TS ISO 28004-3

TS ISO 28004-3 is an additional implementation guide for medium and small businesses that want to adopt ISO 28000 for supply chain security management, with a specific focus on organisations other than marine ports. ISO 28000 provides a management-system framework for controlling security risks across the supply chain; TS ISO 28004-3 helps smaller organisations understand how that framework can be applied in practice.

Relationship to ISO 28004-1

This part was developed to supplement the general guidance in ISO 28004-1. As stated in the scope, it amplifies the main guidance but does not conflict with it, and it does not amend ISO 28000. In other words, TS ISO 28004-3 is a complementary guide rather than a standalone security management standard.

What the guidance means for smaller organisations

In general technical terms, supply chain security is about managing the movement of goods, information, cargo and processes against risks such as unauthorised access, theft, tampering, sabotage or disruption. For medium and small businesses, implementing such a system usually means adapting policies, responsibilities, controls and improvement processes to more limited resources and simpler organisational structures. The value of this standard is that it makes adoption of ISO 28000 more approachable in that setting.

Because the document excludes marine ports, its context is different from port-specific operations. It is therefore more relevant to storage, transport, distribution, shipping support and other commercial links in the chain where security management needs to be embedded into day-to-day operations. This gives organisations a clearer conceptual bridge between ISO 28000 requirements and practical use in smaller-scale businesses.

• Prepared for medium and small businesses seeking to adopt ISO 28000.
• Marine ports are outside its stated focus.
• Complements the general guidance in ISO 28004-1.
• Does not amend ISO 28000; it adds explanatory guidance only.