[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso\u002F28000":3},{"item":4,"lessons":16,"controls":46,"related":65},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso","28000","ISO\u002FIEC 28000","ISO 28000: Security and resilience: Security management systems: Requirements",7,"International Organization for Standardization (ISO) and IEC","**What it covers.** An international standard specifying requirements for a security management system, originally developed for supply chain security. The 2022 edition broadened it to cover security risks across an organisation's operations, including those affecting its supply chain. It can be certified and integrated with other management system standards.\n\n**In practice.** Applying it well means assessing security risks such as theft, sabotage, smuggling and disruption, setting objectives and controls, and managing them within the familiar management system structure. It is commonly used in logistics, ports and manufacturing. Evidence includes risk assessments, security plans, incident records and audits.\n\n**Common gaps.** Common gaps are focusing only on physical security, and weak integration with information security and business continuity. Security requirements for subcontractors and logistics partners are also frequently left undefined.",null,"https:\u002F\u002Fwww.iso.org\u002Fisoiec-27001-information-security.html","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42],{"slug":19,"title":20,"published_at":21},"hardware-implants-in-resold-crypto-wallets-expose-supply-chain-risk","Hardware Implants in Resold Crypto Wallets Expose Supply Chain Risk","2026-10-12T14:22:09.278+00:00",{"slug":23,"title":24,"published_at":25},"violent-cargo-thefts-target-high-value-ai-hardware-shipments","Violent Cargo Thefts Target High-Value AI Hardware Shipments","2026-08-12T12:21:47.303+00:00",{"slug":27,"title":28,"published_at":29},"nation-states-create-fake-maritime-registries-to-evade-sanctions","Nation-States Create Fake Maritime Registries to Evade Sanctions","2026-06-12T19:20:45.947+00:00",{"slug":31,"title":32,"published_at":33},"maritime-shadow-fleet-uses-fake-websites-to-evade-sanctions","Maritime Shadow Fleet Uses Fake Websites to Evade Sanctions","2026-06-12T19:20:36.836+00:00",{"slug":35,"title":36,"published_at":37},"spyware-intermediaries-exploit-regulatory-gaps","Spyware Intermediaries Exploit Regulatory Gaps","2026-03-26T13:08:36.146+00:00",{"slug":39,"title":40,"published_at":41},"export-control-violations-expose-supply-chain-vulnerabilities","Export Control Violations Expose Supply Chain Vulnerabilities","2026-03-25T20:07:11.122+00:00",{"slug":43,"title":44,"published_at":45},"fcc-bans-foreign-routers-due-to-supply-chain-security-risks","FCC Bans Foreign Routers Due to Supply Chain Security Risks","2026-03-25T09:07:50.92+00:00",[47,52,57,61],{"slug":48,"name":49,"problem":50,"stories":51},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",2,{"slug":53,"name":54,"problem":55,"stories":56},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",1,{"slug":58,"name":59,"problem":60,"stories":56},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":62,"name":63,"problem":64,"stories":56},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[66,71,77,83,87,91,95,100],{"family":67,"item":68,"code":69,"title":70,"together":9},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":72,"item":73,"code":74,"title":75,"together":76},"cis","15","Control 15","Service Provider Management",4,{"family":78,"item":79,"code":80,"title":81,"together":82},"gdpr","28","Article 28","Processor",3,{"family":72,"item":84,"code":85,"title":86,"together":56},"3","Control 3","Data Protection",{"family":72,"item":88,"code":89,"title":90,"together":56},"6","Control 6","Access Control Management",{"family":72,"item":92,"code":93,"title":94,"together":56},"1","Control 1","Inventory and Control of Enterprise Assets",{"family":96,"item":97,"code":98,"title":99,"together":56},"nist-800-53","ir-4","IR-4","Incident Handling",{"family":96,"item":101,"code":102,"title":103,"together":56},"sa-12","SA-12","Supply Chain Protection"]