ISO 28000 Mandatory Documents: The Complete Clause-by-Clause List

ISO 28000 mandatory documents are the documented information ISO 28000:2022 requires a security management system to maintain and the records it requires it to retain, and the list is short: the standard follows the harmonized structure’s rule of naming a small set and leaving the rest to the organisation under clause 7.5. There is no security manual in it, no prescribed procedure format and no control catalogue. What it does name divides into the documents that describe the system — scope, security policy, objectives, the processes and activities identified under 8.2 — and the records that prove it operates: the risk assessment and treatment under 8.3, the controls under 8.4, the procedures under 8.5, the security plans under 8.6, competence, monitoring results, audits, management review and corrective action. This guide lists the ISO 28000 mandatory documents clause by clause, explains what each has to contain to survive a certification audit or a customs validation, separates the security-specific documents from the shared core, and names the second tier that no clause requires and every auditor asks for.

How ISO 28000 uses the term documented information

ISO 28000:2022 uses the harmonized structure’s single term, documented information, for documents and records alike; where the text says maintain, it means a living controlled document, and where it says retain, it means a record kept as evidence. Clause 7.5 requires the documented information the standard specifies plus whatever the organisation determines is necessary for the effectiveness of the security management system — and for a security system that second half is large, because clause 8.4 controls are only auditable through the procedures, logs and registers that show them operating. Our guide to ISO 28000:2022 covers the edition; this post covers what it makes you write down.

The ISO 28000 mandatory documents, clause by clause

The clause headings are the 2022 edition’s; the requirements for what to document under 8.2 to 8.6 are the clauses’ own, and the 2022 foreword records that recommendations were added in clause 8 “for better consistency with ISO 22301”, which is why the sequence — identify, assess, control, procedure, plan — mirrors the continuity standard. Confirm wording against your copy before building the register. Our guide to ISO 22301 mandatory documents shows the sister list.

The security-specific ISO 28000 mandatory documents

1. The process and activity register (8.2). The document most systems skip and the reason so many protect an idealised operation. It lists what is actually done — receiving, staging, sealing, subcontracted legs, returns, night shifts — and where security applies. Auditors walk it against the yard.
2. The risk assessment and treatment (8.3). The load-bearing document. Threats with intent, vulnerabilities at handovers, consequences including customs status, scores, treatments, residual risk accepted by name. Our guide to the supply chain security risk assessment covers the method.
3. The control register (8.4). Each control with owner, verification method and the risk row it treats. A control without a risk is a cost; a risk without a control is a finding.
4. The procedures (8.5). Seal control including ISO 17712 high-security seals, seal verification and audits; conveyance and container inspection; cargo staging and release; access control, visitor identification and logs; business partner screening; incident reporting and escalation; cybersecurity. These are also the documents a C-TPAT validator or AEO auditor reads, which is why the register should cross-reference their criteria.
5. The security plans (8.6). Not a control list: a plan is what a supervisor follows when a seal is broken, a trailer is missing or an unauthorised person is on site.

Beyond the ISO 28000 mandatory documents: what auditors still expect

Building the documented-information register

1. One row per clause requirement with document name, owner, location, review date, retention period.
2. Mark maintain versus retain so version control applies to the first and retention to the second.
3. Add the organisation’s own documented information under 7.5: the procedures, checklists, logs and registers above.
4. Add a customs column — the C-TPAT criterion or AEO requirement each document evidences — so one register serves the certification audit and the validation. Our guide to ISO 28000 vs C-TPAT maps the overlap.
5. Retire anything citing ISO 28000:2007, which was retitled, restructured and withdrawn in 2022.

Frequently asked questions

How many ISO 28000 mandatory documents are there?
Fifteen clause-level requirements in the table above: the maintained documents (scope, policy, objectives, processes and activities, risk assessment, controls, procedures, security plans, document control) and the retained records (competence, monitoring, audit, review, corrective action). The register, not the count, is what the audit tests.

Does ISO 28000 require a security manual?
No. Clause 7.5 requires the documented information the standard specifies plus whatever the organisation determines is necessary. A manual is optional.

Which documents are unique to ISO 28000?
The process and activity register (8.2), the security risk assessment and treatment (8.3), the control register (8.4), the security procedures (8.5) and the security plans (8.6). The rest is harmonized core text shared with ISO 9001, ISO 22301 and ISO 27001.

Do the same documents serve C-TPAT or AEO?
Largely. The procedures, risk assessment, partner screening records, seal and access logs and training records are what a CBP validator or customs auditor reads. Add a column to the register mapping each document to the criterion it evidences.

What if our documents cite ISO 28000:2007?
Rebuild against the 2022 text rather than renumbering. The standard was retitled, widened to security management generally and restructured on the harmonized structure; old clause references no longer map.

Where this leaves you

Build the register from the fifteen clause requirements, mark each maintained or retained, and put the effort into the five security-specific documents — processes and activities, risk assessment, controls, procedures, plans — because that is where the ISO 28000 mandatory documents differ from every other management system and where the certification auditor and the customs validator will both look.

References

• ISO 28000:2022 — Security and resilience — Security management systems — Requirements — Second edition, March 2022, with Amd 1:2024; clauses 7.5 and 8.2–8.6.
• ISO 28001:2007 — Best practices for implementing supply chain security, assessments and plans — Guidance on the assessment and plan documents.

More on supply chain security

• ISO 28000 mandatory documents — you are here
• ISO 28000:2022 explained
• Supply chain security risk assessment
• ISO 28000 certification cost
• ISO 28000 vs C-TPAT
• ISO 22301 mandatory documents

Every document in the register — SMS manual and policy, scope, objectives, process and activity register, risk assessment and treatment workbook, control register, the procedure set and the security plan templates — is drafted in the ISO 28000 Supply Chain Security Toolkit (29 templates), or start with the free templates.