What is ISO 28000?
ISO 28000 sets out the requirements for a security management system: the organization identifies security threats, assesses the risk they pose and puts measures in place to manage it. The standard also covers the supply chain.
The current edition is ISO 28000:2022 “Security and resilience — Security management systems — Requirements”. It is the second edition, published by ISO in March 2022, and was developed by technical committee ISO/TC 292. In 2024 a climate change amendment (Amd 1:2024) was added to it, as to the other management system standards.
According to ISO, the standard applies to organizations of all types and sizes — commercial companies, public bodies and non-profit organizations — and is not specific to any industry. It is most often used by companies in transport, logistics, warehousing, freight forwarding and courier services.
The previous edition, ISO 28000:2007, was written specifically for the supply chain. The 2022 edition keeps that focus but applies to the security of the whole organization.
What is AEO status?
Authorised economic operator (AEO) is a status that customs authorities grant to reliable companies under the Union Customs Code — Regulation (EU) No 952/2013. In Bulgaria, authorisations are issued by the Customs Agency. Article 38(2) of the Code provides for two types of authorisation:
For companies that want simpler customs procedures. The security criterion does not apply.
For companies in the international supply chain. Requires appropriate security and safety standards.
The security and safety criterion is in Article 39(e) of the Code and applies only to the AEOS authorisation. It is considered fulfilled when the company demonstrates that it maintains appropriate measures to ensure the security of the international supply chain.
What do customs check on security?
The conditions are listed in Article 28(1) of Implementing Regulation (EU) 2015/2447. In short, customs check:
- Buildings and accessProtection against unlawful intrusion and measures against unauthorised access to offices, warehouses and loading areas.
- Handling of goodsProtection against the unauthorised introduction or exchange of goods and against tampering with cargo units.
- Business partnersClear identification of partners and arrangements ensuring they secure their part of the chain.
- Staff and suppliersScreening of staff in security-sensitive positions, procedures for external service providers, awareness training and a contact person.
How is an ISO 28000 certificate taken into account for AEO?
Article 28(2) of the regulation states that where the applicant holds a security and safety certificate issued on the basis of an international convention, an International Standard of ISO or a European standard, that certificate is taken into account when checking compliance with the security criterion.
The criteria are deemed to be met to the extent that the criteria for issuing the certificate are found to be identical or equivalent to those in the Code. The regulation does not name a specific standard — the assessment is made by customs.
The certificate gives
- Evidence that the security system is in place and has been checked by an independent body
- Documented risk assessments and measures that customs can review
- An annual surveillance audit — the system is maintained, not just described
- An advantage with clients and partners along the chain
The certificate does not give
- AEO status — only customs authorities grant it
- Automatic fulfilment of the security criterion
- Fulfilment of the other AEO criteria
- Exemption from an on-site check by customs
How does ISO 28000 certification work?
- 1Security risk assessment
You define the sites, activities and links in the chain and assess the threats to them.
- 2Measures and documents
You put the measures in place, document the procedures and carry out an internal audit and management review.
- 3Stage 1
The auditor reviews the documentation and the risk assessment and assesses readiness for the on-site audit.
- 4Stage 2
The auditor checks how the measures work in practice — access, handling of goods, partners, training.
- 53-year certificate
With a surveillance audit in the second and third year and recertification before it expires.
ISO 28000 certification through Euro Standard Certification is carried out by CERTIND S.A. under its established procedures. The standard is outside the scope of the body’s accreditation. If a contract or contracting authority requires an accredited certificate, say so in your enquiry — we will tell you which standard covers it. The certification body does not provide consultancy — preparing the system and the AEO application are separate work.
Questions about ISO 28000 and AEO
Is an ISO 28000 certificate mandatory for AEO status?
No. AEO status is granted by customs authorities after their own assessment. A certificate to an ISO security standard is taken into account when checking the security and safety criterion, but it is not a condition for the status.
Does an ISO 28000 certificate grant AEO status automatically?
No. The regulation provides that the criteria are deemed to be met only to the extent that the criteria for issuing the certificate are identical or equivalent to those in the Union Customs Code. The assessment is made by customs.
Which companies is ISO 28000 suitable for?
Organizations of all types and sizes. It is most often used by companies in transport, logistics, warehousing, freight forwarding and courier services, and by manufacturers and traders with international supply chains.
Is ISO 28000 certification through ESCERT accredited?
No. The certificate is issued by CERTIND S.A. under its established procedures after an actual audit, but ISO 28000 is outside the scope of the body’s accreditation.