ISO 28000 Maturity · Supply Chain Security
Your supply chain security, measured against ISO 28000 and turned into a costed action plan.
10 themes, 84 questions, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO 28000 Maturity · Supply Chain Security
10 themes, 84 questions, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO 28000:2022 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism, one level, the level above, and the action that connects them, is what turns a finding into a trajectory.
Are the security requirements applicable to carriers and logistics providers defined and verified?
- N1
No security requirement is set for providers. Selection is based on price, lead time and capacity.
- N2
Requirements exist in some contracts or specifications, with no common wording or verification after signature.
- N3
A baseline of security requirements is built into contracts and qualification files. Main providers supply supporting evidence.
- N4
Requirements are systematically written into contracts, verified against a control plan, and identified gaps are tracked through to closure.
- N5
The requirements baseline is revised in light of incidents and changing flows, extended to second-tier subcontracting, and control results feed into renewal decisions.
Action to move from L2 to L3
Draft a single baseline of security requirements, attach it to transport contracts at the next renewal round and build it into the supplier qualification grid reviewed at the quarterly procurement committee.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 28000.
What this framework covers
ISO 28000 sets out the requirements for a security management system for the supply chain. The 2022 version aligned the standard with the high level structure common to ISO management standards: context of the organisation, leadership, planning, support, operation, performance evaluation, improvement. It covers the security of physical and information flows, security risk assessment, protective measures, management of partners and subcontractors, and the ability to maintain operations in the event of a disruption. It is certifiable by an accredited body.
In practice, the difficulty is not understanding the requirements but knowing where you stand across a scope that largely escapes direct control. Do security risk assessments cover every link in the chain, or only the sites you operate directly? Are security requirements written into supplier contracts, and are they verified beyond self-declaration? Do transport, handling or logistics data access incidents feed into a single system, or do they stay handled locally?
One point of context is worth spelling out, because it shapes current projects: supply chain security has moved into the digital realm. Transport management systems, data exchanges with freight forwarders, traceability platforms and embedded connected devices are now part of the security scope, on the same footing as seals and restricted access zones. ISO 28000 is often confused with ISO 28001, which covers best practices and criteria applicable to operators in the international supply chain, or collapsed into customs programmes such as AEO. These are separate mechanisms that overlap without replacing one another.
The maturity assessment answers a different question from the certification audit. The audit concludes with either compliance or a nonconformity against a given requirement. The assessment places each practice on a progressive scale, across five levels inspired by the CMMI method, and points to the action that moves you up to the next level. Datamensio measures maturity and prepares for the audit, it does not issue any certificate. This positioning is what allows you to start before you are ready, and to steer progress between two audit cycles.
In Datamensio, the framework is ready to use and remains yours. The AI adjusts the themes, questions and wording of the levels to your sector and scope, or builds a variant from your own documents: security policy, flow mapping, transport specifications. You can assess several business units, compare their scores and consolidate a cross-cutting roadmap.
Reference standard: ISO 28000:2022
The themes assessed
Context and scope of the management system
Mapping of flows and links covered, identification of interested parties, applicable legal and contractual requirements, definition of the security scope boundaries.
Leadership and security policy
Management commitment, formalised and communicated supply chain security policy, roles and responsibilities, resource allocation.
Security risk assessment
Method for identifying threats to physical and information flows, evaluation of likelihood and impact, prioritisation, frequency of reassessment.
Operational security measures
Access control to sites and sensitive areas, integrity of transport units and seals, security of loading and unloading, personnel vetting.
Security of partners and subcontractors
Qualification of carriers and providers, security clauses in contracts, documentary or on-site verification, management of subcontracting cascades.
Security of logistics data and systems
Protection of exchanges with freight forwarders and platforms, access rights to transport management systems, digital traceability, embedded connected devices.
Incident preparedness and response
Identified disruption scenarios, alert and escalation procedures, exercises conducted, continuity and recovery plans for critical flows.
Competence and awareness
Training for logistics teams and drivers, awareness of suspicious behaviour, briefing of providers, traceability of training activities.
Performance evaluation
Security indicators tracked, internal audits of the supply chain scope, management review, handling of nonconformities and weak signals.
Continual improvement
Lessons learnt after incidents, updated risk assessments, comparison of results over time and across entities, tracking of corrective actions.
A short version of the framework, with 28 questions, is available for the online self-assessment. The full version covers 10 themes and 84 questions.
Frequently asked questions
Is ISO 28000 certifiable?
Yes, by an accredited certification body, against the requirements of the 2022 version. Datamensio does not certify: the assessment measures your maturity level and prepares for the audit by identifying gaps and the actions to carry out.
What is the difference between this assessment and a certification audit?
The audit checks whether a requirement is met and concludes with compliance or a nonconformity. The assessment places each practice on five progressive levels and points to the action that moves it up to the next one. The assessment prepares the audit, the audit validates it.
How long does the assessment take?
The short self-assessment can be completed in a single working session. The full version, run collaboratively with sites, procurement and IT, spans one to two weeks, most of the time going into gathering supporting evidence.
Can the framework be adapted to our sector?
Yes. You can edit the questions, levels and themes, or add your own. The AI generates a variant from your internal documents, for example your security policy or transport specifications. The framework remains your property.
How do you assess several sites or countries?
The same framework is rolled out to every entity, which makes scores comparable. The benchmark places each business unit against the others and against its own past results. A cross-cutting roadmap consolidates shared actions without duplicating them.
Do you need security expertise to answer?
The questions focus on management practices, not equipment specifications. A supply chain manager or an internal auditor can answer them. Technical or IT questions are routed to the right contributor in collaborative mode.
How does this relate to ISO 28001 and customs programmes?
ISO 28001 covers best practices for operators in the international supply chain, while Authorised Economic Operator type programmes fall under customs authorities. The scopes overlap: a solid ISO 28000 assessment provides a reusable base of evidence for these schemes.
Where is the data hosted?
In France, with OVH, with backup at Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.