ISO 28001:2007 Supply Chain Security Management 5.2: 5.2 Identification of the scope of the security assessment

The security assessment shall cover every activity the organization carries out as set out in its Statement of Application. It shall be repeated periodically, with the security plan updated as appropriate and the results recorded and kept. It shall also take in the information systems, documents and networks involved in handling and moving goods while the organization has custody of them. With the exceptions allowed by 4.3 and 4.4, the current security arrangements shall be assessed at every location, and for every business partner, where security weaknesses may exist.