ISO 28001:2007 Supply Chain Security Management 5.3.2: 5.3.2 Assessment process

The organization shall set up, carry out and keep procedures for identifying the countermeasures already in place against security threats. It shall list the threat scenarios that apply, including any the relevant government officials consider necessary (and record the fact if officials did not take part). For each scenario it shall evaluate the current countermeasures, establish likelihood and consequence, and judge whether further countermeasures are needed to bring the risk down to an acceptable level. It shall review each business partner's security declaration (4.2) using professional judgement, its knowledge of the partner and regulatory requirements, weighing how detailed and valid each declaration is when judging how vulnerable the chain is overall (partners under 4.3 or 4.4 need not be assessed further). It shall record every threat scenario considered, the processes used to evaluate them, and every countermeasure identified and ranked.