What it covers. An international standard specifying requirements for a security management system, originally developed for supply chain security. The 2022 edition broadened it to cover security risks across an organisation's operations, including those affecting its supply chain. It can be certified and integrated with other management system standards.
In practice. Applying it well means assessing security risks such as theft, sabotage, smuggling and disruption, setting objectives and controls, and managing them within the familiar management system structure. It is commonly used in logistics, ports and manufacturing. Evidence includes risk assessments, security plans, incident records and audits.
Common gaps. Common gaps are focusing only on physical security, and weak integration with information security and business continuity. Security requirements for subcontractors and logistics partners are also frequently left undefined.