ISO 28000 Certification in Kenya: Improving Supply Chain Security & Risk Management

 Kenya sits at the center of East African trade. Cargo moves through the port of Mombasa and along the Northern Corridor to Uganda, Rwanda, the Democratic Republic of Congo, and South Sudan, while Jomo Kenyatta International Airport carries perishable exports such as flowers and produce to world markets. Every handover along those routes is a chance for theft, tampering, delay, or loss.

ISO 28000 Certification in Kenya is the international standard for security management systems. It gives freight forwarders, transporters, warehouse operators, exporters, and port-related businesses a structured way to identify security risks and control them. This guide explains the standard, the threats it addresses, and how Kenyan organizations can get certified.

What Is ISO 28000?

ISO 28000 specifies requirements for a security management system. The current edition, ISO 28000:2022, is titled "Security and resilience: Security management systems: Requirements." It replaced the 2007 edition, which was written specifically for supply chain security, and it now applies more broadly to any organization that needs to manage security risks.

The 2022 edition follows the same high-level structure as ISO 9001 and ISO 27001, and it is aligned with the ISO 31000 approach to risk management. That means it fits easily into an integrated management system.

Other standards in the ISO 28000 family give more detailed guidance on supply chain security, so check the current catalogue for what applies to your operations. ISO 28000 is certifiable by independent certification bodies.

Why ISO 28000 Matters in Kenya

• A regional gateway. The port of Mombasa, the Northern Corridor, inland container depots, and the standard gauge railway link East African importers and exporters, so security failures can affect many parties.

• Air cargo and perishables. Exporters of cut flowers and produce depend on fast, secure, temperature-controlled handling at airports.

• Customs and aviation security schemes. Trade facilitation programs, such as authorized economic operator status from the revenue authority, and aviation cargo security arrangements, such as regulated agent and known consignor schemes, involve security criteria. A management system helps you meet and evidence them, but does not grant status by itself.

• Customer and insurer expectations. International buyers and insurers increasingly ask logistics providers to show how they control theft, tampering, and unauthorized access.

• Digital trade systems. Electronic customs and single window platforms make information security and document integrity part of cargo security.

• Tender and partner requirements. Large shippers and multinational clients often prefer certified logistics partners.

Requirements differ by sector and authority, so confirm what applies to your operations.

Typical Supply Chain Security Threats and Controls

Threats differ along the route, so a good security management system looks stage by stage. These examples show where to start, not what your risk assessment will conclude.

Stage	Typical threats	Example controls
Origin: farm, factory, or warehouse	Pilferage, unauthorized access, insider theft, contamination	Access control, CCTV, stock counts, staff screening, controlled loading areas
Packing and loading	Tampering, substitution, concealed goods	Seals with recorded numbers, supervised loading, load photos, checks of container condition
Road and rail transport	Hijacking, theft in transit, unauthorized stops, diversion	Route planning, driver vetting, vehicle tracking, convoy or escort where justified
Depots, terminals, and ports	Breach of perimeter, document fraud, seal tampering	Gate procedures, verification of documents and seals, restricted zones
Air cargo	Unsecured cargo, unauthorized access to aircraft or handling areas	Screening, known consignor and regulated agent procedures, secure holding areas
Information and documentation	Fraudulent documents, data breaches, system misuse	Access control on systems, document verification, information security policies
Emergency situations	Incidents, accidents, civil disruption	Incident reporting, emergency contacts, continuity and recovery plans

Key Requirements of ISO 28000:2022

Area	What it requires	Example for a Kenyan logistics business
Context	Understand internal and external issues, interested parties, and define the scope	A forwarder defines its depots, fleet, and routes covered, and notes customer, customs, and insurer expectations
Leadership	Security policy, assigned roles, and visible management commitment	A security manager is appointed and the policy is signed by the managing director
Planning	Address risks and opportunities, set security objectives, and plan to achieve them	An objective to reduce cargo loss incidents on a named corridor
Support	Resources, competence, awareness, communication, and documented information	Drivers and warehouse staff trained on seal control and incident reporting
Operation	Operational planning and control, risk assessment and treatment, and security plans	Written procedures for gate control, container checks, and route security
Performance evaluation	Monitoring, measurement, internal audit, and management review	Monthly review of incidents, near misses, and audit findings
Improvement	Corrective action and continual improvement	Root-cause investigation after a theft, with changes to controls

How Security Risk Is Assessed and Treated

The security risk assessment is the working core of ISO 28000. It is not a one-off exercise: risks change with routes, clients, cargo, and criminal methods, so the process repeats.

ISO 28000 Compared With Related Standards and Programs

Standard or program	What it is	Who it applies to	How it relates to ISO 28000
ISPS Code	International code on security of ships and port facilities	Ships and port facilities	Mandatory for in-scope ships and port facilities. ISO 28000 is a voluntary management system that can cover wider operations around them
Authorized economic operator programs	Customs trade-facilitation status granted by a customs authority	Traders and logistics operators that meet the authority's criteria	ISO 28000 can support meeting security criteria, but status is granted only by the customs authority
Regulated agent and known consignor schemes	Aviation cargo security arrangements	Air cargo handlers and shippers	Set by the aviation authority. ISO 28000 helps structure the controls and records
ISO 22301	Business continuity management	Any organization	Complements ISO 28000 by covering recovery after disruption
ISO/IEC 27001	Information security management	Any organization	Complements ISO 28000 for information and digital systems

Organizations that already hold ISO 9001 or ISO 27001 can add ISO 28000 to an integrated system, reusing document control, audit, and review processes.

Benefits of ISO 28000 Certification

• Fewer losses. Systematic risk assessment and controls reduce theft, tampering, and pilferage.

• Faster, calmer incident response. Defined procedures, contacts, and records limit confusion when something goes wrong.

• Customer and insurer confidence. A certificate backs up security claims with independent evidence.

• Support for trade and security schemes. Documented controls make it easier to meet criteria from customs, aviation, and port authorities.

• Stronger supplier and subcontractor control. Transporters and depots are brought into the system.

• Better staff awareness. Drivers, loaders, and guards understand their role in security.

• Competitive position. Certification can help in tenders and in winning business with multinational shippers.

How to Get ISO 28000 Certified in Kenya

1. Define scope and secure management commitment. Decide which operations, sites, routes, and services are covered.

2. Run a gap analysis. Compare current security practices with ISO 28000:2022.

3. Set security policy and objectives. Link objectives to real threats, such as cargo loss on a named route.

4. Carry out the security risk assessment. Identify threats and vulnerabilities, assess their likelihood and consequences, and decide how to treat them.

5. Design and document controls. Prepare procedures for access control, seals, transport, loading, incident reporting, and emergency response.

6. Train staff and subcontractors. Include drivers, guards, warehouse teams, and key suppliers.

7. Implement and keep records. Show that controls operate in practice.

8. Audit and review. Complete an internal audit and a management review, and close findings.

9. Select an accredited certification body. Confirm its accreditation for ISO 28000 and that customers and authorities accept its certificates.

10. Complete the certification audits and maintain the certificate. Expect a staged audit, then surveillance audits and recertification.

Common Mistakes to Avoid

• Copying a generic risk assessment. Your routes, cargo, and clients create specific threats.

• Ignoring insider risk. Many losses involve people with legitimate access, so staff screening and access control matter.

• Forgetting subcontractors. Transporters, depots, and guards are part of your security chain and must be covered.

• Treating security as guards and cameras only. Procedures, records, and training do as much work as equipment.

• Weak incident reporting. Unreported near misses hide the patterns you need to see.

• Neglecting information security. Document fraud and system misuse can enable physical theft.

• Letting the system go quiet after certification. Surveillance audits will expose it.

Readiness Checklist

• Scope and security policy approved by top management

• Security roles and responsibilities assigned

• Security risk assessment completed and kept current

• Risk treatment plan with owners and dates

• Procedures for access control, loading, seals, transport, and incident reporting

• Emergency and continuity arrangements tested

• Subcontractor and supplier security requirements agreed

• Staff and driver training records available

• Incident, near miss, and corrective action records

• Internal audit completed and management review held

How PopularCert Supports Organizations in Kenya

PopularCert helps logistics and trade-related businesses build a security management system that works on real routes and passes the certification audit. Support typically includes:

• A gap analysis against ISO 28000:2022 and help defining scope.

• Guidance on carrying out the security risk assessment and risk treatment plan.

• Help preparing policies, procedures, and records for access control, loading, transport, and incident response.

• Training for managers, drivers, warehouse teams, security staff, and internal auditors.

• Support integrating ISO 28000 with ISO 9001, ISO 27001, or other management systems.

• An internal audit and pre-certification readiness review.

• Support with surveillance audits and continual improvement.

PopularCert prepares your organization. The certificate is issued by an independent certification body.

Conclusion

In a trade corridor as busy as Kenya's, security is part of service quality. ISO 28000 gives organizations a structured way to find where cargo and information are most exposed, control those risks, and show customers and authorities that the controls work.

If you are considering ISO 28000 certification, contact PopularCert to discuss your scope and where to start.

Frequently Asked Questions

Is ISO 28000 mandatory in Kenya?

Certification is generally voluntary. However, customers, insurers, and security schemes may expect strong security controls, and some activities fall under mandatory codes and regulations.

Does ISO 28000 make me an authorized economic operator?

No. That status is granted by the customs authority against its own criteria. ISO 28000 can help you meet security-related criteria and show your controls.

Is ISO 28000 only for freight forwarders?

No. Transporters, warehouse operators, exporters, importers, port-related businesses, and other organizations facing security risks can use it.

What changed in the 2022 edition?

It is no longer limited to supply chain security, it is aligned with the ISO 31000 risk management approach, and it follows the common structure used by other management system standards.

How long does certification take?

It depends on your scope, size, and existing controls. A gap analysis gives the most realistic estimate.

Who issues the certificate?

An independent certification body. Consultants help you prepare but do not certify.