What is the primary objective of ISA 95?

ISA 95 is an international standard series defining models and interfaces for integrating enterprise business systems with manufacturing control systems. It organizes technology and processes into Purdue-based levels 0–4, primarily focusing on the Level 3 (manufacturing operations management, e.g., MES/SCADA) and Level 4 (business planning/logistics, e.g., ERP) interface to reduce integration risk, cost, and errors. The nine parts provide activity models, object/attribute models (e.g., equipment hierarchy, materials, personnel), transactions, messaging services, alias mapping, exchange profiles, and common object models, enabling consistent semantics and collaboration between IT and manufacturing personnel.

Who is legally or professionally required to comply with ISA 95?

No organizations are legally required to comply with ISA 95, as it is a voluntary, technology-agnostic reference architecture. Professionally, it applies to manufacturing enterprises (discrete, continuous, batch) implementing MES/MOM, ERP integrations, or IT/OT convergence, including plant managers, IT/OT architects, system integrators, and vendors needing shared terminology for equipment hierarchies, production schedules, and data exchanges across Levels 3–4.

Does ISA 95 require an external audit or third-party certification?

ISA 95 does not require external audits or third-party certification, lacking formal conformance criteria or product certification mechanisms. Compliance is demonstrated through architectural alignment with its models (e.g., levels, activities, objects), consistent information exchanges, and optional individual training via the ISA-95/IEC 62264 Enterprise-Control System Integration Certificate Program.

How often should an assessment for ISA 95 be performed?

ISA 95 assessments should be performed during initial implementation and periodically as part of change management, with no fixed frequency specified. Align reviews with equipment hierarchy updates, integration changes, or system lifecycles (per Parts 3–4), treating adoption as an operating model initiative with ongoing governance for data models, transactions (Parts 5–8), and security segmentation.

What are the consequences of non-compliance with ISA 95?

Non-compliance with ISA 95 carries no legal penalties, as it is a non-mandatory standard. Consequences include increased integration costs, errors, and risks at the Level 3–4 boundary; semantic misalignment; poor IT/OT collaboration; and failure to achieve benefits like reduced risk in manufacturing operations, equipment capability tracking, and scalable Industry 4.0 data flows.

Can ISA 95 be mapped to other international frameworks?

Yes, ISA 95’s Purdue levels and models map to frameworks like PERA, OPC UA, and ICS security standards such as NIST 800-82. Its hierarchical structure (Levels 0–4), activity models (Part 3), and object models (Parts 2/4) support cybersecurity segmentation (e.g., Level 3.5 DMZ), while transactions (Part 5) and messaging (Part 6) align with modern IIoT/event streaming, enabling semantic consistency without prescribing technologies.

What is the first step to begin implementing ISA 95?

The first step is mapping current systems and processes to ISA 95’s Levels 0–4 hierarchy via a cross-functional workshop. Identify Level 3–4 interface gaps, define equipment hierarchies (Part 1), and establish shared terminology for objects (materials, personnel, production) to clarify boundaries, data ownership, and priority transactions, forming the basis for canonical models and governance.

What is the primary objective of ISO 28000?

ISO 28000 specifies requirements for establishing, implementing, maintaining, and continually improving a security management system (SMS) with explicit relevance to supply chain security. It operationalizes a Plan-Do-Check-Act (PDCA) cycle across Clauses 4–10, requiring organizations to assess security risks (malicious acts, disruptions, interdependencies), define scope including external processes, embed top management leadership, and integrate risk treatment aligned with ISO 31000. The SMS governs policy, objectives, operational controls, performance evaluation via audits and reviews, and continual improvement, turning episodic security into a holistic governance capability applicable to all organization sizes and activities.

Who is legally or professionally required to comply with ISO 28000?

ISO 28000 is voluntary and not legally mandatory, but professionally required for organizations facing supply chain security risks or stakeholder demands. It applies to all types and sizes—logistics providers, manufacturers, retailers, ports, government agencies—handling goods transport, storage, or related activities. Compliance is driven by customer/partner requirements, contractual flow-downs, insurance incentives, trade facilitation programs, or due diligence for high-risk sectors like pharmaceuticals and defense, where weakest-link vulnerabilities demand structured SMS assurance.

Does ISO 28000 require an external audit or third-party certification?

ISO 28000 requires internal audits at planned intervals but supports optional external verification or third-party certification. Clause 9.2 mandates a risk-based internal audit program to evaluate SMS conformity and effectiveness, with documented results. External audits follow ISO 28003 guidelines for certification bodies, typically via Stage 1 (documentation review) and Stage 2 (implementation), followed by surveillance. Certification demonstrates maturity to stakeholders but is an outcome of sustained PDCA, not a prerequisite.

How often should an assessment for ISO 28000 be performed?

Risk assessments under ISO 28000 must be maintained continuously, with formal reviews at planned intervals tied to changes and performance data. Clause 8.3 requires an ongoing risk assessment and treatment process aligned with ISO 31000, considering threats, vulnerabilities, and interdependencies. Clause 9.1 specifies monitoring/measurement analysis, while management reviews (Clause 9.3) and internal audits (Clause 9.2) occur at planned intervals, risk-informed by prior results, incidents, or context shifts like new suppliers.

What are the consequences of non-compliance with ISO 28000?

Non-compliance with ISO 28000 risks operational disruptions, financial losses, and loss of market access, though it imposes no direct legal penalties as a voluntary standard. Failure to maintain the SMS exposes organizations to unmitigated security incidents (theft, sabotage), regulatory scrutiny in trade programs, contractual defaults, higher insurance premiums, and reputational damage. Internally, inadequate risk treatment, audit failures, or unaddressed nonconformities (Clause 10) erode governance, amplifying supply chain vulnerabilities.

Can ISO 28000 be mapped to other international frameworks?

Yes, ISO 28000:2022 aligns structurally with Annex SL-based standards, enabling integrated management systems. Its PDCA clauses (4–10) harmonize with ISO 9001, ISO 14001, ISO/IEC 27001, ISO 45001, and ISO 22301 for shared audits, documentation, and reviews. Clause 8 references ISO 31000 for risk processes and ISO 22301 for security plans, while ISO 22300 provides normative vocabulary, facilitating governance without duplication.

What is the first step to begin implementing ISO 28000?

The first step is determining the organization’s context, interested parties, and SMS scope per Clause 4. Map internal/external issues (threats, regulations, supply chain dependencies), identify relevant stakeholders and requirements (Clause 4.2), and document boundaries including externally provided processes. This foundational analysis informs policy, risks, and tailoring, ensuring proportionality across all sizes/sectors before proceeding to leadership commitment (Clause 5).

Standards Comparison

ISA 95 vs ISO 28000

ISA 95

Voluntary

2000

International standard for enterprise-manufacturing control integration

ISO 28000

Voluntary

2022

International standard for supply chain security management systems

Quick Verdict

ISA-95 provides integration models for manufacturing enterprises, while ISO 28000 establishes security management systems for supply chains. Manufacturers adopt ISA-95 to reduce ERP-MES errors; logistics firms use ISO 28000 for risk governance, audits, and resilience.

Enterprise-Control Integration

ISA 95

ANSI/ISA-95 Enterprise-Control System Integration

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Defines Purdue levels 0-4 boundaries
Standardizes equipment/material/personnel objects
Specifies manufacturing operations activity models
Defines Level 3-4 information exchanges
Provides alias services for identifiers

Supply Chain Security

ISO 28000

ISO 28000:2022 Security management systems — Requirements

Cost

€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Risk-based PDCA management system for supply chains
Explicit supplier and external process controls
Integrated security plans and incident response
Leadership commitment with measurable objectives
Alignment with ISO 31000 and 22301 standards

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISA 95 Details

What It Is

ANSI/ISA-95 (IEC 62264) is an international framework standard for integrating enterprise business systems with manufacturing control systems. It uses a Purdue model-based hierarchy (Levels 0-4) to define boundaries, activities, and information exchanges, focusing on the critical Level 3-4 interface between MES/MOM and ERP.

Key Components

Nine parts: models/terminology (Part 1), objects/attributes (Parts 2/4), activities (Part 3), transactions (Part 5), messaging/aliasing/profiles (Parts 6-8), and common object models (Part 9).
Core elements: equipment hierarchy, activity models (production/quality/maintenance), object semantics (materials/equipment/personnel).
Built on Purdue Reference Model; no formal product certification, but training certificates available.

Why Organizations Use It

Reduces integration risks/costs/errors via shared semantics; enables data consistency for OEE, traceability, analytics. Supports IT/OT collaboration, regulatory compliance, cybersecurity segmentation; provides competitive agility in Industry 4.0.

Implementation Overview

Phased approach: assess gaps, define canonical models, pilot integrations, govern data/messaging. Applies to manufacturing firms globally; requires cross-functional teams, no mandatory audits but self-compliance via models/transactions.

ISO 28000 Details

What It Is

ISO 28000:2022 is an international standard specifying requirements for a security management system (SMS) focused on supply chain security. It adopts a risk-based, PDCA (Plan-Do-Check-Act) approach to manage threats like theft, sabotage, and disruptions.

Key Components

Clauses 4-10 cover context, leadership, planning, support, operation, evaluation, and improvement.
Emphasizes risk assessment (aligned with ISO 31000), operational controls, security plans, and supplier interdependencies.
No fixed controls; tailored via risk treatment.
Supports certification per ISO 28003.

Why Organizations Use It

Reduces supply chain risks and incidents.
Meets contractual, regulatory, and insurance needs.
Enhances resilience, compliance, and market access.
Builds stakeholder trust through audits.

Implementation Overview

Phased: gap analysis, risk assessment, controls, training, audits.
Scalable for all sizes/industries; integrates with ISO 9001/22301.
Certification via Stage 1/2 audits.

Key Differences

Aspect	ISA 95	ISO 28000
Scope	Enterprise-manufacturing system integration models	Supply chain security management system
Industry	Manufacturing, discrete/continuous/process industries	Logistics, all supply chain sectors globally
Nature	Voluntary reference architecture standard	Voluntary management system certification standard
Testing	No formal certification; self-assessed conformance	Internal/external audits; third-party certification
Penalties	None; integration risks/costs if ignored	None; loss of certification/reputation

Scope

ISA 95

Enterprise-manufacturing system integration models

ISO 28000

Supply chain security management system

Industry

ISA 95

Manufacturing, discrete/continuous/process industries

ISO 28000

Logistics, all supply chain sectors globally

Nature

ISA 95

Voluntary reference architecture standard

ISO 28000

Voluntary management system certification standard

Testing

ISA 95

No formal certification; self-assessed conformance

ISO 28000

Internal/external audits; third-party certification

Penalties

ISA 95

None; integration risks/costs if ignored

ISO 28000

None; loss of certification/reputation

Frequently Asked Questions

Common questions about ISA 95 and ISO 28000

ISA 95 FAQ

ISO 28000 FAQ

You Might also be Interested in These Articles...

Using CIS Controls v8.1 as a ‘Compliance On-Ramp’: Map One Security Program to NIST CSF, ISO 27001, PCI DSS, and NIS2

Use CIS Controls v8.1 as your compliance on-ramp. Map one security program to NIST CSF, ISO 27001, PCI DSS, and NIS2 without duplicating work via practical mapp

5 Ways Modern Compliance Software Makes Evolving Regulations Your Strategic Advantage

Discover 5 ways modern compliance software turns evolving regulations into strategic advantage. Automate monitoring, cut 3x non-compliance costs, stay audit-rea

Real-World ISO 27701 Success: Synthesized Case Studies, Metrics, and Lessons for Privacy Resilience

Real-world ISO 27701 success from Tribeca, Kocho: DSAR efficiency gains, risk score reductions, certification ROI. Synthesized metrics prove privacy resilience

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISA 95 and ISO 28000 compare against other standards

Other ISA 95 Comparisons

Other ISO 28000 Comparisons

What It Is

Key Components

Nine parts: models/terminology (Part 1), objects/attributes (Parts 2/4), activities (Part 3), transactions (Part 5), messaging/aliasing/profiles (Parts 6-8), and common object models (Part 9).

Core elements: equipment hierarchy, activity models (production/quality/maintenance), object semantics (materials/equipment/personnel).

Built on Purdue Reference Model; no formal product certification, but training certificates available.

Key Components

Clauses 4-10 cover context, leadership, planning, support, operation, evaluation, and improvement.

Emphasizes risk assessment (aligned with ISO 31000), operational controls, security plans, and supplier interdependencies.

No fixed controls; tailored via risk treatment.

Supports certification per ISO 28003.

Aspect

ISA 95

ISO 28000

Scope

Enterprise-manufacturing system integration models

Supply chain security management system

Industry

Manufacturing, discrete/continuous/process industries

Logistics, all supply chain sectors globally

Nature

Voluntary reference architecture standard

Voluntary management system certification standard

Testing

No formal certification; self-assessed conformance

Internal/external audits; third-party certification

Penalties

None; integration risks/costs if ignored

None; loss of certification/reputation