ISO 28000 certification consultant in Malaysia
Supply chain securityISO 28000:2022
Protect cargo, facilities, and freight movements with a security management system your customers and Customs both recognise.
What it is
ISO 28000:2022 sets requirements for a security management system covering the financial, manufacturing, information, and facility aspects of security across the supply chain. It requires organisations to assess security threats and vulnerabilities, implement controls for facilities, cargo, and transport, and maintain an incident response capability, certified through a two-stage audit by an accredited body. In Malaysia it complements Authorised Economic Operator, or AEO, status granted by the Royal Malaysian Customs Department, which offers faster cargo clearance to security-vetted traders.
Who needs it in Malaysia
- Freight forwarders and logistics operators
- Companies moving goods on behalf of customers use ISO 28000 to demonstrate that cargo handling, warehousing, and transport are protected by documented controls rather than depending on individual drivers or warehouse staff.
- Port and bonded warehouse operators
- Facilities handling high volumes of transit or bonded cargo need to show consistent access control, inventory security, and incident response across shifts, which customers and Customs both scrutinise during audits.
- Exporters and importers pursuing AEO status
- Companies applying for Authorised Economic Operator status with Royal Malaysian Customs use ISO 28000 as the documented security framework that supports the application, since the two share overlapping risk assessment requirements.
- Manufacturers with high-value or high-risk cargo
- Electronics, pharmaceuticals, and other high-value manufacturers implement ISO 28000 to reduce theft, tampering, and diversion risk across their outbound supply chain, not just within the factory gate.
Our process
Security risk assessment across the supply chain
We assess threats and vulnerabilities across your facilities, cargo, and transport routes, and hand over a dated, written action list ranked by the risk each gap actually represents.
Controls for facilities, cargo, and transport
Access control, cargo seal integrity, and transport monitoring procedures are built around your actual routes and sites, not a generic checklist unrelated to how your goods actually move.
Documentation and incident response
Security procedures, incident reporting, and response plans are drafted so staff at every site know what to do when a security event occurs, not only what to do to pass an audit.
Internal audit and management review
A full rehearsal against the standard's internal audit and management review requirements, with findings closed and objective evidence filed before the certification audit is booked.
Certification audit support
We accompany you through Stage 1 document review and Stage 2 on-site assessment, and align the evidence produced with your AEO application where your company is pursuing that status alongside certification.
Timeline
A single-site freight or warehouse operator with existing access control typically reaches certification in four to seven months from gap analysis. Operators with multiple sites, several transport modes, or pursuing AEO status alongside ISO 28000 often need eight to eleven months, since incident logs and security records need to accumulate real evidence across a full audit cycle.
What affects the cost
- Number of sites, warehouses, or ports within the certification scope
- Existing security infrastructure such as CCTV and access control
- Number of transport modes and routes carrying meaningful risk
- Certification body fees, which scale with scope and site count
- Scope of staff security awareness and incident response training
- Whether AEO application support is bundled alongside certification
How BUKTI helps
- BUKTI keeps your security procedures and site risk assessments current, so version history and approvals are never the finding an auditor raises.
- Security incidents and corrective actions run through BUKTI's CAPA workflow, with root cause and closure evidence tracked automatically across sites and shifts.
- Management review inputs, from incident trends to access control exceptions, are compiled in BUKTI so the meeting starts with organised data.
FAQ
How is ISO 28000 different from ISO 27001?
ISO 27001 covers information security, protecting data and IT systems. ISO 28000 covers physical and operational supply chain security, protecting cargo, facilities, and transport. Companies with both information and physical security exposure sometimes implement both standards together.
Do we need AEO status too, or is ISO 28000 enough?
They serve different purposes. ISO 28000 certification demonstrates a security management system to customers and partners; AEO status, granted by Royal Malaysian Customs, delivers faster cargo clearance benefits. Many companies pursue ISO 28000 certification specifically to support an AEO application, since the risk assessments overlap.
Which industries actually need ISO 28000 in Malaysia?
Freight forwarders, port and bonded warehouse operators, and exporters or importers moving high-value or high-risk cargo see it requested most often, particularly where customers or Customs expect documented, auditable security controls rather than informal, ad hoc arrangements.
How much does ISO 28000 certification cost in Malaysia?
Cost depends on the number of sites and transport modes in scope, existing security infrastructure, and certification body fees, which are quoted separately from consulting fees. We give a written, fixed-scope quote after reviewing your operations.
How long does ISO 28000 implementation take?
Four to seven months is typical for a single-site operator with existing access control. Multiple sites, several transport modes, or a parallel AEO application usually extend the timeline to eight to eleven months, as security records need to accumulate real evidence first.
What happens after we get certified?
Certification bodies run annual surveillance audits to confirm the security management system is still operating, with full recertification every three years. BUKTI keeps incident and access records current between visits so surveillance audits stay routine.
Where we work
Perlis, Kedah, Penang, Perak, Selangor, Kuala Lumpur, Putrajaya, Negeri Sembilan, Melaka, Johor, Pahang, Terengganu, Kelantan, Sabah, Sarawak, Labuan. ISO consultants in every Malaysian state.
Ask about this standard
Customs or a customer asking about your supply chain security?
Tell us your sites and transport routes. We will scope a realistic path to certification, and to AEO if you need it.