ISO 28000 Certification in Rwanda
Last reviewed: November 2026
ISO 28000 certification in Rwanda is relevant because Rwanda is a landlocked exporter and importer that depends on long, multi-border supply chains. Goods reach Kigali by road from Mombasa and Dar es Salaam, cross borders at Rusumo, Gatuna, Rubavu and Rusizi, and leave by road and air. Every handover creates a chance for theft, tampering, delay or infiltration.
Nathan ISO Consulting implements ISO 28000:2022 security and resilience management systems for Rwandan freight operators, forwarders, warehouses, exporters and importers. We combine remote development with on-site risk assessment and audit attendance across Kigali, Musanze, Huye, Rubavu and Rusizi.
Quick answer: ISO 28000:2022 is the international standard for security and resilience management in the supply chain. In Rwanda, a single-site operator can usually be certified in four to seven months, with certification body fees of roughly US$3,500 to US$9,000 over three years, before consulting.
Looking for ISO 28000 Certification in Rwanda?
ISO 28000 at a Glance for Rwandan Businesses
| Item | Typical position in Rwanda |
|---|---|
| Current edition | ISO 28000:2022 |
| Certificate validity | Three years, with annual surveillance audits |
| Typical timeline | 4 to 7 months for a single-site operator |
| Indicative certification body fees | US$3,500 to US$9,000 (small), US$9,000 to US$18,000 (medium) |
| Legal requirement | Voluntary; complements customs, border and customer security requirements |
| Best fit | Freight forwarders, hauliers, warehouses, exporters, importers and cargo handlers |
What Is ISO 28000?
ISO 28000:2022 specifies requirements for a security management system, including aspects relevant to supply chain security and resilience. It helps organisations identify threats, assess risk, implement controls and monitor performance across storage, transport, handling and information flow.
The 2022 edition adopted the Annex SL structure and replaced the 2007 edition, so it integrates with ISO 9001, ISO 14001, ISO 45001 and ISO 27001.
Why ISO 28000 Certification in Rwanda Matters
Rwanda's imports and exports travel along the Northern Corridor through Kenya and Uganda and the Central Corridor through Tanzania, covering roughly a thousand kilometres or more each way. Cargo is exposed to theft, tampering, diversion and delay at depots, border posts and parking areas. ISO 28000 links route risk, driver controls and site security in one documented system.
Informal and formal cross-border trade with the Democratic Republic of Congo passes through Rubavu and Rusizi, and the Rusumo and Gatuna crossings link Rwanda to Tanzania and Uganda. Warehouse and transport operators handling goods at these points face smuggling, documentation and infiltration risks that structured security management helps control.
East African customs integration and electronic cargo tracking rely on accurate documentation, sealed loads and controlled routes. Trusted trader or authorised operator programmes, where available, are granted by the customs authority after its own assessment, but ISO 28000 documentation supports the security criteria.
Coffee, tea, minerals, horticulture and manufactured goods leave Rwanda for retailers, traders and refiners that audit chain-of-custody and security. Certified systems reduce repeated customer audits and demonstrate control of seals, storage and handover.
Perishable exports, courier traffic and new airport development in the Kigali region increase demand for secure handling and screening. Operators and ground handlers need documented security procedures and trained staff.
Which Rwandan Organisations Need ISO 28000
The Business Benefits
How to Get ISO 28000 Certified in Rwanda: Step by Step
| Step | What Happens |
|---|---|
| Step 1: Gap Analysis | We assess current security practice against ISO 28000:2022 and customer and border requirements. |
| Step 2: Scope and Supply Chain Mapping | We define activities, sites and routes in scope, and map the flow of cargo, vehicles, people and information. |
| Step 3: Security Risk Assessment | We assess threats such as theft, tampering, unauthorised access, smuggling, insider threats and cyber intrusion, and rate vulnerabilities and consequences. |
| Step 4: Policy, Objectives and Roles | We establish the security policy, measurable objectives and clear responsibilities. |
| Step 5: Physical and Access Controls | We design controls for perimeters, gates, CCTV, seals, key control, visitor management and driver verification. |
| Step 6: Cargo and Conveyance Integrity | We define sealing, inspection, tracking and handover procedures for containers, trailers and vehicles. |
| Step 7: Personnel and Supplier Security | We set screening, training and contractual security requirements for staff, drivers and subcontractors. |
| Step 8: Incident Response and Resilience | We prepare response plans for theft, tampering, fire and disruption, and rehearse them. |
| Step 9: Internal Audit and Management Review | We train internal auditors, run a full audit cycle, investigate incidents and facilitate a management review. |
| Step 10: Certification Audit Support | We help select an accredited certification body, attend Stage 1 and Stage 2, close findings and support surveillance audits. |
ISO 28000 Certification Cost in Rwanda
The bands below are indicative certification body fees for ISO 28000 certification in Rwanda across the three-year cycle, in US dollars, excluding consulting, local taxes and auditor travel. Always request written quotations.
Audit time depends on headcount, sites and route complexity. Auditor travel to Rwanda can influence quotations. Integrated audits with ISO 9001 and ISO 45001 reduce total audit days.
How Long Does ISO 28000 Certification Take?
Typically four to six months for a single-site operator with reasonable existing records, and six to nine months for multi-site or border-area operations. ISO 28000 certification in Rwanda needs a completed risk assessment, an incident drill, an internal audit and a management review before the certification audit.
Common Implementation Challenges in Rwanda
Why Choose Nathan ISO Consulting
We build security systems around how cargo and people actually move through your sites and corridors. Risk assessments reflect Rwandan trade routes, border conditions and subcontracted transport, controls are proportionate to threat, and records prove checks are done. ISO 28000 certification in Rwanda should reduce losses and strengthen bids. Fixed scope and fee, full audit attendance and continuing support. Nathan ISO Consulting is a consultancy, not a certification body, and does not provide legal or customs advice.
Where We Deliver ISO 28000 in Rwanda
Related Services
See also: ISO 9001 quality management Rwanda, ISO 45001 occupational health and safety Rwanda, ISO 27001 information security Rwanda, ISO 22000 food safety Rwanda and ISO 22301 business continuity Rwanda.
Request a Free ISO 28000 Scoping Call
For ISO 28000 certification in Rwanda, tell us your sites, routes and cargo types, and we will confirm the likely scope, timeline and certification body options within one working day.
Ready to start your ISO 28000 certification journey?
Sources and References
Frequently Asked Questions
No. ISO 28000 is voluntary. Customs, border and customer requirements still apply independently, but a certified system helps document how those obligations are managed and wins business from shippers and insurers that ask for security evidence.
Typically four to six months for a single-site operator, and six to nine months for multi-site or border-area operations. Risk assessment, incident drills, internal audit and management review must be evidenced before the certification audit.
The 2022 edition adopted the Annex SL structure, aligned terminology with other ISO management standards and emphasised security and resilience. The older 2007 edition is no longer used for new certification, so projects should follow 2022.
No. Trusted trader or authorised operator status, where offered, is granted by the customs authority after its own assessment. ISO 28000 documentation supports the security criteria, but customs decide whether to authorise an applicant. Auditors always ask to see evidence.
Yes. Forwarders, hauliers and warehouses certify regularly, and customers often prefer certified partners for high-value cargo. The scope should describe services and sites accurately, including any subcontracted transport that you control. Confirm details with your auditor.
Through supplier and personnel controls: screening, contractual security obligations, vehicle checks, tracking and incident reporting. Auditors test whether subcontractors are held to the same standards as employees where they affect cargo security. Keep the approach proportionate.
It can support negotiations. Cargo insurers look favourably on documented risk assessment and controls, though premiums depend on loss history, cargo, routes and underwriter policy. Certification is evidence, not a guaranteed discount. Evidence is what counts.
Yes. A small operator can implement a compact system proportionate to its fleet and routes. Many smaller companies certify to be accepted by exporters and distributors, and records can be kept simple and practical. Keep the approach proportionate.
Evidence that threats are assessed, controls are applied and incidents are learned from. Auditors inspect gates, seals, storage and vehicles, review logs and drills, and interview guards, drivers and managers to confirm practice matches procedures.
Certification body fees typically fall around US$3,500 to US$9,000 over the three-year cycle for small organisations and US$9,000 to US$18,000 for medium ones, before consulting. Auditor travel to Rwanda, headcount and sites all affect the quotation.
Certificates last three years, with annual surveillance audits and a recertification audit at the end of the cycle. Internal audits and management reviews must continue throughout the cycle so the system stays credible between external visits.
Yes. The standards share the Annex SL structure, so one document control system, internal audit programme and management review can serve several certificates. Integration reduces duplication and usually lowers total audit days and administration. Records make the difference.
Documents are prepared in English, which certification bodies and most customers use. Short operator-level summaries and training in Kinyarwanda or French can be arranged with your team, so staff understand procedures in the language they work in.
Largely yes. Gap analysis, documentation, training and management reviews run well online, which suits Kigali and upcountry teams alike. Site verification, internal audits and certification audits need physical presence, which we plan in blocks to limit travel and disruption.
Choose a body accredited for your scope under a recognised international arrangement, with auditors who know your sector. Ask your key customers which certificates they accept, then compare written quotations that include auditor travel to Rwanda.
Nathan ISO Consulting is headquartered in Dubai and does not maintain a Kigali office. We deliver through remote engagement and scheduled on-site visits. Workshops and documentation run online, while verification and audits are attended in person.
0
Projects
0
Services
0
Clients Serving
0
Countries Serving