ISO/PAS 28001:2006

Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Field of application
  4.1 Statement of application
  4.2 Business partners
  4.3 Internationally accepted certificates or approvals
  4.4 Business partners exempt from security declaration
      requirement
  4.5 Security reviews of business partners
5 Supply chain security process
  5.1 General
  5.2 Identification of the scope of security assessment
  5.3 Conduction of the security assessment
  5.4 Development of the supply chain security plan
  5.5 Execution of the supply chain security plan
  5.6 Documentation and monitoring of the supply chain
      security process
  5.7 Actions required after a security incident
  5.8 Protection of the security information
Annex A (informative) Supply chain security process
Annex B (informative) Methodology for security risk
                      assessment and development of
                      countermeasures
Annex C (informative) Guidance for obtaining advice and
                      certification
Bibliography

ISO/PAS 28001:2006 provides requirements and guidance for organizations in international supply chains to

• develop and implement supply chain security processes;
• establish and document a minimum level of security within a supply chain(s) or segment of a supply chain;
• assist in meeting the applicable Authorized Economic Operators criteria set forth in the World Customs Organization Framework of Standards and conforming national supply chain security programmes.

NOTE Only a participating National Customs Agency can designate organizations as Authorized Economic Operators in accordance with its supply chain security programme and its attendant certification and validation requirements.

In addition, ISO/PAS 28001:2006 establishes certain documentation requirements that would permit verification.

Users of ISO/PAS 28001:2006 will

• define the portion of an international supply chain within which they have established security (see 4.1);
• conduct security vulnerability assessments on that portion of the supply chain and develop adequate countermeasures;
• develop and implement a supply chain security plan;
• train security personnel in their security related duties.