Supply Chain Security Plan Template (ISO 28000, AEO, CTPAT)

Cargo security scope, policy, chain map, risk scoring, controls by area, partner requirements, incident response, AEO and CTPAT map, audit

लॉजिस्टिक्स और सप्लाई चेनपूर्णISO 28000:2022 (Amd 1:2024); EU AEO; US CTPATsupply chain security planअपडेट किया गया 29 अक्टू॰ 2026

एडिटर में खोलें.md डाउनलोड करें

उपयोग कैसे करें: Use it to plan the security of physical goods across your sites, carriers and partners. Fill the supply chain map and the risk assessment first, then link each control to a risk. The main pitfall is covering only your own sites, while most losses happen in transit and at partners.

प्रीव्यू

Supply Chain Security Plan: [Organization or site]

A security plan for the physical supply chain: the goods, facilities, vehicles, containers, people and information that move cargo from suppliers to customers. It covers scope, threat and risk assessment, controls by area, business partner requirements, incident response, customs security programmes, monitoring and review. Structure aligned with ISO 28000:2022, Security and resilience, Security management systems, Requirements (with Amendment 1:2024), and informed by customs programmes such as the EU Authorised Economic Operator and US CTPAT. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Field	Value
Document ID	[SEC-SCP-001]
Version	[1.0]
Status	[Draft / Approved]
Owner	[@supply-chain-security-manager]
Approvers	[@operations-director], [@chief-security-officer]
Scope	[Sites, trade lanes, modes, business units]
Customs programmes	[AEO (AEOS), CTPAT, other mutual recognition partners, none]
Management system	[ISO 28000 certified / aligned / not used]
Last updated	YYYY-MM-DD
Next review	YYYY-MM-DD (at least yearly and after any significant incident)
Classification	[Confidential: restricted distribution]

Approvals

Role	Name	Decision	Date
Supply chain security manager	[@supply-chain-security-manager]	[Prepared]	YYYY-MM-DD
Operations director	[@operations-director]	[Approved]	YYYY-MM-DD
Chief security officer	[@chief-security-officer]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2026-10-30	Supply chain security manager	First issue

Context, scope and objectives
Leadership, policy and roles
Supply chain map
Threat and risk assessment
Security objectives and plan of controls
Controls by area
Business partner requirements
Incident response and recovery
Customs security programmes and certification map
Training and awareness
Monitoring, audit and review
Improvement and corrective action
Glossary and references

1. Context, scope and objectives

Item	Value
Organization role	[Manufacturer, importer, exporter, freight forwarder, carrier, warehouse operator]
Goods	[Consumer electronics, high value, theft-attractive]
Sites	[Plant, two distribution centres, cross-dock]
Modes and lanes	[Road within the region, sea containers from Asia, air for urgent spares]
Interested parties	[Customers, insurers, customs authorities, carriers, staff, local community]
Legal and programme requirements	[Customs security status, hazardous materials security plans, aviation security rules, data protection for staff screening]
Exclusions	[Office IT, which is covered by the information security programme]

Objectives (Example):

No cargo loss above [value] per quarter on controlled lanes.
100% of outbound containers sealed with a high-security seal and seal number verified at each hand-over.
All carriers and forwarders on controlled lanes meet the partner requirements in section 7 by [YYYY-MM-DD].

2. Leadership, policy and roles

Policy statement (Example):

[Organization] protects the goods it makes, stores and ships, the people who handle them and the information about them. We assess security risks across our supply chain, apply proportionate controls, require the same from our partners, report incidents and learn from them, and meet the legal and customs requirements that apply to us.

Role	Responsibility
Executive sponsor	Accountable for the plan, resources and risk acceptance
Supply chain security manager	Maintains the plan, risk assessment, partner programme and reporting
Site security leads	Apply site controls, guard routines, access and alarm management
Logistics and transport managers	Apply conveyance, seal and route controls; select compliant carriers
Procurement	Includes security requirements in contracts with partners
Human resources	Pre-employment screening within the law, leaver process
Information security	Protects shipment data, booking systems and tracking platforms
All staff	Follow procedures, report suspicious activity and incidents

3. Supply chain map

Node or hand-over	Custodian	Security relevance (Example)
Supplier factory, container stuffing	Supplier	Contents verified, seal applied
Forwarder and port of loading	Forwarder, terminal	Documents filed, container staged
Sea transit	Sea carrier	Long dwell, many hands, little direct control
Port of discharge, clearance	Terminal, customs broker	Container released, data checked
Road leg to distribution centre	Road haulier	Highest theft risk on parking stops
Distribution centre	Our organization	Full control, internal theft risk
Outbound to customers	Road haulier	Multi-drop, open doors at stops

4. Threat and risk assessment

Scoring (Example): likelihood 1 (rare) to 5 (almost certain) times impact 1 (minor) to 5 (severe). Score 15 or above is high, 8 to 14 is medium, 7 or below is low.

ID	Threat	Where	Likelihood	Impact	Inherent score	Main controls	Residual likelihood	Residual impact	Residual score
SCR-001 (Example)	Theft of full trailer from unsecured parking	Road leg to distribution centre	4	5	20	CTL-COV-02, CTL-COV-03	2	5	10
SCR-002 (Example)	Tampering with container contents before sealing	Supplier factory	3	4	12	CTL-PRT-01, CTL-SEAL-01	2	4	8
SCR-003 (Example)	Internal theft of small high-value items	Distribution centre	3	3	9	CTL-ACC-01, CTL-PER-01	2	3	6
SCR-004 (Example)	Fraudulent pickup with false carrier identity	Distribution centre dock	3	4	12	CTL-COV-01	1	4	4
SCR-005 (Example)	Concealment of illegal goods in a container	Origin to port of loading	2	5	10	CTL-SEAL-01, CTL-PRT-01	1	5	5
SCR-006 (Example)	Shipment data stolen to plan a theft	Booking and tracking systems	2	4	8	CTL-INF-01	1	4	4

Risk treatment decisions above the appetite (residual score 10 or above in this example, which applies to SCR-001) need the executive sponsor's acceptance, recorded with a review date.

Questions to answer:

Which lanes, stops and hand-overs have had incidents in the past three years, internally or in the industry?
Which goods are most attractive to thieves, and are they visible from the outside (branded packaging, predictable routes)?
Who can see shipment data (routes, times, contents), and is that access needed?

5. Security objectives and plan of controls

Objective	Risks	Measure	Target date	Owner
OBJ-01 (Example): secure parking on all overnight stops	SCR-001	Share of overnight stops at approved secure parking	YYYY-MM-DD	Transport manager
OBJ-02 (Example): verified seal on every container hand-over	SCR-002, SCR-005	Seal verification records complete	YYYY-MM-DD	Logistics manager
OBJ-03 (Example): carrier identity check at every collection	SCR-004	Collections with identity check recorded	YYYY-MM-DD	Site security lead

6. Controls by area

6.1 Physical security of facilities

ID	Control	Applies to
CTL-PHY-01 (Example)	Perimeter fencing, gates controlled 24 hours, lighting of yard and docks	Distribution centres
CTL-PHY-02 (Example)	Intrusion alarm monitored by a receiving centre, tested monthly	All sites
CTL-PHY-03 (Example)	CCTV covering gates, docks and high-value cage, recordings kept [30] days	Distribution centres
CTL-PHY-04 (Example)	High-value goods in a locked cage with access logging	Distribution centres

6.2 Access control

ID	Control
CTL-ACC-01 (Example)	Badge access by zone; visitors signed in, escorted, badges returned
CTL-ACC-02 (Example)	Drivers stay in a waiting area unless their task requires dock access
CTL-ACC-03 (Example)	Keys and access rights removed on the day a person leaves

6.3 Personnel security

ID	Control
CTL-PER-01 (Example)	Pre-employment checks for roles with access to high-value goods, within the limits of local employment and data protection law
CTL-PER-02 (Example)	Security awareness at induction and yearly (section 10)
CTL-PER-03 (Example)	Confidential route for reporting suspicious activity

6.4 Conveyances, containers and seals

ID	Control
CTL-SEAL-01 (Example)	Containers and trailers sealed with high-security bolt seals; seal numbers recorded on documents and verified at every hand-over
CTL-SEAL-02 (Example)	Container and trailer inspection before loading (walls, floor, ceiling, doors, undercarriage) with a checklist
CTL-COV-01 (Example)	Carrier identity checked against the booking (driver ID, vehicle registration, pickup reference) before loading
CTL-COV-02 (Example)	Overnight and long stops only at approved secure parking
CTL-COV-03 (Example)	Tracking on high-value loads with alerts on route deviation or unplanned stops

6.5 Information and documents

ID	Control
CTL-INF-01 (Example)	Shipment data available only to roles that need it; booking and tracking platforms use strong authentication
CTL-INF-02 (Example)	Documents checked for consistency (weight, piece count, seal number) at each hand-over

6.6 Procedural controls

ID	Control
CTL-PRO-01 (Example)	Shipping and receiving reconciled against orders and advance notices; discrepancies investigated
CTL-PRO-02 (Example)	Agricultural and pest contamination checks on containers where required

7. Business partner requirements

ID	Partner type	Requirement (Example)	Evidence	Check
CTL-PRT-01	Suppliers stuffing containers	Container inspection, supervised loading, seal applied and recorded	Loading photographs, seal records	Sample audit yearly
CTL-PRT-02	Road hauliers	Driver identity, secure parking, tracking on high-value loads, incident reporting within [2] hours	Carrier security questionnaire, tracking reports	Questionnaire yearly, review after incidents
CTL-PRT-03	Freight forwarders	Customs security status or equivalent controls	AEO or CTPAT status, or completed questionnaire	Status checked at onboarding and yearly
CTL-PRT-04	Third-party warehouses	Physical, access and personnel controls equivalent to section 6	Site audit report	Audit every [2] years

Questions for partner onboarding:

Does the partner hold a customs security status recognised by your authority, and is it current?
Who in the partner's organization handles security incidents, and how fast will they inform you?
Does the partner subcontract, and do subcontractors meet the same requirements?

Supplier security questionnaires for information security are covered in compliance/supplier-security-assessment; sanctions screening of partners in compliance/sanctions-exposure-assessment.

8. Incident response and recovery

Incident type	First action	Notify	Time limit (check your obligations)
Cargo theft or hijack	Ensure driver safety, call police	Insurer, customer, customs if goods under customs control	[Per insurer and customs rules]
Broken or wrong seal at hand-over	Do not open; photograph; quarantine	Shipper, carrier, customs where applicable	[Immediately]
Suspected contraband found	Stop work, do not touch, secure area	Customs and police	[Immediately]
Intrusion at site	Alarm response, police	Site security lead	[Immediately]

Loss of a site or a lane for longer than [48] hours triggers the business continuity plan (compliance/business-continuity).

9. Customs security programmes and certification map

Programme or standard	Status	Where criteria are published	Mapped controls
ISO 28000:2022 (with Amd 1:2024)	[Aligned / certification planned / certified]	ISO, purchase or licensed access	Sections 1 to 12 of this plan
EU Authorised Economic Operator, security and safety (AEOS)	[Held / applying / not applicable]	European Commission; criteria in Article 39 of the Union Customs Code	Sections 6 and 7
US CTPAT	[Member / applying / not applicable]	US Customs and Border Protection, Minimum Security Criteria by business entity type	Sections 6, 7 and 10
US hazardous materials security plans	[Applies if you offer or carry certain hazardous materials]	49 CFR Part 172, Subpart I	Section 6 and the dangerous goods checklist
Other national programmes	[Name]	[Authority]	[Sections]

As of October 2026 the European Commission page lists three AEO authorisation types: customs simplifications (AEOC), security and safety (AEOS), and a combination of both. Security and safety measures are a criterion for AEOS only. CBP publishes CTPAT Minimum Security Criteria separately for each business entity type, such as importers, exporters, highway carriers and third-party logistics providers. Check both pages for the current criteria before mapping.

ISO 28000:2022 uses the common management system structure: context of the organization (clause 4), leadership (clause 5), planning (clause 6), support (clause 7), operation (clause 8), performance evaluation (clause 9) and improvement (clause 10). This plan follows that order.

10. Training and awareness

Audience	Topics (Example)	Frequency	Record
All site staff	Reporting suspicious activity, access rules, tailgating	Induction and yearly	Training system
Dock and dispatch staff	Seal verification, carrier identity check, container inspection	Induction and yearly	Training system
Drivers (own fleet and contracted)	Secure parking, route discipline, hijack response	Before first load and yearly	Carrier records
Managers	Incident response, evidence protection, risk acceptance	Yearly	Training system

11. Monitoring, audit and review

Measure	Target (Example)	Frequency	Owner
Cargo loss value on controlled lanes	Below [value] per quarter	Monthly	Supply chain security manager
Seal verification records complete	100%	Monthly sample	Logistics manager
Partners meeting requirements	100% on controlled lanes	Quarterly	Procurement
Security incidents and near misses reported	Trend reviewed	Monthly	Site security leads
Internal audit findings closed on time	90%	Quarterly	Supply chain security manager

Internal audit: every site and every requirement of this plan at least once every [12] months. Management review: at least yearly, covering incidents, audit results, risk changes, partner performance and resources.

12. Improvement and corrective action

ID	Source	Finding	Root cause	Corrective action	Owner	Due	Effective?
CAR-001 (Example)	Incident SCR-001	Driver parked at an unapproved stop	Approved parking list not on driver app	Add list to app, brief carriers	Transport manager	YYYY-MM-DD	[Check after 3 months]

Use business/root-cause-analysis for structured cause analysis.

13. Glossary and references

Term	Meaning
AEO	Authorised Economic Operator, an EU customs status (AEOC, AEOS or both)
CTPAT	Customs Trade Partnership Against Terrorism, a voluntary US CBP programme
High-security seal	A seal designed to resist tampering and show evidence of it, with a unique number
Custody hand-over	A point where responsibility for goods passes to another party
Inherent and residual risk	Risk before and after controls

References (checked October 2026):

ISO 28000:2022, Security and resilience, Security management systems, Requirements, and Amendment 1:2024 (climate action changes). Official text: ISO, purchase or licensed access: https://www.iso.org/standard/79612.html (also sold by national standards bodies, for example https://www.evs.ee/en/iso-28000-2022).
European Commission, Authorised Economic Operator: https://taxation-customs.ec.europa.eu/customs-4/aeo-authorised-economic-operator/what-aeo_en
US Customs and Border Protection, CTPAT: https://www.cbp.gov/border-security/ports-entry/cargo-security/ctpat
US 49 CFR Part 172, Subpart I, Safety and Security Plans: https://www.ecfr.gov/current/title-49/subtitle-B/chapter-I/subchapter-C/part-172/subpart-I
WCO SAFE Framework of Standards, the international basis for AEO programmes (check the current edition at https://www.wcoomd.org/).
Related templates: security/supply-chain-security (software), compliance/risk-methodology, compliance/risk-register, compliance/business-continuity, compliance/supplier-security-assessment, compliance/sanctions-exposure-assessment, logistics/warehouse-sop, logistics/dangerous-goods-checklist, mba/mba-supply-chain-resilience-card.

Standard and licence note

Structure aligned with ISO 28000:2022, Security and resilience, Security management systems, Requirements, including Amendment 1:2024 (top-level clauses 4 to 10 named only). ISO 28000 is a paid standard: this template reproduces none of its text, requirements or definitions, and every explanation is original wording. Official text: ISO, purchase or licensed access: https://www.iso.org/standard/79612.html, also available from national standards bodies. Customs programmes (EU AEO, US CTPAT) and US federal rules are named with links to the official pages, checked in October 2026, and paraphrased only. Check the current official versions before use. This is a documentation format, not legal advice.

Template licence: MIT.