Supply Chain Security Plan Template (ISO 28000, AEO, CTPAT)
Cargo security scope, policy, chain map, risk scoring, controls by area, partner requirements, incident response, AEO and CTPAT map, audit
使い方: Use it to plan the security of physical goods across your sites, carriers and partners. Fill the supply chain map and the risk assessment first, then link each control to a risk. The main pitfall is covering only your own sites, while most losses happen in transit and at partners.
プレビュー
Supply Chain Security Plan: [Organization or site]
A security plan for the physical supply chain: the goods, facilities, vehicles, containers, people and information that move cargo from suppliers to customers. It covers scope, threat and risk assessment, controls by area, business partner requirements, incident response, customs security programmes, monitoring and review. Structure aligned with ISO 28000:2022, Security and resilience, Security management systems, Requirements (with Amendment 1:2024), and informed by customs programmes such as the EU Authorised Economic Operator and US CTPAT. Replace every
[bracketed]value and every row marked Example. This is a documentation format, not legal advice.
Document control
| Field | Value |
|---|---|
| Document ID | [SEC-SCP-001] |
| Version | [1.0] |
| Status | [Draft / Approved] |
| Owner | [@supply-chain-security-manager] |
| Approvers | [@operations-director], [@chief-security-officer] |
| Scope | [Sites, trade lanes, modes, business units] |
| Customs programmes | [AEO (AEOS), CTPAT, other mutual recognition partners, none] |
| Management system | [ISO 28000 certified / aligned / not used] |
| Last updated | YYYY-MM-DD |
| Next review | YYYY-MM-DD (at least yearly and after any significant incident) |
| Classification | [Confidential: restricted distribution] |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Supply chain security manager | [@supply-chain-security-manager] | [Prepared] | YYYY-MM-DD |
| Operations director | [@operations-director] | [Approved] | YYYY-MM-DD |
| Chief security officer | [@chief-security-officer] | [Approved] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 (Example) | 2026-10-30 | Supply chain security manager | First issue |
Contents
- Context, scope and objectives
- Leadership, policy and roles
- Supply chain map
- Threat and risk assessment
- Security objectives and plan of controls
- Controls by area
- Business partner requirements
- Incident response and recovery
- Customs security programmes and certification map
- Training and awareness
- Monitoring, audit and review
- Improvement and corrective action
- Glossary and references
1. Context, scope and objectives
| Item | Value |
|---|---|
| Organization role | [Manufacturer, importer, exporter, freight forwarder, carrier, warehouse operator] |
| Goods | [Consumer electronics, high value, theft-attractive] |
| Sites | [Plant, two distribution centres, cross-dock] |
| Modes and lanes | [Road within the region, sea containers from Asia, air for urgent spares] |
| Interested parties | [Customers, insurers, customs authorities, carriers, staff, local community] |
| Legal and programme requirements | [Customs security status, hazardous materials security plans, aviation security rules, data protection for staff screening] |
| Exclusions | [Office IT, which is covered by the information security programme] |
Objectives (Example):
- No cargo loss above [value] per quarter on controlled lanes.
- 100% of outbound containers sealed with a high-security seal and seal number verified at each hand-over.
- All carriers and forwarders on controlled lanes meet the partner requirements in section 7 by [YYYY-MM-DD].
2. Leadership, policy and roles
Policy statement (Example):
[Organization] protects the goods it makes, stores and ships, the people who handle them and the information about them. We assess security risks across our supply chain, apply proportionate controls, require the same from our partners, report incidents and learn from them, and meet the legal and customs requirements that apply to us.
| Role | Responsibility |
|---|---|
| Executive sponsor | Accountable for the plan, resources and risk acceptance |
| Supply chain security manager | Maintains the plan, risk assessment, partner programme and reporting |
| Site security leads | Apply site controls, guard routines, access and alarm management |
| Logistics and transport managers | Apply conveyance, seal and route controls; select compliant carriers |
| Procurement | Includes security requirements in contracts with partners |
| Human resources | Pre-employment screening within the law, leaver process |
| Information security | Protects shipment data, booking systems and tracking platforms |
| All staff | Follow procedures, report suspicious activity and incidents |
3. Supply chain map
| Node or hand-over | Custodian | Security relevance (Example) |
|---|---|---|
| Supplier factory, container stuffing | Supplier | Contents verified, seal applied |
| Forwarder and port of loading | Forwarder, terminal | Documents filed, container staged |
| Sea transit | Sea carrier | Long dwell, many hands, little direct control |
| Port of discharge, clearance | Terminal, customs broker | Container released, data checked |
| Road leg to distribution centre | Road haulier | Highest theft risk on parking stops |
| Distribution centre | Our organization | Full control, internal theft risk |
| Outbound to customers | Road haulier | Multi-drop, open doors at stops |
4. Threat and risk assessment
Scoring (Example): likelihood 1 (rare) to 5 (almost certain) times impact 1 (minor) to 5 (severe). Score 15 or above is high, 8 to 14 is medium, 7 or below is low.
| ID | Threat | Where | Likelihood | Impact | Inherent score | Main controls | Residual likelihood | Residual impact | Residual score |
|---|---|---|---|---|---|---|---|---|---|
| SCR-001 (Example) | Theft of full trailer from unsecured parking | Road leg to distribution centre | 4 | 5 | 20 | CTL-COV-02, CTL-COV-03 | 2 | 5 | 10 |
| SCR-002 (Example) | Tampering with container contents before sealing | Supplier factory | 3 | 4 | 12 | CTL-PRT-01, CTL-SEAL-01 | 2 | 4 | 8 |
| SCR-003 (Example) | Internal theft of small high-value items | Distribution centre | 3 | 3 | 9 | CTL-ACC-01, CTL-PER-01 | 2 | 3 | 6 |
| SCR-004 (Example) | Fraudulent pickup with false carrier identity | Distribution centre dock | 3 | 4 | 12 | CTL-COV-01 | 1 | 4 | 4 |
| SCR-005 (Example) | Concealment of illegal goods in a container | Origin to port of loading | 2 | 5 | 10 | CTL-SEAL-01, CTL-PRT-01 | 1 | 5 | 5 |
| SCR-006 (Example) | Shipment data stolen to plan a theft | Booking and tracking systems | 2 | 4 | 8 | CTL-INF-01 | 1 | 4 | 4 |
Risk treatment decisions above the appetite (residual score 10 or above in this example, which applies to SCR-001) need the executive sponsor's acceptance, recorded with a review date.
Questions to answer:
- Which lanes, stops and hand-overs have had incidents in the past three years, internally or in the industry?
- Which goods are most attractive to thieves, and are they visible from the outside (branded packaging, predictable routes)?
- Who can see shipment data (routes, times, contents), and is that access needed?
5. Security objectives and plan of controls
| Objective | Risks | Measure | Target date | Owner |
|---|---|---|---|---|
| OBJ-01 (Example): secure parking on all overnight stops | SCR-001 | Share of overnight stops at approved secure parking | YYYY-MM-DD | Transport manager |
| OBJ-02 (Example): verified seal on every container hand-over | SCR-002, SCR-005 | Seal verification records complete | YYYY-MM-DD | Logistics manager |
| OBJ-03 (Example): carrier identity check at every collection | SCR-004 | Collections with identity check recorded | YYYY-MM-DD | Site security lead |
6. Controls by area
6.1 Physical security of facilities
| ID | Control | Applies to |
|---|---|---|
| CTL-PHY-01 (Example) | Perimeter fencing, gates controlled 24 hours, lighting of yard and docks | Distribution centres |
| CTL-PHY-02 (Example) | Intrusion alarm monitored by a receiving centre, tested monthly | All sites |
| CTL-PHY-03 (Example) | CCTV covering gates, docks and high-value cage, recordings kept [30] days | Distribution centres |
| CTL-PHY-04 (Example) | High-value goods in a locked cage with access logging | Distribution centres |
6.2 Access control
| ID | Control |
|---|---|
| CTL-ACC-01 (Example) | Badge access by zone; visitors signed in, escorted, badges returned |
| CTL-ACC-02 (Example) | Drivers stay in a waiting area unless their task requires dock access |
| CTL-ACC-03 (Example) | Keys and access rights removed on the day a person leaves |
6.3 Personnel security
| ID | Control |
|---|---|
| CTL-PER-01 (Example) | Pre-employment checks for roles with access to high-value goods, within the limits of local employment and data protection law |
| CTL-PER-02 (Example) | Security awareness at induction and yearly (section 10) |
| CTL-PER-03 (Example) | Confidential route for reporting suspicious activity |
6.4 Conveyances, containers and seals
| ID | Control |
|---|---|
| CTL-SEAL-01 (Example) | Containers and trailers sealed with high-security bolt seals; seal numbers recorded on documents and verified at every hand-over |
| CTL-SEAL-02 (Example) | Container and trailer inspection before loading (walls, floor, ceiling, doors, undercarriage) with a checklist |
| CTL-COV-01 (Example) | Carrier identity checked against the booking (driver ID, vehicle registration, pickup reference) before loading |
| CTL-COV-02 (Example) | Overnight and long stops only at approved secure parking |
| CTL-COV-03 (Example) | Tracking on high-value loads with alerts on route deviation or unplanned stops |
6.5 Information and documents
| ID | Control |
|---|---|
| CTL-INF-01 (Example) | Shipment data available only to roles that need it; booking and tracking platforms use strong authentication |
| CTL-INF-02 (Example) | Documents checked for consistency (weight, piece count, seal number) at each hand-over |
6.6 Procedural controls
| ID | Control |
|---|---|
| CTL-PRO-01 (Example) | Shipping and receiving reconciled against orders and advance notices; discrepancies investigated |
| CTL-PRO-02 (Example) | Agricultural and pest contamination checks on containers where required |
7. Business partner requirements
| ID | Partner type | Requirement (Example) | Evidence | Check |
|---|---|---|---|---|
| CTL-PRT-01 | Suppliers stuffing containers | Container inspection, supervised loading, seal applied and recorded | Loading photographs, seal records | Sample audit yearly |
| CTL-PRT-02 | Road hauliers | Driver identity, secure parking, tracking on high-value loads, incident reporting within [2] hours | Carrier security questionnaire, tracking reports | Questionnaire yearly, review after incidents |
| CTL-PRT-03 | Freight forwarders | Customs security status or equivalent controls | AEO or CTPAT status, or completed questionnaire | Status checked at onboarding and yearly |
| CTL-PRT-04 | Third-party warehouses | Physical, access and personnel controls equivalent to section 6 | Site audit report | Audit every [2] years |
Questions for partner onboarding:
- Does the partner hold a customs security status recognised by your authority, and is it current?
- Who in the partner's organization handles security incidents, and how fast will they inform you?
- Does the partner subcontract, and do subcontractors meet the same requirements?
Supplier security questionnaires for information security are covered
in compliance/supplier-security-assessment; sanctions screening of
partners in compliance/sanctions-exposure-assessment.
8. Incident response and recovery
| Incident type | First action | Notify | Time limit (check your obligations) |
|---|---|---|---|
| Cargo theft or hijack | Ensure driver safety, call police | Insurer, customer, customs if goods under customs control | [Per insurer and customs rules] |
| Broken or wrong seal at hand-over | Do not open; photograph; quarantine | Shipper, carrier, customs where applicable | [Immediately] |
| Suspected contraband found | Stop work, do not touch, secure area | Customs and police | [Immediately] |
| Intrusion at site | Alarm response, police | Site security lead | [Immediately] |
Loss of a site or a lane for longer than [48] hours triggers the
business continuity plan (compliance/business-continuity).
9. Customs security programmes and certification map
| Programme or standard | Status | Where criteria are published | Mapped controls |
|---|---|---|---|
| ISO 28000:2022 (with Amd 1:2024) | [Aligned / certification planned / certified] | ISO, purchase or licensed access | Sections 1 to 12 of this plan |
| EU Authorised Economic Operator, security and safety (AEOS) | [Held / applying / not applicable] | European Commission; criteria in Article 39 of the Union Customs Code | Sections 6 and 7 |
| US CTPAT | [Member / applying / not applicable] | US Customs and Border Protection, Minimum Security Criteria by business entity type | Sections 6, 7 and 10 |
| US hazardous materials security plans | [Applies if you offer or carry certain hazardous materials] | 49 CFR Part 172, Subpart I | Section 6 and the dangerous goods checklist |
| Other national programmes | [Name] | [Authority] | [Sections] |
As of October 2026 the European Commission page lists three AEO authorisation types: customs simplifications (AEOC), security and safety (AEOS), and a combination of both. Security and safety measures are a criterion for AEOS only. CBP publishes CTPAT Minimum Security Criteria separately for each business entity type, such as importers, exporters, highway carriers and third-party logistics providers. Check both pages for the current criteria before mapping.
ISO 28000:2022 uses the common management system structure: context of the organization (clause 4), leadership (clause 5), planning (clause 6), support (clause 7), operation (clause 8), performance evaluation (clause 9) and improvement (clause 10). This plan follows that order.
10. Training and awareness
| Audience | Topics (Example) | Frequency | Record |
|---|---|---|---|
| All site staff | Reporting suspicious activity, access rules, tailgating | Induction and yearly | Training system |
| Dock and dispatch staff | Seal verification, carrier identity check, container inspection | Induction and yearly | Training system |
| Drivers (own fleet and contracted) | Secure parking, route discipline, hijack response | Before first load and yearly | Carrier records |
| Managers | Incident response, evidence protection, risk acceptance | Yearly | Training system |
11. Monitoring, audit and review
| Measure | Target (Example) | Frequency | Owner |
|---|---|---|---|
| Cargo loss value on controlled lanes | Below [value] per quarter | Monthly | Supply chain security manager |
| Seal verification records complete | 100% | Monthly sample | Logistics manager |
| Partners meeting requirements | 100% on controlled lanes | Quarterly | Procurement |
| Security incidents and near misses reported | Trend reviewed | Monthly | Site security leads |
| Internal audit findings closed on time | 90% | Quarterly | Supply chain security manager |
Internal audit: every site and every requirement of this plan at least once every [12] months. Management review: at least yearly, covering incidents, audit results, risk changes, partner performance and resources.
12. Improvement and corrective action
| ID | Source | Finding | Root cause | Corrective action | Owner | Due | Effective? |
|---|---|---|---|---|---|---|---|
| CAR-001 (Example) | Incident SCR-001 | Driver parked at an unapproved stop | Approved parking list not on driver app | Add list to app, brief carriers | Transport manager | YYYY-MM-DD | [Check after 3 months] |
Use business/root-cause-analysis for structured cause analysis.
13. Glossary and references
| Term | Meaning |
|---|---|
| AEO | Authorised Economic Operator, an EU customs status (AEOC, AEOS or both) |
| CTPAT | Customs Trade Partnership Against Terrorism, a voluntary US CBP programme |
| High-security seal | A seal designed to resist tampering and show evidence of it, with a unique number |
| Custody hand-over | A point where responsibility for goods passes to another party |
| Inherent and residual risk | Risk before and after controls |
References (checked October 2026):
- ISO 28000:2022, Security and resilience, Security management systems, Requirements, and Amendment 1:2024 (climate action changes). Official text: ISO, purchase or licensed access: https://www.iso.org/standard/79612.html (also sold by national standards bodies, for example https://www.evs.ee/en/iso-28000-2022).
- European Commission, Authorised Economic Operator: https://taxation-customs.ec.europa.eu/customs-4/aeo-authorised-economic-operator/what-aeo_en
- US Customs and Border Protection, CTPAT: https://www.cbp.gov/border-security/ports-entry/cargo-security/ctpat
- US 49 CFR Part 172, Subpart I, Safety and Security Plans: https://www.ecfr.gov/current/title-49/subtitle-B/chapter-I/subchapter-C/part-172/subpart-I
- WCO SAFE Framework of Standards, the international basis for AEO programmes (check the current edition at https://www.wcoomd.org/).
- Related templates:
security/supply-chain-security(software),compliance/risk-methodology,compliance/risk-register,compliance/business-continuity,compliance/supplier-security-assessment,compliance/sanctions-exposure-assessment,logistics/warehouse-sop,logistics/dangerous-goods-checklist,mba/mba-supply-chain-resilience-card.
Standard and licence note
Structure aligned with ISO 28000:2022, Security and resilience, Security management systems, Requirements, including Amendment 1:2024 (top-level clauses 4 to 10 named only). ISO 28000 is a paid standard: this template reproduces none of its text, requirements or definitions, and every explanation is original wording. Official text: ISO, purchase or licensed access: https://www.iso.org/standard/79612.html, also available from national standards bodies. Customs programmes (EU AEO, US CTPAT) and US federal rules are named with links to the official pages, checked in October 2026, and paraphrased only. Check the current official versions before use. This is a documentation format, not legal advice.
Template licence: MIT.
関連テンプレート
Sales and Operations Plan Template (S&OP Monthly Cycle)
S&OP cycle, time fences, demand review with accuracy and bias, supply review, inventory projection, financial reconciliation, scenarios, decisions, KPIs
物流・サプライチェーンCarrier Scorecard Template
Carrier performance: definitions and weights, scoring bands, on-time, damage, cost index, invoice accuracy, weighted score, claims log, rating and actions
物流・サプライチェーンDangerous Goods Shipment Checklist Template (IATA DGR, IMDG)
Rule books by mode, classification, UN classes, packaging, marking and labelling, declaration, training and security, carrier hand-over