ISO 28000 Security Management Qatar

Q: Q5. How much does Guardian Approved Scheme conformity assessment cost?

Guardian's indicative range is QAR 5,000–20,000 (Cluster B) for initial assessment, depending on operational scope and security threat exposure.

ISO 28000:2022 conformity assessment issued under the Guardian Approved Scheme — a structured conformity assessment programme administered by Guardian Middle East LLC.

Demonstrate your organisation’s commitment to systematic security management — protecting people, assets, infrastructure, and supply chain operations against security threats. Aligned with Qatar’s strategic infrastructure security expectations, Hamad Port (Mwani Qatar) operations, regional logistics hub ambitions, and broader supply chain security frameworks.

Important Disclosure: Tier 4 — Guardian Approved Scheme (NOT IAF MLA Accredited). Certificates for ISO 28000:2022 are issued under the Guardian Approved Scheme — Guardian’s own structured conformity assessment programme. This is NOT an internationally accredited certification under IAF MLA. See §12 for full disclosure.

Post-Transition Status. ISO 28000:2022 (second edition, published 15 March 2022) replaced ISO 28000:2007. The three-year transition period ended March 2025 — ISO 28000:2022 is now the only operative edition.

WHAT IS ISO 28000:2022?

ISO 28000:2022 is the international standard for Security Management Systems (SeMS). It specifies requirements for a security management system, including aspects relevant to the supply chain. The standard provides a holistic and common approach to security management — applicable to all types and sizes of organizations across all industries.

ISO 28000:2022 was developed by ISO Technical Committee TC 292 (Security and resilience) and published on 15 March 2022 as the second edition. It replaced ISO 28000:2007 (originally developed by ISO/TC 8 for ships and maritime technology). The 2022 edition expanded scope beyond supply chain to all aspects of organizational security.

Key changes in ISO 28000:2022 (vs 2007 edition):

Title change — from ‘Specification for security management systems for the supply chain’ to ‘Security and resilience — Security management systems — Requirements’
Scope expansion — from supply-chain-only to all organizational security
Harmonized Structure adoption — full alignment with Annex SL for integration
Risk-based approach strengthened — alignment with ISO 31000
Eight security management principles added in Clause 4 (aligned with ISO 31000)
Security context analysis strengthened
Continuity for existing certified organizations — most 2007 requirements retained

ISO 28000 family overview:

ISO 28000:2022 — SeMS Requirements (certifiable, with Amd 1:2024 Climate action)
ISO 28001:2007 — Best practices for implementing supply chain security
ISO 28002:2011 — Resilience in the supply chain
ISO 28003:2007 — Requirements for bodies providing audit and certification of supply chain SeMS
ISO 28004 family — Implementation guidance

Key concepts of ISO 28000:2022:

Security — protection from intentional and unintentional acts
Security management system (SeMS) — coordinated framework for security management
Security risk — risk of intentional or unintentional acts affecting organizational objectives
Security threats — terrorism, theft, smuggling, cyberattacks (in supply chain context), product tampering, fraud, sabotage, unauthorized access
Supply chain security — security across upstream and downstream operations
Resilience — capacity to anticipate, withstand, and recover from disruption
Eight security management principles — leadership, integration, comprehensive approach, risk-based decisions, structured/comprehensive process, customized/tailored, inclusive, continual improvement

WHY DOES THIS MATTER FOR QATAR ORGANISATIONS?

Qatar’s strategic position as a regional logistics hub, combined with substantial port operations, energy export operations, and broader supply chain complexity, creates significant security management imperatives. ISO 28000:2022 provides the international framework most relevant to Qatar organisations with substantial security exposure.

1. Hamad Port (Mwani Qatar) Operations

Hamad Port serves as Qatar’s strategic seaport and regional logistics hub. Container security, cargo screening, ship security interfaces, and broader port security operations create substantial security management demands. ISO 28000:2022 provides systematic framework aligned with port security expectations.

2. Hamad International Airport Cargo & Logistics

Hamad International Airport’s substantial cargo operations, courier hub functions, and high-value goods movements create substantial security management demands. Aviation cargo security frameworks (ICAO, IATA, regulatory expectations) align with ISO 28000:2022 systematic approach.

3. Energy Sector Supply Chain Security

QatarEnergy’s substantial export operations, LNG shipping, and broader energy supply chain face significant security threats — terrorism, sabotage, cargo theft, sanctions compliance. ISO 28000:2022 provides systematic security management framework.

4. Logistics and Freight Sector

Major logistics operators (DHL, Aramex, regional firms) face substantial security risks across cargo handling, transportation, warehousing, and last-mile delivery. ISO 28000:2022 provides foundational framework — increasingly required by major customers.

5. Critical Infrastructure Protection

Qatar’s critical infrastructure — power generation, water desalination, telecommunications, financial systems — faces substantial security threats. ISO 28000:2022 provides systematic framework supporting critical infrastructure protection initiatives.

KEY REQUIREMENTS — CLAUSES 4-10

ISO 28000:2022 follows the Harmonized Structure (Clauses 4-10) with security-specific requirements throughout:

Clause	Title	Key Requirements
4	Context of the Organization	Internal/external issues · Stakeholder needs · SeMS scope · Eight security management principles (4.4) · Climate change relevance (Amd 1:2024)
5	Leadership	Top management commitment · Security policy · Roles, responsibilities, authorities · Security culture
6	Planning	Security risk assessment · Security risk treatment · Statement of Applicability (security controls) · Security objectives · Planning of changes
7	Support	Resources · Security competence · Awareness · Communication · Documented information
8	Operation	Operational planning and control · Security risk treatment implementation · Security incident response · Outsourced security activities
9	Performance Evaluation	Monitoring, measurement, analysis · Internal audit · Management review · Security performance evaluation
10	Improvement	Nonconformity and corrective action · Continual improvement · Security incident learning

Distinctive ISO 28000:2022 requirements: Eight security management principles (Clause 4.4) provide foundational framework aligned with ISO 31000 risk management principles. Security risk assessment (Clause 6.1) addresses both intentional and unintentional security threats. Statement of Applicability documents security controls implemented to treat identified risks. Security incident response (Clause 8.4) provides systematic framework for managing security events.

WHO NEEDS ISO 28000:2022 CONFORMITY ASSESSMENT?

ISO 28000:2022 follows the Harmonised Structure (Clauses 4-10) with security-specific requirements throughout:

Clause	Title	Key Requirements
4	Context of the Organization	Internal/external issues · Stakeholder needs · SeMS scope · Eight security management principles (4.4) · Climate change relevance (Amd 1:2024)
5	Leadership	Top management commitment · Security policy · Roles, responsibilities, authorities · Security culture
6	Planning	Security risk assessment · Security risk treatment · Statement of Applicability (security controls) · Security objectives · Planning of changes
7	Support	Resources · Security competence · Awareness · Communication · Documented information
8	Operation	Operational planning and control · Security risk treatment implementation · Security incident response · Outsourced security activities
9	Performance Evaluation	Monitoring, measurement, analysis · Internal audit · Management review · Security performance evaluation
10	Improvement	Nonconformity and corrective action · Continual improvement · Security incident learning

SECTOR APPLICABILITY — QATAR PRIORITY SECTORS

Sector	ISO 28000 Relevance
Port Operations (Mwani Qatar)	Critical for Hamad Port operations and supporting service providers. Port security has multiple regulatory frameworks (ISPS Code, AEO, etc.) — ISO 28000 provides integrating management framework.
Airport Cargo & Logistics	Important for Hamad International Airport cargo operations, Qatar Airways Cargo, courier hubs. Aviation cargo security alignment.
Logistics & Freight	Strong fit for major logistics operators. Customer security expectations increasingly require ISO 28000 evidence.
Energy Sector Supply Chain	Critical for QatarEnergy operations, LNG shipping, oil & gas supply chain. Substantial security threats; sanctions compliance integration.
Pharmaceutical & Medical Devices	Important for pharmaceutical importers, distributors, manufacturers. Cold chain integrity, anti-counterfeiting, controlled substance security.
High-Value Goods	Relevant for jewellery, electronics, luxury goods importers/distributors. Substantial theft and diversion risks.
Defence & Security	Applicable to defence contractors, security service providers. Sensitive operations with substantial security frameworks.
Critical Infrastructure	Important for Kahramaa, telecommunications operators, financial systems operators. Critical asset protection.
Banking Physical Security	Relevant for banks with substantial physical security operations — branch network, ATM, cash transit, vault operations.
Manufacturing	Applicable to manufacturers with substantial supply chain security exposure.
Free Zones (QFZ)	Important for Qatar Free Zones Authority operations and tenant companies. Free zone security frameworks align with ISO 28000.

BENEFITS OF ISO 28000:2022 CONFORMITY ASSESSMENT

Security Performance Benefits

Systematic identification and treatment of security risks
Reduced security incidents (theft, sabotage, breach)
Better preparedness for security threats
Enhanced security culture across the organisation
Stronger protection of people, assets, and operations
Better integration of security into business operations
Foundation for security risk-based decision-making

Operational Benefits

Reduced operational disruption from security incidents
Better supply chain visibility and control
Enhanced supplier security qualification
Reduced cargo loss and damage
Improved access control and personnel security
Stronger crisis management and incident response
Foundation for security technology investment

Commercial Benefits

Pre-qualification advantage for security-conscious tenders
Stronger position with major customers requiring security evidence
Reduced customer audit burden
Foundation for trusted trader programmes (AEO, C-TPAT)
Enhanced positioning in sensitive cargo handling
Reduced second-party security audit demands

Financial Benefits

Reduced insurance premiums (typically 5-15% for security-conscious operators)
Lower theft, fraud, and sabotage losses
Reduced regulatory penalty exposure
Lower cost of security incident remediation
Foundation for security-conscious customer pricing premiums

Strategic Benefits

Vision 2030 security pillar contribution
Critical infrastructure resilience evidence
Foundation for international trade facilitation
ESG governance disclosure support
Climate change considerations integrated (Amd 1:2024)
Foundation for cross-border trade and logistics expansion

CONFORMITY ASSESSMENT PATHWAY

Guardian’s conformity assessment pathway under the Guardian Approved Scheme follows ISO/IEC 17021-1:2015 principles for management system assessment, even though the resulting certificate is not IAF MLA accredited:

Stage	Activity	Outcome
1	Application & Contract	Application form. Guardian reviews scope (operations, sites, supply chain footprint, security threats), proposes assessment plan. Contract signed.
2	Stage 1 Assessment	On-site readiness review. Assessor verifies SeMS documentation, security policy, security risk register, Statement of Applicability, security incident response procedures.
3	Stage 2 Assessment	On-site full assessment. Assessor samples evidence, observes security operations across sample sites, reviews security incident records, audits supplier security controls, validates access control and physical security.
4	Conformity Decision	Guardian’s conformity assessment committee reviews assessment report. Guardian Approved Scheme certificate issued (3-year validity).
5	Surveillance & Re-Assessment	Annual surveillance assessments. Re-assessment before Year 3.

Assessor competence: ISO 28000 conformity assessments require assessors with substantive security competence — typically security management, supply chain security, or risk management backgrounds with sector experience. Sensitive operations may require additional vetting.

IMPLEMENTATION TIMELINE

Typical end-to-end implementation timeline is 8 to 14 months depending on operational complexity and security threat exposure:

Phase	Duration	Activities
Gap Analysis & Threat Assessment	4-8 weeks	Review existing security practices against ISO 28000:2022. Comprehensive security threat and vulnerability assessment.
System Design	8-12 weeks	Develop SeMS Manual, security policy, security risk methodology, security objectives, Statement of Applicability, integration with risk management.
Implementation	12-20 weeks	Roll out new processes. Implement security controls. Train security and operations staff. Implement supplier security controls. Test incident response.
Internal Audit & Review	4 weeks	Internal audit cycle. Security performance review. Management review. Address findings.
Conformity Assessment	3-5 weeks	Stage 1 readiness review. Stage 2 full assessment.

Key implementation considerations: Security risk assessment requires specialist competence — engaging security professionals with sector experience helps. Existing security operations may need formalisation rather than complete reinvention. Multi-site operations require careful sampling and consistency.

DOCUMENTATION REQUIREMENTS

Mandatory Documented Information

Scope of the SeMS (Clause 4.3) — operations, sites, supply chain coverage
Security policy (Clause 5.2)
Security risk assessment criteria and methodology (Clause 6.1)
Security risk treatment plan (Clause 6.1)
Statement of Applicability — security controls (Clause 6.1)
Security objectives (Clause 6.2)
Evidence of competence (Clause 7.2)
Operational planning and control (Clause 8.1)
Security incident response procedures (Clause 8.4)
Records of internal audit and audit results (Clause 9.2)
Records of management review (Clause 9.3)
Records of nonconformities and corrective actions (Clause 10.1)

INVESTMENT & PRICING

Indicative pricing range: QAR 5,000 – 20,000 depending on operational scope, sites, security threat exposure, and integration with other certifications.

Assessment time and corresponding fee considerations:

Effective number of personnel (operations, security, management)
Operational scope — single-site vs multi-site, single-jurisdiction vs international
Security threat exposure — high-threat sectors require additional assessment time
Supply chain breadth — extensive supplier networks affect scope
Integration with other Guardian-issued certifications

Cost components beyond initial assessment:

Application fee (one-time)
Stage 1 + Stage 2 assessment fee
Surveillance assessments (Year 1 and Year 2)
Re-assessment (Year 3)
Travel costs for multi-site assessments

For an exact quotation, contact Guardian directly.

GUARDIAN APPROVED SCHEME — CONFORMITY ASSESSMENT (NOT IAF MLA ACCREDITED)

Tier 4 Disclosure — Guardian Approved Scheme (Conformity Assessment).Certificates for ISO 28000:2022 are issued under the Guardian Approved Scheme — a structured conformity assessment programme administered by Guardian Middle East LLC (QFC 03870). This is NOT an internationally accredited certification under IAF MLA recognition.

Why this approach for ISO 28000:

ISO 28000 currently falls outside the accreditation scope of Guardian Assessment Pvt Ltd, TNV Global Limited, or any other entity within the Guardian/TNV group. Rather than misrepresent third-party accreditation, Guardian offers transparent conformity assessment under our own scheme.

Tier 4 consistency with R13, R15, R16, R17:

ISO 28000 is the fifth standard in Guardian’s portfolio under Tier 4 (Guardian Approved Scheme), following ISO 41001:2018 (R13), ISO 37301:2021 (R15), ISO 20121:2024 (R16), and ISO 39001:2012 (R17). All Tier 4 standards are issued under the Guardian Approved Scheme administered by Guardian Middle East LLC.

Tier comparison:

Tier	Issuing Body & Standards
Tier 1	Guardian Assessment Pvt Ltd · QS RB066-26 + UAF/IAS · ISO 9001/14001/45001 · IAF MLA accredited
Tier 2	Guardian Assessment Pvt Ltd · UAF/IAS only · ISO 21001/27001/37001/27701/55001/13485 · IAF MLA accredited
Tier 2-Special	Third-Party CB · IAS MSCB 154 · ISO 22301 · IAF MLA accredited
Tier 3	TNV Global Limited · UAF only · ISO/IEC 20000-1, ISO 50001, ISO/IEC 42001 · IAF MLA accredited
Tier 4 (this standard)	Guardian Middle East LLC · Guardian Approved Scheme · ISO 41001, ISO 37301, ISO 20121, ISO 39001, ISO 28000 (and future) · NOT IAF MLA accredited

CURRENT EDITION STATUS

ISO 28000:2022 is the current second edition, published on 15 March 2022 by ISO/TC 292. The 2022 edition replaced ISO 28000:2007 with title change reflecting expanded scope (from supply-chain-only to all organisational security).

Post-Transition Status:

Transition Complete. ISO 28000:2007 is fully withdrawn. The three-year transition period from publication ended March 2025. ISO 28000:2022 is the only operative edition.

Climate Action Amendment 1:2024 (Now in Effect)

ISO 28000:2022 / Amendment 1:2024 — Climate action changes is now in effect as part of the IAF/ISO joint Climate Action initiative. No transition period applies — the amendment is effective from publication. The 2022 edition with this amendment is the current operative edition.

Future Edition Outlook:

No formal revision project for ISO 28000 is currently active. Recently revised (2022), ISO 28000:2022 is in early adoption phase. ISO/TC 292 systematic review will commence around 2027. The 2022 edition with Climate Amendment 1:2024 is current and stable.

No §13b section for this standard — successor not in development.

COMMON MISCONCEPTIONS & CLARIFICATIONS

Misconception 1: ‘ISO 28000 is only for supply chain operations.’

Reality: The 2022 edition expanded scope to all organisational security. The title changed from ‘Specification for security management systems for the supply chain’ to ‘Security and resilience — Security management systems — Requirements’. Now applicable across organisational security broadly.

Misconception 2: ‘ISO 28000 is the same as ISO 27001.’

Reality: Different scope. ISO 27001 covers information security specifically. ISO 28000 covers physical, supply chain, and operational security. Many organisations certify both — they are complementary.

Misconception 3: ‘ISO 28000:2022 requires complete system redesign vs 2007.’

Reality: The 2022 edition contains ‘almost no new requirements’ for organisations previously certified to ISO 28000:2007. Title and scope updates plus Harmonised Structure adoption are the main changes — most existing security practices map directly to 2022 edition.

Misconception 4: ‘Guardian Approved Scheme is the same as IAF MLA accredited.’

Reality: It is NOT the same. The Guardian Approved Scheme is Guardian’s own conformity assessment programme — credible, but NOT recognised under IAF MLA.

Misconception 5: ‘ISO 28000 is the same as ISPS Code or AEO.’

Reality: Different frameworks. ISPS Code is international ship/port security regulation. AEO (Authorised Economic Operator) is customs trusted trader programme. ISO 28000 is voluntary international standard providing systematic security management — supports compliance with ISPS, AEO, and other security frameworks but is distinct from them.

RISKS OF NON-CONFORMITY

Higher security incident exposure — without systematic management, security risks unmanaged
Tender exclusion — security-conscious customers increasingly require ISO 28000 evidence
Insurance premium increases — without security evidence, premiums higher
Customer audit burden — frequent second-party security audits without certification
Loss exposure — theft, fraud, sabotage losses without systematic prevention
Regulatory exposure — sectors expecting security discipline (port, aviation, energy)
Supply chain disruption — security incidents create operational continuity risks
Reputational damage — security failures damage brand significantly
Trade facilitation gaps — AEO and similar programmes require security evidence
Competitive disadvantage — peers with conformity gain reputational advantage

INTEGRATION WITH OTHER STANDARDS

Integration	Why & When
28000 + 27001	SeMS + InfoSec — Most natural pairing. Physical and information security complementary. Most security-conscious organisations certify both.
28000 + 22301	SeMS + Business Continuity — Strong pairing. Security incidents create business continuity disruptions. Combined approach provides resilience.
28000 + 9001	SeMS + Quality — Common foundation pairing.
28000 + 45001	SeMS + OH&S — Important for sectors with security-related personnel safety risks.
28000 + 31000	SeMS + Risk Management — ISO 31000 risk management framework supports SeMS approach.
28000 + AEO	SeMS + Customs Trusted Trader — Strong synergy. AEO and ISO 28000 share security philosophy.
28000 + ISPS Code	SeMS + Port/Ship Security Regulation — Complementary. ISO 28000 provides management system; ISPS provides regulatory framework.

Common pairing: ISO 28000 + ISO 27001 + ISO 22301 triple integration provides comprehensive security and resilience framework for major operators.

HOW TO CHOOSE THE RIGHT CONFORMITY ASSESSMENT BODY

Integration	Why & When
28000 + 27001	SeMS + InfoSec — Most natural pairing. Physical and information security complementary. Most security-conscious organisations certify both.
28000 + 22301	SeMS + Business Continuity — Strong pairing. Security incidents create business continuity disruptions. Combined approach provides resilience.
28000 + 9001	SeMS + Quality — Common foundation pairing.
28000 + 45001	SeMS + OH&S — Important for sectors with security-related personnel safety risks.
28000 + 31000	SeMS + Risk Management — ISO 31000 risk management framework supports SeMS approach.
28000 + AEO	SeMS + Customs Trusted Trader — Strong synergy. AEO and ISO 28000 share security philosophy.
28000 + ISPS Code	SeMS + Port/Ship Security Regulation — Complementary. ISO 28000 provides management system; ISPS provides regulatory framework.

Common pairing: ISO 28000 + ISO 27001 + ISO 22301 triple integration provides comprehensive security and resilience framework for major operators.

SURVEILLANCE & RE-ASSESSMENT

Assessment	Timing & Scope
Surveillance 1	Within 12 months of Stage 2. Mandatory: management review, internal audit, security performance review, security incident review, corrective actions.
Surveillance 2	Within 24 months of Stage 2. Same scope, different operations sample.
Re-Assessment	Before 3-year anniversary. Re-evaluation of full SeMS.

Special assessments triggered by: significant scope change, major site addition, certificate transfer, material security incident.

USE OF GUARDIAN APPROVED SCHEME MARK

Conformity-assessed organisations may use the Guardian Approved Scheme Mark on documents, marketing, websites, tender submissions — subject to Guardian’s Use of Marks Policy.

Permitted: Letterhead, marketing materials, websites, tender submissions, security communications.

PROHIBITED: CRITICAL — Use that implies IAF MLA accredited certification, UAF/IAS/QS accreditation, or equivalence with accredited certification is STRICTLY PROHIBITED.

Full policy: → /use-of-marks/

COMPLAINTS & APPEALS

Guardian operates an independent complaints and appeals process for the Guardian Approved Scheme. Process aligned with ISO/IEC 17021-1:2015 principles.

Full process: → /complaints-appeals/

GET STARTED — CONTACT GUARDIAN

Ready to begin your ISO 28000 security management conformity assessment journey? Contact Guardian Middle East LLC for a no-obligation initial consultation.

Guardian Middle East LLC

QFC Licence 03870 · Doha, Qatar · Guardian Approved Scheme Administrator

→ /contact/

Frequently Asked Question

Q1. Is the Guardian Approved Scheme certificate equivalent to IAF MLA accredited certification?

No. The Guardian Approved Scheme provides credible conformity evidence following ISO/IEC 17021-1 principles, but it is NOT IAF MLA accredited.

Q2. What changed from ISO 28000:2007 to ISO 28000:2022?

Title changed (now 'Security and resilience — Security management systems'). Scope expanded from supply-chain-only to all organisational security. Harmonised Structure adopted. Eight security management principles added. Risk-based approach strengthened. Most operational requirements retained for continuity.

Q3. Has the transition to ISO 28000:2022 ended?

Yes. Three-year transition period from March 2022 publication ended March 2025. ISO 28000:2007 is fully withdrawn. ISO 28000:2022 is the only operative edition.

Q4. How does ISO 28000 differ from AEO and ISPS Code?

AEO is customs trusted trader programme. ISPS Code is regulatory framework for ship and port security. ISO 28000 is voluntary international standard providing systematic security management framework. Complementary; ISO 28000 supports AEO and ISPS compliance.

Q5. How much does Guardian Approved Scheme conformity assessment cost?

Guardian's indicative range is QAR 5,000–20,000 (Cluster B) for initial assessment, depending on operational scope and security threat exposure.

Q6. How long does ISO 28000 implementation take?

Typically 8-14 months. Security risk assessment requires specialist competence. Multi-site operations require careful coordination.

Q7. Does ISO 28000 cover cybersecurity?

Typically 8-14 months. Security risk assessment requires specialist competence. Multi-site operations require careful coordination

Q8. Will ISO 28000:2022 be replaced soon?

No. Recently published (March 2022). ISO/TC 292 systematic review will commence around 2027. Climate Amendment 1:2024 in effect. Edition is current and stable.

Q9. Is ISO 28000 referenced in Qatar regulatory frameworks?

Increasingly. Mwani Qatar port security expectations align with ISO 28000 principles. Customs procedures reference international security standards. Major customer security requirements increasingly cite ISO 28000.

Q10. What does Statement of Applicability cover?

Documentation of which security controls are implemented (and which are excluded with rationale). Similar concept to ISO/IEC 27001 SoA. Clause 6.1 requires SoA covering all security controls relevant to identified security risks.

ISO 28000:2022 Security Management System — Conformity Assessment in Qatar