Keep your methodology
Your scales, your risk matrix, your questionnaires and your own controls. You start with what you already have.
ISO 28000 software for a supply chain that's secure end to end
Suppliers, facilities, transport and incidents in one place, with the risk of every link in plain sight. From the first assessment to the ISO 28000 certificate.
4.4 · 105 reviews on G2
2,000+ companies trust GlobalSuite®
Managing ISO 28000 in GlobalSuite®
What the standard asks for, what you've already done and what's still missing, all on one platform. Screens show sample data.
Each ISO 28000 clause with its requirements, their status and what's left before the stage 2 audit.
Each ISO 28000 clause with its requirements, their status and what's left before the stage 2 audit.
Each supplier in the chain with its security rating and its importance, so you know who to act on first.
Cargo theft, tampered seals, unauthorised access or cyberattacks: each incident with its status, its priority and the supplier involved.
Pick a threat at the facility and the AI suggests ISO 28000 security controls to reduce it. Add them to the plan and the residual risk is recalculated.
AI agent
Add to planDismiss
✓ 2 controls added to the treatment planAI technology can make mistakes.The security questionnaire each supplier fills in: threats, likelihood and impact, with the result straight away.
The dashboard for management and the security committee: compliance by standard, by clause and by control status.
Automate the compliance process
You set up the workflow once and GlobalSuite® repeats it: it requests, reminds, collects and updates. Your team only steps in when there's a decision to make.
- Assessment campaignsQuestionnaires sent to each control owner, with reminders until they reply.
- Expiring suppliersWhen a critical supplier's questionnaire or audit expires, it is relaunched automatically and purchasing gets notified.
- Approval workflowsPolicies, accepted risks and exceptions, each with its sign-off and date.
- Everything recalculatesClosing an action updates the risk of each link, each supplier and the indicators.
What you save when you drop spreadsheets
The reports are already done
Risk by link, supplier status and the management report, up to date and ready to download.
AI does the first pass
Before each audit, the agent goes through suppliers and facilities, finds what hasn't been assessed or has no plan, and prepares the plan. You just approve it.
Your ISO 28000 work counts towards other standards
Supplier assessments, the risks of each link and continuity plans are the foundation of ISO 22301, ISO 27001 and NIS2. In GlobalSuite® you do them once and they count for all of them.
Our own estimate of how much of each standard is covered: each requirement counts in full if it is covered the same way and half if only partly. Each standard adds its own requirements.
ISO 22301
ISO 27001
NIS2
Connected to the tools you already use
GlobalSuite® connects to your ecosystem via API. Data comes in on its own and nobody has to copy it by hand.
- Suppliers and ordersfrom your ERP or purchasing system
- Users and accessfrom Active Directory
- Plan actionsin your ticketing tool
- Supply chain indicatorsin Power BI or your data lake
Active Directory
Identity
Ticketing
CMDB
Power BI
Monitoring
Vulnerabilities
Data lake
Power BI
Monitoring
Vulnerabilities
Data lake
GlobalSuite® GRC PlatformModules
ISO 28000 lives in the Third-party risk module
And the module is part of the GRC platform. Suppliers, their questionnaires and their risks are the same ones that continuity, security and compliance use, so nothing gets assessed twice.
If you're asked for NIS2 or ISO 22301 tomorrow, the supplier side is already in place.
Your goal: get ISO 28000 certified and stay certified
Your team leads the way. GlobalSuite® automates your management system and, if you need it, our consultants support you at whichever step you choose.
If you want help, our consultants are:Lead Auditor ISO 28000Third-party risk experts+2,000 projects
- Gap analysisYou know what's missing against ISO 28000 and where to start.
- ImplementationYou map the chain, assess suppliers and facilities and decide which measures apply.
- Management system automationEvidence, approvals, reminders and indicators run on their own in GlobalSuite®.
- AuditYou go into the internal audit and the certification audit with everything ready.
Your ISO 28000 certificateAnd every renewal, without starting from scratch.
What our customers have achieved
Rail transport · 14,000+ employees
As we rolled out risk management and compliance processes, and given the size of the company and the range of its activities, we needed software that would make risk management more effective and efficient.
Diego Molero AlonsoDirector of Internal Audit, Compliance and Business Risk · Renfe
- 5,000
- trains a day under its risk management system
- 100%
- of processes with an owner who keeps their risks up to date
Verified reviews on G2
Read all 105 reviewsIt reduces tool fragmentation and centralizes all evidence, documentation, controls, and assessments in one place.
From day one, the onboarding process was excellent, allowing us to understand the platform really fast, thanks to their top-notch support team. The UI is clean and intuitive, making it easy to use for everyone.
It is very easy to use, and when we have had a problem, the support people are very helpful. It is easy to implement.
Shall we look at it with your risks and your methodology?
Request a demo
Frequently asked questions about ISO 28000
Can't find your question? Tell us about your case and we'll answer it with your situation in mind.
Tell us about your caseWhat is ISO 28000?
The international standard for security management systems for the supply chain. Its 2022 version applies to any organisation that wants to protect its suppliers, facilities, transport and deliveries against theft, sabotage, fraud or cyberattacks.
Can it be certified?
Yes. Certification is issued by an accredited certification body after a two-stage audit. GlobalSuite Solutions doesn't certify: it helps you get your system ready and supports you through the audit.
Is it only for logistics companies?
No. It works for manufacturers, distributors, logistics providers and any company that depends on its supply chain. It applies to whichever part of the chain you choose.
How does it relate to Authorised Economic Operator (AEO) status?
They share many supply chain security controls. Keeping ISO 28000 up to date makes it much easier to gather the evidence customs asks for AEO status, although they are separate processes.
How are suppliers assessed?
With security questionnaires, audits of the most critical ones and a risk level for each. GlobalSuite® launches the campaigns, reminds anyone who hasn't replied and recalculates the risk with every answer.
Where does your
supply chain security stand?
Tell us what you need and we’ll show you how GlobalSuite® solves it.