With the Gulf positioned as one of the world’s great trade and logistics crossroads, security in the supply chain is a commercial necessity. ISO 28000:2022 gives ports, carriers, forwarders and manufacturers a certifiable system to prevent theft, tampering, smuggling and disruption.
In brief: Looking for ISO 28000 certification in the UAE? ISO 28000:2022 specifies requirements for a security management system covering physical, personnel, information and process security across the supply chain. Nathan ISO Consulting prepares logistics, port, aviation, manufacturing and trading organisations in the UAE and Saudi Arabia for independent certification and customs trust programmes.
In plain English: ISO 28000 helps you protect goods, people and information as they move through your supply chain. It covers theft, tampering and other security risks. An independent body can certify it, and Nathan helps you prepare.
Regulatory and standards information on this page was last checked in October 2026 against the official sources listed at the end.
ISO 28000 at a glance
| Item | Detail |
|---|---|
| Standard and edition | ISO 28000:2022 — supply chain security management system |
| What you obtain | Auditable management-system certificate |
| Who issues it | Independent, accredited certification body |
| Voluntary or mandatory | Voluntary; customs, port and aviation security laws apply separately |
| Nathan's role | Advisory only for ISO 28000: gap analysis, implementation support, training and audit readiness. Nathan does not certify or accredit. |
What is ISO 28000?
ISO 28000 is the international standard for security management systems in the supply chain. The 2022 edition replaced the 2007 version and now follows the harmonised ISO management-system structure, making it much easier to combine with ISO 9001, ISO 14001, ISO 45001 and ISO 27001.
The standard takes a risk-based view. Organisations determine their security context, identify threats — theft, pilferage, counterfeiting, tampering, unauthorised access, smuggling, terrorism, cyber-physical attacks — assess risk to people, cargo, facilities and information, and implement proportionate controls. It also requires security objectives, resources, competence, communication, operational planning, emergency preparedness and continual improvement.
ISO 28000 is not a replacement for mandatory regimes such as the ISPS Code for ports and ships, civil-aviation security programmes or customs requirements. It sits alongside them, giving a management framework that integrates their requirements and shows consistent control.
Certification is voluntary and issued by independent certification bodies after audit.
Why ISO 28000 certification in the UAE matters for UAE, Saudi Arabia and GCC organisations
The UAE and Saudi Arabia are building global logistics positions. Jebel Ali, Khalifa Port, Jeddah Islamic Port, King Abdullah Port and the Dammam ports handle enormous volumes of containers and bulk, while air-cargo hubs in Dubai, Abu Dhabi, Riyadh and Jeddah are growing fast. High-value, time-sensitive cargo requires trusted partners, and customers look for evidence that security is managed systematically.
Security incidents carry heavy costs: lost cargo, delays, contraband findings, regulatory action and reputational damage. Customs administrations also grant benefits — faster clearance and reduced inspections — to operators that can demonstrate security and compliance controls, as under Authorised Economic Operator programmes. ISO 28000 gives a structure for building those controls and the evidence base for such programmes.
Regulatory and legal compliance — United Arab Emirates
UAE supply-chain security is governed by customs, port, aviation and law-enforcement frameworks. This table highlights main points of alignment.
| Authority / law | Relevance to ISO 28000 |
|---|---|
| Dubai Customs and Abu Dhabi Customs — AEO programmes | Authorised Economic Operator schemes recognise secure, compliant traders; a documented security system supports applications. |
| Federal Authority for Identity, Citizenship, Customs and Port Security (ICP) | Federal body with customs and port-security responsibilities that influence border and port procedures. |
| ISPS Code implementation at UAE ports | Mandatory security plans for port facilities and ships; ISO 28000 helps integrate them into wider supply-chain security. |
| GCAA and aviation security programmes | Set civil-aviation security requirements, including cargo security, which logistics partners must satisfy. |
| Free-zone authorities (e.g. JAFZA, DMCC, KEZAD) | Set premises, access and inspection conditions for operators inside zones. |
| Federal Decree-Law No. 31 of 2021 (Penal Code) | Criminalises smuggling, forgery and related offences that security controls aim to prevent. |
Regulatory and legal compliance — Saudi Arabia
Saudi Arabia is developing logistics hubs as part of Vision 2030 and the National Transport and Logistics Strategy.
| Authority / law | Relevance to ISO 28000 |
|---|---|
| ZATCA — customs and AEO programme | Customs administration that supports trusted-trader initiatives and risk-based clearance. |
| Mawani (Saudi Ports Authority) | Regulates ports and oversees port security and operations. |
| GACA and aviation cargo security | Set aviation-security rules for airports and air cargo. |
| Transport General Authority (TGA) | Regulates road, rail and maritime transport, including logistics activities. |
| Ministry of Interior and border security agencies | Border and security authorities whose requirements influence cargo handling and inspection. |
| Special Economic Zones and logistics parks | New zones set premises and operational standards for tenants. |
The GCC’s customs union and shared transport corridors mean security incidents in one state affect others. Regional trade through Oman, Qatar, Bahrain and Kuwait also relies on common practices. International shippers apply the same security expectations across all Gulf routes, so a consistent ISO 28000 system supports multi-country operations.
Industries that benefit from ISO 28000
| Industry | How it applies |
|---|---|
| Ports, terminals and free zones | Access control, cargo integrity, seal management and incident response. |
| Freight forwarders and 3PL providers | Trusted partners for high-value or regulated goods. |
| Shipping lines and carriers | Vessel, container and crew security alongside ISPS compliance. |
| Air cargo, airports and ground handlers | Screening, known-consignor schemes and handling security. |
| Manufacturers and exporters | Supply-chain security for outbound goods and incoming materials. |
| Pharmaceutical and high-value goods | Anti-theft, anti-counterfeiting and cold-chain integrity. |
| Retail, e-commerce and last-mile | Warehouse security, personnel screening and delivery control. |
Where we support ISO 28000 projects — Dubai, Abu Dhabi, Saudi Arabia and beyond
| Location | What is distinctive here |
|---|---|
| Dubai — Jebel Ali, JAFZA, DWC and Dubai Airport Free Zone | The region’s largest integrated logistics hub across sea, air and road. |
| Abu Dhabi — Khalifa Port, KEZAD and Zayed Port | Port-centred industrial and logistics clusters. |
| Sharjah — Hamriyah and Sharjah Airport International Free Zone | Trading, industrial and cargo operations. |
| Fujairah and Khor Fakkan | East-coast ports offering alternative routes and bunkering. |
| Jeddah Islamic Port and King Abdullah Port | Red Sea gateways for imports and transhipment. |
| Dammam, Jubail and Ras Al Khair | Gulf-coast ports serving industry and energy. |
| Riyadh Dry Port and logistics parks | Inland logistics and customs hubs. |
What ISO 28000 requires — in practical terms
The following summarises the main requirements of ISO 28000:2022.
| Requirement area | What it means in practice |
|---|---|
| Context and interested parties | Understand security threats, legal requirements and stakeholder expectations. |
| Leadership and policy | Set a security policy and assign responsibilities and authority. |
| Security risk assessment | Identify assets, threats, vulnerabilities and consequences; decide on treatments. |
| Security objectives and planning | Set measurable objectives and plan how to achieve them. |
| Resources and competence | Provide people, technology and training, including vetting and awareness. |
| Operational planning and control | Control access, cargo handling, documentation, subcontractors and information. |
| Emergency preparedness | Plan, test and review responses to incidents and disruptions. |
| Evaluation and improvement | Monitor, audit, review and correct weaknesses. |
Our ISO 28000 roadmap
Step 1 — Scoping and threat context. We confirm your sites, routes, cargo types and customers, and the legal and customer security requirements involved.
Step 2 — Security risk assessment. We assess threats and vulnerabilities across facilities, vehicles, personnel and information systems.
Step 3 — Gap analysis. We compare current controls with ISO 28000 and with AEO or customer security criteria.
Step 4 — Procedure and control design. We create practical access-control, seal, screening, vetting, incident and continuity procedures.
Step 5 — Implementation, training and drills. We train staff, test emergency plans and refine controls.
Step 6 — Internal audit and management review. We run an internal audit and review before the certification audit.
Step 7 — Certification audit. We support selection of an accredited certification body and audit preparation.
Common pitfalls we help you avoid
Documents and records an auditor expects
Typical evidence includes:
Auditors also walk the site. They look at gates, lighting, fencing, CCTV, cargo handling areas and the way staff actually behave, because a security system is demonstrated in practice, not only in documents.
Timeline and cost drivers
Timelines depend on the number of sites, the complexity of cargo flows and existing controls. A single warehouse is quicker than a multi-site port-linked network.
Costs depend on the same factors and on the audit days the certification body sets. We give a fixed consulting quotation after scoping; certification body fees are quoted separately.
Common myths about ISO 28000
Myth: ISO 28000 is the same as ISPS. ISPS is a mandatory maritime security regime. ISO 28000 is a wider management system that can include ISPS requirements.
Myth: Security is a guard-force issue. Guards help, but the standard covers risk assessment, procedures, personnel vetting, information, cargo handling and incident response.
Myth: Certification guarantees AEO status. AEO is granted by customs. ISO 28000 provides supporting evidence of security controls.
How ISO 28000 fits with your other management systems
Security management links closely with ISO 9001 (process control), ISO 45001 (site safety), ISO 27001 (information) and ISO 22301 (continuity). A single risk register and audit programme can cover them all.
What to have ready before our first conversation
Bring site plans, a description of cargo flows and routes, existing security procedures and incident logs, ISPS or aviation security plans where relevant, customer security requirements and any AEO or customs correspondence.
How Nathan ISO Consulting delivers ISO 28000 certification in the UAE
We design controls that fit your sites, cargo and customers, and that security teams, operations and management can all follow.
Why choose Nathan ISO Consulting for ISO 28000 certification in the UAE? What we do differently
Our consultants bring more than ten years of ISO practice to UAE and Saudi organisations, including logistics and industrial sites.
You receive a written ISO 28000 scope, deliverables and fee before work begins, so your security budget is predictable.
The same experienced assessor reviews your gates, yards and routes in person, which makes the system realistic rather than theoretical.
We map ISO 28000 to ISPS, aviation security and customs expectations so you do not run parallel systems.
We support clients at Dubai, Abu Dhabi, Sharjah and Fujairah, and at Jeddah, Dammam, Jubail, Yanbu and Riyadh logistics hubs.
Our role, stated plainly: Nathan ISO Consulting is an advisory firm. We design and prepare the system; independent certification bodies issue certificates, and customs or port authorities decide on programme status.
Related services
ISO 28000 FAQs — UAE, Saudi Arabia and GCC
ISO 28000 is the international standard for security management systems in the supply chain. It helps organisations identify and control security risks to people, cargo, facilities and information, with processes for risk assessment, operational control, emergency response and continual improvement.
The 2022 edition adopts the harmonised ISO structure and updates requirements on risk, objectives and operational control. Organisations certified to the earlier version must follow the transition arrangements of their certification body, so confirm timing and audit expectations with them early.
No. Mandatory requirements come from customs, port, aviation and security laws. ISO 28000 is voluntary but can help integrate those requirements into one management system and give customers independent evidence that security risks are identified and controlled.
ISPS is a mandatory maritime security regime for ships and port facilities. ISO 28000 is a management-system standard that can incorporate ISPS requirements into wider supply-chain security, covering inland transport, warehousing and information handling beyond the port gate.
No. AEO status is granted by customs authorities after their own assessment. ISO 28000 certification can support an application by demonstrating documented security controls, but it does not guarantee approval and does not replace the customs authority's criteria.
Ports, terminals, logistics providers, carriers, manufacturers, exporters and any organisation that must protect goods and information in transit or storage should consider it, especially where customers, insurers or customs authorities ask for evidence of security controls.
Yes. The system is proportionate. Smaller operators need simpler procedures but still show risk assessment, operating controls, incident response and review. Certification can help a small forwarder or warehouse qualify for contracts that ask for security assurance.
It addresses theft, tampering, smuggling, counterfeiting, unauthorised access, insider threats, terrorism and interruption of operations, among others. You identify the threats relevant to your sites and routes, assess them and apply proportionate controls.
Control insider threats through personnel screening, access rights, supervision, awareness and reporting channels. We help you design proportionate measures that fit local employment practice and respect privacy and labour law, with legal advice where needed.
It covers security of information as it relates to supply-chain operations, such as shipping documents, manifests and access records. Many organisations also hold ISO 27001 for a full information-security system, and the two can be integrated.
Timing depends on the number of sites, routes and starting maturity. A company with established security procedures moves faster. We provide a realistic schedule after a gap analysis rather than a generic estimate.
ISO 28000 consulting fees depend on size, sites and complexity. We provide a fixed quotation after scoping, while certification body fees are quoted separately by the body you choose, so consultancy and audit costs stay transparent from the start.
Yes. ISO 28000, ISO 9001 and ISO 45001 use the same high-level structure and can be combined into one system, sharing document control, internal audits, management review and corrective action, which reduces duplication.
We assess security as part of risk assessment and gap analysis, looking at procedures, access control and physical arrangements. We are not a guarding or security-installation company, so specialist surveys and equipment come from qualified providers.
No. Nathan ISO Consulting is an advisory firm and does not certify or accredit. Independent certification bodies issue certificates after their own audit, which keeps the result impartial and credible with customers, customs authorities and insurers.
Call or WhatsApp us, or email your sites, cargo types and customers. We will arrange a scoping call, confirm the scope and send a fixed-fee proposal covering the gap analysis and the work needed to prepare for certification.
Start your project
Ready to start ISO 28000 certification in the UAE? Customers and customs authorities reward supply chains they can trust. Tell us about your sites, routes and cargo, and we will propose a practical, fixed-fee route to a certifiable ISO 28000 security system.
Call or WhatsApp: +971 58 579 0714 · Email: info@nathanisoconsulting.com · Web: www.nathanisoconsulting.com
Sources and further reading
0
Projects
0
Services
0
Clients Serving
0
Countries Serving