ISO 28000 Certification in Portugal
Last reviewed: November 2026
ISO 28000 certification in Portugal is increasingly relevant because Portugal sits on one of Europe's key Atlantic trade gateways. The deep-water port of Sines, Leixões, Lisbon, Setúbal and Aveiro, together with road, rail and air freight, move large volumes of goods for exporters and importers, and every handover creates risk of theft, tampering, delay or infiltration.
Nathan ISO Consulting implements ISO 28000:2022 security and resilience management systems for Portuguese ports, terminals, forwarders, hauliers, warehouses and manufacturers. We combine remote development with on-site risk assessment and audit attendance across Lisbon, Porto, Braga, Aveiro, Setúbal and Sines.
Quick answer: ISO 28000:2022 is the international standard for security and resilience management in the supply chain. In Portugal, a single-site operator can usually be certified in three to six months, with certification body fees of roughly €3,500 to €8,000 over three years, before consulting.
Looking for ISO 28000 Certification in Portugal?
ISO 28000 at a Glance for Portuguese Businesses
| Item | Typical position in Portugal |
|---|---|
| Current edition | ISO 28000:2022 |
| Certificate validity | Three years, with annual surveillance audits |
| Typical timeline | 3 to 6 months for a single-site operator |
| Indicative certification body fees | €3,500 to €8,000 (small), €8,000 to €18,000 (medium) |
| Legal requirement | Voluntary; complements ISPS, customs and AEO requirements |
| Best fit | Ports, terminals, forwarders, hauliers, warehouses, exporters |
What Is ISO 28000?
ISO 28000:2022 specifies requirements for a security management system, including aspects relevant to supply chain security and resilience. It helps organisations identify threats, assess risk, implement controls and monitor performance across storage, transport, handling and information flow.
The 2022 edition adopted the Annex SL structure and replaced the 2007 edition, so it integrates with ISO 9001, ISO 14001, ISO 45001 and ISO 27001.
Why ISO 28000 Certification in Portugal Matters
Sines is Portugal's deep-water Atlantic port, handling containers, energy products and bulk cargo, while Leixões, Lisbon, Setúbal and Aveiro serve northern, central and industrial hinterlands. Terminal operators, shipping lines, forwarders and hauliers work within maritime security regimes and customer expectations. ISO 28000 links operational controls to documented risk assessment and review, which helps when shippers, insurers and authorities audit.
The EU Authorised Economic Operator programme, administered in Portugal by the customs authority, grants trusted traders simplified procedures and fewer checks. Applicants must show compliance history, record keeping and security and safety standards. ISO 28000 evidence supports the security part of an application, although AEO status requires its own customs assessment.
Portuguese exporters of machinery, electronics, pharmaceuticals, wine, food and components sell into retailers and manufacturers that audit supply chain security. Certified systems help satisfy those requirements and reduce repeated customer audits.
Cargo theft, tampering and fraud, combined with cyber risks affecting port and logistics systems, drive demand for integrated security management. ISO 28000 combines naturally with ISO 27001 for information security and ISO 22301 for continuity.
IPAC is Portugal's national accreditation body, and buyers expect certificates from certification bodies accredited for ISO 28000 under recognised arrangements, with a scope matching your operation.
Which Portuguese Organisations Need ISO 28000
The Business Benefits
How to Get ISO 28000 Certified in Portugal: Step by Step
| Step | What Happens |
|---|---|
| Step 1: Gap Analysis | We assess current security practice against ISO 28000:2022 and port, customs and customer requirements. |
| Step 2: Scope and Supply Chain Mapping | We define activities, sites and routes in scope, and map the flow of cargo, vehicles, people and information. |
| Step 3: Security Risk Assessment | We assess threats such as theft, tampering, unauthorised access, smuggling, insider threats and cyber intrusion, and rate vulnerabilities and consequences. |
| Step 4: Policy, Objectives and Roles | We establish the security policy, measurable objectives and clear responsibilities. |
| Step 5: Physical and Access Controls | We design controls for perimeters, gates, CCTV, seals, key control, visitor management and driver verification. |
| Step 6: Cargo and Conveyance Integrity | We define sealing, inspection, tracking and handover procedures for containers, trailers and vehicles. |
| Step 7: Personnel and Supplier Security | We set screening, training and contractual security requirements for staff, drivers and subcontractors. |
| Step 8: Incident Response and Resilience | We prepare response plans for theft, tampering, fire and disruption, and rehearse them. |
| Step 9: Internal Audit and Management Review | We train internal auditors, run a full audit cycle, investigate incidents and facilitate a management review. |
| Step 10: Certification Audit Support and Surveillance | We help select an IPAC-accredited certification body, attend Stage 1 and Stage 2, close findings and support surveillance audits. |
ISO 28000 Certification Cost in Portugal
The bands below are indicative certification body fees for ISO 28000 certification in Portugal across the three-year cycle, in euros, excluding consulting and VAT.
Audit time depends on headcount, sites and route complexity. Integrated audits with ISO 9001 and ISO 45001 reduce total audit days.
How Long Does ISO 28000 Certification Take?
Typically three to six months for a single-site operator with reasonable existing records, and five to nine months for multi-site or network operators. A completed risk assessment, incident drill, internal audit and management review must be evidenced before the certification audit.
Common Implementation Challenges in Portugal
Why Choose Nathan ISO Consulting
We build security systems around how cargo and people actually move through your sites and routes. Risk assessments reflect Portuguese port, road and rail conditions, controls are proportionate to threat, and records prove checks are done. ISO 28000 certification in Portugal should reduce losses, support AEO and strengthen bids. Fixed scope and fee, full audit attendance and continuing support. Nathan ISO Consulting is a consultancy, not a certification body, and does not provide legal or customs advice.
Where We Deliver ISO 28000 in Portugal
Related Services
See also: ISO 9001 quality management certification Portugal, ISO 45001 occupational health and safety Portugal, ISO 27001 information security Portugal, ISO 22000 food safety Portugal and IATF 16949 automotive Portugal.
Request a Free ISO 28000 Scoping Call
For ISO 28000 certification in Portugal, tell us your sites, routes and cargo types, and we will confirm the likely scope, timeline and certification body options within one working day.
Ready to start your ISO 28000 certification journey?
Sources and References
Frequently Asked Questions
No. ISO 28000 is voluntary. Maritime security rules, customs requirements and customer conditions still apply independently, but a certified system helps document how those obligations are managed and wins business from shippers and insurers that ask for security evidence.
Certification body fees typically fall around €3,500 to €8,000 over three years for small single-site operators and €8,000 to €18,000 for medium or multi-site ones, before consulting and VAT. Headcount, sites and route complexity determine audit time.
Typically three to six months for a single-site operator and five to nine months for multi-site or network operators. Risk assessment, incident drills, internal audit and management review must be evidenced before the certification audit is scheduled.
The 2022 edition adopted the Annex SL structure, aligned terminology with other ISO management standards and emphasised security and resilience. The older 2007 edition is no longer used for new certification, so projects should be built on the 2022 requirements.
No. AEO status is granted by the customs authority after its own assessment. ISO 28000 documentation supports the security and safety criteria and evidences systematic risk management, but customs decide whether to authorise the applicant.
No. The ISPS Code is a maritime security regime applying to ships and port facilities. ISO 28000 is a voluntary management system that can include those obligations, adding risk assessment, monitoring and continual improvement across the wider supply chain.
Yes. Forwarders, hauliers and warehouses certify regularly, and customers often prefer certified partners for high-value cargo. The scope should describe the services and sites accurately, including any subcontracted transport that you control. Customers frequently list certification in tenders.
It can support negotiations. Cargo insurers look favourably on documented risk assessment and controls, though premiums depend on loss history, cargo, routes and underwriter policy. Certification is evidence, not a guaranteed discount. Share loss history and controls with your broker.
Yes. All follow the Annex SL structure, so one document control system, audit programme and management review can serve several standards. Integrated audits usually reduce total audit days and administration for logistics operators. Auditors can plan one visit.
Through supplier and personnel controls: screening, contractual security obligations, vehicle checks, tracking and incident reporting. Auditors test whether subcontractors are held to the same standards as employees where they affect cargo security. Contracts should state security duties clearly.
Yes. A small operator can implement a compact system proportionate to its fleet and routes. Many smaller companies certify to be accepted by pharmaceutical, retail and exporter customers, and records can be kept simple and practical.
Evidence that threats are assessed, controls are applied and incidents are learned from. Auditors inspect gates, seals, storage and vehicles, review logs and drills, and interview guards, drivers and managers to confirm that practice matches procedures.
Certificates last three years, with annual surveillance audits and a recertification audit at the end of the cycle. Internal audits, drills and management reviews must continue throughout to keep the system credible between external visits.
Yes. Procedures, drills and training can be prepared in Portuguese, English or both, depending on staff and customer needs. Practical, visual materials usually work best for guards, drivers and warehouse teams, and we tailor them accordingly.
Largely yes for risk assessment, documentation, training and reviews. Site walk-throughs, gate and cargo checks, and certification audits benefit from physical presence, which we arrange at Portuguese ports, depots and terminals when required. Hybrid delivery is typical.
Nathan ISO Consulting is headquartered in Dubai and does not maintain a Portuguese office. We deliver through remote engagement and scheduled on-site visits. Workshops and documentation run online, while verification and audits are attended in person.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving