ISO 28002:2011

International (ISO)

v2011 (first edition)

6 domains

37 controls

Requirements for a supply chain resilience policy built into a management system such as ISO 28000: context and end-to-end supply chain mapping, scope and strategic weightings, top management policy with life safety first, and the full management system cycle of risk and impact assessment with recovery time criteria, prevention, mitigation, response, continuity and recovery programmes, crisis teams, warning and communication, supplier verification, exercises, audit and management review. 37 leaves read against the complete identical Russian adoption.

Verified

ISO 28002:2011 is a compliance framework from International (ISO) with 6 domains and 37 controls that map to 2 other frameworks. The largest domains are Annex A: Implementation and operation – ISO 28002:2011 (10 controls), Annex A: Checking and corrective action – ISO 28002:2011 (7 controls), Clause 4: Requirements of the management system containing a resilience policy – ISO 28002:2011 (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Annex A: Checking and corrective action – ISO 28002:2011

7 controls

Controls in the Annex A: Checking and corrective action – ISO 28002:2011 domain of ISO 28002:2011 — 7 controls
Code	Title	Description
iso-28002-2011::A.6.1	A.6.1 General	The organization reviews its resilience plans, procedures and capability by regular assessment, testing, incident report...
iso-28002-2011::A.6.2	A.6.2 Monitoring and measurement	The organization sets performance indicators and procedures that regularly track and measure the characteristics of its...
iso-28002-2011::A.6.3.1	A.6.3.1 Evaluation of compliance	Following through on its compliance commitment, the organization keeps procedures to evaluate periodically its complianc...
iso-28002-2011::A.6.3.2	A.6.3.2 Exercises and testing	The organization tests and evaluates whether its resilience policy, programmes, processes and procedures, including supp...
iso-28002-2011::A.6.4	A.6.4 Nonconformity, corrective and preventive action	The organization keeps procedures to handle nonconformities, real or potential, and to take corrective and preventive ac...
iso-28002-2011::A.6.5	A.6.5 Control of records	The organization keeps records showing conformity with the resilience policy and the results achieved, with procedures t...
iso-28002-2011::A.6.6	A.6.6 Internal audit	The organization audits its resilience policy internally at planned intervals and when management decides, to find out w...

Annex A: Implementation and operation – ISO 28002:2011

10 controls

Controls in the Annex A: Implementation and operation – ISO 28002:2011 domain of ISO 28002:2011 — 10 controls
Code	Title	Description
iso-28002-2011::A.5.1	A.5.1 Resources, roles, responsibility and authority for resilience management	Roles, responsibilities and authority are defined, documented and communicated so resilience is managed effectively. Top...
iso-28002-2011::A.5.2	A.5.2 Competence, training and awareness	Anyone whose tasks could prevent, cause, respond to, mitigate or affect significant hazards, threats and risks is compet...
iso-28002-2011::A.5.3	A.5.3 Communication and warning	For hazards, threats, risks and the resilience policy, the organization keeps procedures for: documenting, recording and...
iso-28002-2011::A.5.4	A.5.4 Documentation	The resilience documentation includes the policy, objectives and targets; a description of the scope; a description of t...
iso-28002-2011::A.5.5	A.5.5 Control of documents	Documents required by the resilience policy are controlled, and records, a special kind of document, are handled as set...
iso-28002-2011::A.5.6	A.5.6 Operational control	The organization identifies the operations and activities needed to achieve its resilience policy, control activities wi...
iso-28002-2011::A.5.7.1	A.5.7.1 General	The organization keeps procedures to manage disruptive incidents that could affect it, its activities, functions, servic...
iso-28002-2011::A.5.7.2	A.5.7.2 Prevention, preparedness and response structure	The organization documents and puts in place procedures and a management structure, staffed by people with the needed au...
iso-28002-2011::A.5.7.3	A.5.7.3 Incident prevention, protection and mitigation	The organization keeps procedures to prevent and protect against a disruptive event, limit its consequences and keep ope...
iso-28002-2011::A.5.7.4	A.5.7.4 Incident response	The organization keeps procedures to manage a disruptive event and keep operating based on recovery objectives from the...

Annex A: Management review – ISO 28002:2011

5 controls

Controls in the Annex A: Management review – ISO 28002:2011 domain of ISO 28002:2011 — 5 controls
Code	Title	Description
iso-28002-2011::A.7.1	A.7.1 General	Management reviews the management system at planned intervals to keep it suitable, adequate and effective, assessing opp...
iso-28002-2011::A.7.2	A.7.2 Management review input	Inputs include: results of audits and of reviews of the resilience policy; stakeholder feedback; technologies, products...
iso-28002-2011::A.7.3	A.7.3 Management review output	Outputs include decisions and actions on: improving the effectiveness of the resilience policy; updating the risk assess...
iso-28002-2011::A.7.4	A.7.4 Maintenance	Top management sets a defined, documented programme for maintaining the management system so that internal or external c...
iso-28002-2011::A.7.5	A.7.5 Continual improvement	The organization keeps improving the effectiveness of the management system by drawing on its resilience policy and obje...

Annex A: Planning – ISO 28002:2011

6 controls

Controls in the Annex A: Planning – ISO 28002:2011 domain of ISO 28002:2011 — 6 controls
Code	Title	Description
iso-28002-2011::A.4.1	A.4.1 Risk assessment and monitoring	The organization sets up and keeps a risk assessment process that: identifies risks from intentional, unintentional and...
iso-28002-2011::A.4.2	A.4.2 Internal and external communication and consultation	Within the risk assessment the organization runs a documented process to exchange information and consult with stakehold...
iso-28002-2011::A.4.3	A.4.3 Monitoring and review of the risk assessment process	The organization sets up, keeps and documents a process to monitor and review its risk assessment, in order to update it...
iso-28002-2011::A.4.4	A.4.4 Legal and other requirements	The organization keeps procedures to identify legal and regulatory obligations, plus other commitments it has signed up...
iso-28002-2011::A.4.5	A.4.5 Resilience objectives and targets	The organization documents objectives and targets for managing risk so that disruptive incidents are prevented, avoided,...
iso-28002-2011::A.4.6	A.4.6 Strategic resilience plans and programmes	The organization runs one or more strategic programmes to reach its objectives and targets, optimised and prioritised by...

Annex A: Resilience policy and management responsibility – ISO 28002:2011

2 controls

Controls in the Annex A: Resilience policy and management responsibility – ISO 28002:2011 domain of ISO 28002:2011 — 2 controls
Code	Title	Description
iso-28002-2011::A.2	A.2 Resilience management policy	The resilience management policy is developed and documented to meet this standard and added to the management system po...
iso-28002-2011::A.3	A.3 Management responsibility	Management gives evidence of its engagement in the resilience policy across its whole life, from setting it up and runni...

Clause 4: Requirements of the management system containing a resilience policy – ISO 28002:2011

7 controls

Controls in the Clause 4: Requirements of the management system containing a resilience policy – ISO 28002:2011 domain of ISO 28002:2011 — 7 controls
Code	Title	Description
iso-28002-2011::4.1	4.1 General	The organization sets up a resilience policy for its supply chain that meets this standard, and makes it part of a manag...
iso-28002-2011::4.2.1	4.2.1 External and internal context	The organization works out and writes down the factors of its context. Outside it: cultural, social and political condit...
iso-28002-2011::4.2.2	4.2.2 Specific factors showing commitment to risk and resilience management	To show its commitment to managing risk and resilience, the organization determines and records, as part of the context...
iso-28002-2011::4.3	4.3 Scope of the resilience management policy	The organization defines and documents the objectives and scope of its resilience management policy, naming the particul...
iso-28002-2011::4.4	4.4 Provision of resources for the resilience management policy	Management makes sure the resources needed to implement and run the resilience management policy are available: people a...
iso-28002-2011::4.5	4.5 Resilience management policy	Top management develops, documents and resources the management system into which the resilience management policy is bu...
iso-28002-2011::4.6	4.6 Resilience policy statement	When the standard is applied inside an existing management system, a policy statement is written that fits the nature an...

Maps to 2 other frameworks

37 total controls

ISO 22301:2019

36 source controls mapped|34 target controls covered

97%

ISO 28000:2022

35 source controls mapped|37 target controls covered

95%

Compare ISO 28002:2011 with ISO 22301:2019

Coverage is not the same as your position

This page shows what ISO 28002:2011 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is ISO 28002:2011 and who does it apply to?

ISO 28002:2011 is a compliance framework from International (ISO) with 6 domains and 37 controls. Requirements for a supply chain resilience policy built into a management system such as ISO 28000: context and end-to-end supply chain mapping, scope and strategic weightings, top management policy with life safety first, and the full management system cycle of risk and impact assessment with recovery time criteria, prevention, mitigation, response, continuity and recovery programmes, crisis teams, warning and communication, supplier verification, exercises, audit and management review. 37 leaves read against the complete identical Russian adoption. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 28002:2011 actually require?

ISO 28002:2011 has 37 controls organised across 6 domains. The largest domains are Annex A: Implementation and operation – ISO 28002:2011 (10 controls), Annex A: Checking and corrective action – ISO 28002:2011 (7 controls), Clause 4: Requirements of the management system containing a resilience policy – ISO 28002:2011 (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 28002:2011 do I already cover?

ISO 28002:2011 maps to 2 other compliance frameworks. The top mapping partners are ISO 22301:2019 (97% coverage), ISO 28000:2022 (95% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement ISO 28002:2011?

Start your ISO 28002:2011 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 28002:2011 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 37 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 723 frameworks.

Get Started Free →

Free forever — no credit card required