ISO 28001:2007 Supply Chain Security Management B.2: B.2 Step one: consideration of the security threat scenarios

At a minimum the assessment should cover the threat scenarios in Table B.1 (the same as those in Table A.2) plus any others that authorities, management or the assessing professional identify. In carrying it out, the assessor should consider: access control at premises and their surroundings, on means of transport and over information; the means of transport in normal use, in maintenance yards, when broken down, when switched, when parked and when used as a weapon; handling during loading, manufacture, storage, transfer, unloading and consolidation; carriage by air, road, rail, inland waterway and sea; intrusion detection and prevention for shipments; inspections; employees' competence, training, awareness and integrity; reliance on business partners; internal and external communication, emergencies included; how information on cargo and routes is handled, with data protection and assurance; and outside information such as law, orders from authorities, industry practice, accidents and incidents, and how capable and quick first responders are.