ISO 28000, Supply Chain Security Management, is a management system standard published by the International Organization for Standardization, specifying how an organization identifies, assesses, and controls security risk. Unlike TAPA, already covered on this site, ISO 28000 does not prescribe a specific lock type or GPS reporting interval. It certifies the management system behind those decisions instead, and it is explicitly designed to complement frameworks such as TAPA and the WCO SAFE Framework rather than compete with them.
What ISO 28000 actually certifies
ISO 28000 is built on the same logic as other ISO management system standards, applying that structure to security specifically.
- A documented process for identifying security risk, across financing, manufacturing, information management, transportation, storage, and warehousing.
- Applicable to any type or size of organization, commercial, government, or non-profit, not limited to any single industry or sector.
- Compatible with ISO 9001 and other management systems, allowing security to be integrated into an organization’s existing quality and operational frameworks rather than run as a separate program.
A brief history worth knowing
ISO 28000 was originally developed in 2007 under the ISO committee responsible for ships and maritime technology. Responsibility moved to the dedicated Security and Resilience committee in 2015, and a substantial revision published in 2022 broadened the standard beyond supply chain alone, extending it to any aspect of an organization’s security.
Why ISO 28000 and TAPA are not competing standards
These two frequently get compared as if a company must choose one, when in practice they answer different questions entirely.
- ISO 28000 asks whether an organization has a real process for identifying and managing security risk in the first place.
- TAPA specifies exactly what that process has to require for road transport and facility security, down to lock type and tracking frequency, already covered in detail on this site.
- A company can hold both certifications at once, using ISO 28000 as the overarching management framework and TAPA as the specific technical standard it applies within that framework.
Self-declaration vs. third-party certification
ISO 28000 offers a flexibility TAPA’s audit-based model does not. An organization can seek accredited third-party certification, or make a self-determined declaration of conformance, depending on how much external verification a given relationship or contract actually requires.
Why this matters beyond security itself
Organizations that implement ISO 28000 report benefits beyond risk reduction, including facilitated trade and expedited movement of goods across borders, an outcome consistent with the trade facilitation goals already discussed for the WCO SAFE Framework on this site.
Where onboard courier fits into an ISO 28000 risk assessment
ISO 28000 asks an organization to identify its actual security risks and apply appropriate controls, not adopt a one-size-fits-all checklist. For a genuinely high-risk shipment, an onboard courier is itself a concrete control: continuous personal custody, with no unattended handoff, is exactly the kind of measure a properly conducted ISO 28000 risk assessment would identify as appropriate for the highest-risk cargo in a supply chain.
How OBC ONE supports a security-conscious mission
A typical mission runs through six steps with OBC ONE, most of which overlap to save time.
- Brief and quote. You share the shipment, its risk profile, origin, destination, and the deadline. OBC ONE returns an all-in quote in under 15 minutes.
- Courier assignment. A vetted courier near the origin is dispatched immediately.
- Secure pickup. The shipment is collected directly, verified before departure.
- Personal custody in transit. The courier carries the shipment in the cabin, staying with it through every connection, with no unattended stop.
- Direct delivery. Handover happens with the named recipient, not a facility or depot.
- Proof of delivery. Timestamped confirmation for your records.
Why freight forwarders trust OBC ONE for their highest-risk shipments
Choosing the right partner for a security-sensitive shipment starts with the business model. Many specialty couriers sell directly to shippers, which puts them in competition with the forwarders who might otherwise use them. OBC ONE is built the opposite way: we work exclusively for and with freight forwarders and time-critical desks. We never approach your clients directly and never compete with you.
That partner model is backed by real operator experience. OBC ONE was founded by an onboard courier who personally flew roughly three million kilometers over six years, so the network understands exactly what a genuine security risk assessment should identify as the appropriate control. Forwarders use us because we deliver:
- An all-in quote in under 15 minutes, 24/7/365.
- 1,500+ vetted couriers positioned around major hubs worldwide.
- True door to door coverage, with import and export customs clearance and Importer of Record service in most markets.
- IATA certified dangerous goods capability for shipments that require it.
- One specialty, onboard courier and hand carry for time-critical missions, done at the highest standard.
How to choose a partner for a security-conscious shipment
- Genuine continuous custody, the kind of concrete control a real risk assessment identifies, not a general security claim.
- Fast, transparent quoting, ideally with a named dispatcher accountable for the mission.
- Real network density near major hubs, so the courier is not delayed by being flown in first.
- Vetted, background-checked couriers, not general freight handlers applied to a sensitive shipment.
- A forwarder-only model, so your partner never becomes a competitor for your clients.
Frequently asked questions
What is ISO 28000?
ISO 28000 is a management system standard specifying how an organization identifies, assesses, and controls security risk, applicable to any type or size of organization regardless of industry.
Is ISO 28000 the same as TAPA?
No. ISO 28000 certifies the management system and risk assessment process behind an organization’s security decisions. TAPA specifies exact technical requirements, such as lock types and GPS reporting intervals, for road transport and facility security specifically.
Can a company hold both ISO 28000 and TAPA certification?
Yes. The two are designed to complement each other, with ISO 28000 providing the overarching management framework and TAPA supplying specific technical standards applied within it.
Does ISO 28000 require third-party certification?
Not necessarily. An organization can pursue accredited third-party certification or make a self-determined declaration of conformance, depending on what external verification the relationship or contract requires.
Does ISO 28000 only apply to transportation companies?
No. Since its 2022 revision, ISO 28000 applies to any aspect of an organization’s security, not just supply chain activities, and it is used across commercial, government, and non-profit organizations alike.
Do you sell directly to shippers or buyers?
No. OBC ONE works exclusively with and for freight forwarders and time-critical desks. We act as a white label partner and never approach our clients’ customers directly.
Get the control a real risk assessment would recommend
If you are a freight forwarder handling a shipment your own security risk assessment flags as high-risk, OBC ONE gives you a straight answer, 24/7, worldwide and never a competitor. Contact our team for an all-in quote in under 15 minutes, or explore more time-critical logistics insights.
