ISO 28001:2007 Supply Chain Security Management A.3.3: A.3.3 Performance review (Table A.1)

Table A.1 is the performance review list completed during a security assessment, adapted to the organization's risk assessment and business model; each factor is marked Yes, No (with an explanation or an alternative measure), Not Applicable, or prohibited by law. Its groups of factors are: managing supply chain security (a management system covering it, a named person responsible); the security plan (up-to-date plans, what upstream and downstream partners expect, crisis management, and plans for business continuity and recovering security); security of assets (physical security of buildings, watching the perimeter, access control over facilities, conveyances, docks and cargo areas and the issue of identification, security technology such as intrusion detection and CCTV with recordings kept, how to call security or the police, restricting, detecting and reporting entry to cargo and conveyance areas without authority, identifying people delivering or collecting cargo); security of personnel (checking integrity before hiring and at intervals, security training suited to the job, knowing how to report incidents, cutting off access at once when someone leaves); security of information (cargo information that is legible, timely, accurate and protected, matching cargo against its paperwork, reporting partner information accurately and on time, backup storage, individual user IDs, password management with a change at least yearly, protection against access and misuse without authority); security of goods and conveyances (limiting and reporting access to shipping and storage areas, competent supervision of cargo handling, telling law enforcement about anomalies, goods kept intact at handover, following threat levels along routes, security rules for those operating conveyances); and closed cargo transport units (documented procedures under which whoever loads the unit fits and records ISO/PAS 17712 high security seals or other devices that reveal tampering, checking seals whenever custody changes, checking for contamination before loading, and a seven-point physical check of the doors, floor, ceiling, undercarriage, front wall and both side walls).