Basel III
Global framework strengthening bank capital, leverage, liquidity resilience
ISO 28000
International standard for supply chain security management systems.
Quick Verdict
Basel III enforces capital, leverage, and liquidity standards for global banks to ensure financial stability. ISO 28000 provides a voluntary security management framework for supply chains across industries. Banks adopt Basel III for regulatory compliance; others use ISO 28000 for resilience and certification.
Basel III
Basel III: Finalising post-crisis reforms
Key Features
- Elevates CET1 capital minimum to 4.5% plus buffers
- Introduces 3% non-risk-based leverage ratio backstop
- Mandates LCR for 30-day HQLA stress coverage
- Requires NSFR for one-year stable funding resilience
- Imposes output floor constraining internal model RWAs
ISO 28000
ISO 28000:2022 Security management systems — Requirements
Key Features
- Risk-based supply chain threat assessment and treatment
- PDCA cycle for continual security improvement
- Leadership commitment and integrated SMS policy
- Controls for external providers and processes
- Alignment with ISO 31000 and ISO 22301
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
Basel III Details
What It Is
Basel III is the global prudential regulatory framework issued by the Basel Committee on Banking Supervision (BCBS) post-2007-09 financial crisis. It enhances bank resilience through higher-quality capital, leverage constraints, and liquidity standards. Its risk-based approach combines Pillar 1 minimums with supervisory review and disclosures.
Key Components
- **Three PillarsCapital requirements (CET1 4.5%, Tier 1 6%, Total 8% + buffers), supervisory review (Pillar 2), market discipline (Pillar 3).
- Capital buffers: Conservation (2.5%), countercyclical, G-SIB/D-SIB.
- Leverage ratio (3%), LCR (100% HQLA for 30-day stress), NSFR (stable funding over 1 year).
- Output floor (72.5% of standardized RWAs); no formal certification, but jurisdictional compliance.
Why Organizations Use It
Banks adopt it for regulatory compliance, as jurisdictions mandate via domestic laws. It mitigates systemic risk, improves funding costs, enhances resilience against shocks, boosts investor confidence, and curbs arbitrage via comparability.
Implementation Overview
Phased enterprise transformation: gap analysis, data/system upgrades, model validation, ICAAP integration. Applies to internationally active banks; varies by jurisdiction/size. Involves PMO governance, QIS testing, ongoing reporting—no central certification, but supervisory audits.
ISO 28000 Details
What It Is
ISO 28000:2022 — Security management systems — Requirements is an international certification standard specifying requirements for a security management system (SMS) to manage supply chain security risks. It employs a risk-based PDCA (Plan-Do-Check-Act) cycle, aligned with ISO 31000 and ISO 22301.
Key Components
- Clauses 4–10: context, leadership, planning, support, operation, evaluation, improvement.
- Risk assessment/treatment processes.
- Operational controls for processes, suppliers, equipment.
- Internal audits, management reviews; certification per ISO 28003.
Why Organizations Use It
- Mitigate threats like theft, sabotage, disruptions.
- Meet contractual, regulatory demands.
- Reduce incidents, insurance costs.
- Enhance resilience, market access, stakeholder trust.
Implementation Overview
- Phased: gap analysis, risk assessment, controls deployment, audits.
- Scalable for all sizes/industries.
- Certification via accredited bodies (6–36 months typical).
Key Differences
| Aspect | Basel III | ISO 28000 |
|---|---|---|
| Scope | Bank capital, leverage, liquidity ratios | Supply chain security management system |
| Industry | Banking sector globally | All industries, supply chain focused |
| Nature | Global prudential regulatory standards | Voluntary management system certification |
| Testing | Pillar 2 supervisory review, stress tests | Internal audits, management reviews, certification |
| Penalties | Regulatory enforcement, capital restrictions | Loss of certification, no legal penalties |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about Basel III and ISO 28000
Basel III FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
Top 10 NIST CSF 2.0 Myths Busted: Separating Hype from Reality for Smarter Adoption
Bust 10 NIST CSF 2.0 myths like 'only for critical infrastructure' or 'Govern replaces Identify'. Plain-English breakdowns, evidence, and fixes for flexible ris
SOC 2 Trust Services Criteria in Plain English: Side-by-Side Decoder for Security, Availability, and Beyond
Decode AICPA Trust Services Criteria from auditor jargon to plain English with side-by-side tables, analogies & TL;DRs. CISOs & founders: implement SOC 2 contro
The Tool Landscape for Reaching and Maintaining ISO 27701 Compliance
Discover the top tools for ISO 27701 compliance. Compare functionality, complexity, costs, and benefits to choose the best solution for your privacy program. Ac
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
ISO 20000 vs LEED
ISO 20000 vs LEED: Compare IT service management certification with green building standards. Boost reliability, trust, risk reduction & sustainability. Dive in now!
TISAX vs ISO/IEC 42001:2023
Explore TISAX vs ISO/IEC 42001:2023—automotive cybersecurity meets AI management. Uncover differences, overlaps & strategies for supply chain excellence. Boost compliance today!
ISO 27001 vs ISO 37301
Compare ISO 27001 vs ISO 37301: InfoSec mastery vs full compliance systems. Uncover differences, benefits, risks & implementation guide to choose wisely. Boost resilience now!