ISO 28000 2007

Establish an effective security management system (SMS).

Define the scope of your security management system.

Authorize the establishment of a security management policy.

Document your organization's security management policy.

Implement your organization’s security management policy.

Maintain your organization’s security management policy.

Identify security threats and assess your risks.

• Define a methodology to identify your organization's
  supply chain security threats and assess its security risks.

• Establish procedures to identify threats and assess risks.

• Use your security risk assessment methods and
  procedures to identify threats and assess risks.

Identify security management control measures.

• Establish procedures to identify and implement
  supply chain security management control measures.

• Use your procedures to identify supply chain
  security management control measures.

• Use your procedures to implement your supply
  chain security management control measures.

Establish procedures to manage the legal, statutory, and
regulatory security requirements that you subscribe to.

Communicate information about all relevant, legal, statutory,
and regulatory security management requirements.

Establish security management objectives.

Document security management objectives.

Implement security management objectives.

Maintain security management objectives.

Establish security management targets.

Implement security management targets.

Maintain security management targets.

Establish security programs to achieve objectives and targets.

Implement your organization's security management programs.

Maintain your organization's security management programs.

Establish a security management structure of roles,
responsibilities, and authorities for your organization.

Communicate security management roles, responsibilities, and
authorities to those who must implement and maintain your SMS.

Demonstrate a commitment to the development, implementation,
and continual improvement of your organization's SMS.

Make sure that personnel responsible
for security are suitably qualified.

Establish procedures to make people who work
for you, or on your behalf, aware of your SMS.

Keep records of competence and training.

Establish procedures to ensure that pertinent
security information is communicated.

Establish and maintain a security management
documentation system for your organization.

Establish the security sensitivity of information
before you consider giving people access to it.

Establish procedures to control the documents,
data, and information required by ISO 28000.

Maintain your organization's SMS document,
data, and information control procedures.

Identify the security activities and operations
that your organization needs to carry out.

Carry out your security activities and
operations under specified conditions.

Consider your security threats and risks before you decide
to revise your current arrangements or implement new ones.

Prepare appropriate emergency preparedness plans
and procedures to deal with security threats, incidents,
breaches, and emergencies.

Prepare appropriate plans and procedures to
respond to security incidents and emergencies.

Prepare appropriate security recovery plans and procedures.

Establish procedures to monitor and measure security.

Use your procedures to monitor and measure security.

Maintain supply chain security management records.

Evaluate supply chain security management plans.

Evaluate supply chain security management procedures.

Evaluate supply chain security management capabilities.

Evaluate compliance with regulations and best practices.

Evaluate conformance with security policy and objectives.

Establish security response procedures.

Implement your security response procedures.

Maintain your security response procedures.

Establish your organization's security management records.

Establish procedures to control security management records.

Establish a security management audit program.

Establish security management audit procedures.

Review your SMS by examining inputs.

Assess the results of your management reviews.

Generate management review outputs.