procedures
Personnel screening and security awareness training records
Subcontractor and carrier security requirements and assessments
Incident reporting and response procedures
Security equipment maintenance records (CCTV, alarms, locks)
Internal audit and management review records

How Long Does ISO 28000 Certification Take?

Small and medium logistics operators can usually implement ISO 28000 in around 3 to 5 months, while multi-site operators and ports may require 6 to 9 months. The timeline depends on the scope, the number of facilities and subcontractors, and how mature existing security controls are. Certification follows a two-stage audit, with a three-year certificate and annual surveillance audits.

Who Needs ISO 28000 Certification?

This certification is relevant to a wide range of organisations, including:

Freight forwarders, 3PL providers and customs clearance companies
Warehouse, free-zone and port operators
Manufacturers and exporters of high-value goods
Courier, express and air cargo companies
Organisations required by customers to demonstrate supply chain security

ISO 28000 in Dubai and the UAE

Jebel Ali, Dubai's airports and the free zones form one of the most important trade networks in the world. Companies working in this environment are regularly audited by customers and authorities. Our Business Bay consultants understand how UAE logistics sites operate, and help you build security controls that work for real shipments and real shift patterns. Learn more on our Transport & Logistics sector page.

Why Choose BRSM Global in Dubai & UAE?

Choosing the right partner is as important as choosing the right standard. BRSM Global is an international inspection, training and certification group with a one-stop approach to ISO and related certifications, and our Dubai team is close to your business.

Local presence in Dubai and the UAE

Our UAE office is at Executive Towers, Tower 1, Office 1102, Business Bay, Dubai. We meet you on site, understand local practice and respond quickly. We also have offices in Riyadh (Al Olaya, Al Faisaliah Tower) and Muscat (Al Khuwair), which helps if your organisation operates across the Gulf.

Proven experience

BRSM Global has completed more than 5,000 projects for over 2,500 clients in more than 10 countries, working with 20+ associations. Our consultants combine hands-on industry experience with deep knowledge of the standards.

Practical systems, not paperwork

We design systems that fit your size and your sector, so your team actually uses them. Our experience across the Transport & Logistics sector and our other industry sectors means we speak your language from the first meeting.

Complete one-stop service

From gap analysis and documentation to training, internal audit, certification audit support and ongoing advice, one team supports you at every stage. You can read more about our company on the About Us page or browse practical insights on our blog.

Transparent and independent

We give you a fixed written quote after the gap analysis, explain what is included, and keep consultancy separate from the independent certification audit so that your certificate retains its credibility. Before you commit to any certification body, we recommend you verify its accreditation status for your scope.

Frequently Asked Questions About ISO 28000

What is ISO 28000?

An international standard that specifies requirements for security management systems, including those for supply chains.

What changed in ISO 28000:2022?

It was updated to the ISO high-level structure and renamed Security and resilience - Security management systems - Requirements. The 2007 edition is superseded.

Is ISO 28000 the same as ISO 27001?

No. ISO 27001 is for information security. ISO 28000 covers physical and operational security, including cargo and facilities.

Who needs ISO 28000 certification?

Logistics, freight, warehousing, port and manufacturing organisations with security obligations to customers or authorities.

How long does certification take?

Typically 3 to 5 months for small and medium operators.

Can we integrate it with other ISO systems?

Yes. It uses the same high-level structure as ISO 9001, ISO 14001, ISO 45001 and ISO 27001.

Related Services

Many organisations combine standards in one integrated management system. You may also be interested in:

Get Your ISO 28000 Certification with BRSM Global

Ready to start your ISO 28000 Supply Chain Security Management Certification journey in Dubai or anywhere in the UAE? Tell us about your business and we will respond with a gap analysis plan and a fixed quote.