ISO 26000
International guidance for social responsibility integration
ISO 28000
International standard for supply chain security management systems.
Quick Verdict
ISO 26000 offers non-certifiable guidance on social responsibility principles for all organizations, while ISO 28000 provides certifiable requirements for supply chain security management. Companies adopt 26000 for holistic SR integration and 28000 for resilient, auditable security.
ISO 26000
ISO 26000:2010 Guidance on social responsibility
Key Features
- Explicitly non-certifiable guidance standard
- Seven principles underpinning SR behavior
- Seven interconnected core subjects
- Multi-stakeholder consensus from 500+ experts
- Universal applicability to all organizations
ISO 28000
ISO 28000:2022 Security management systems — Requirements
Key Features
- Risk-based supply chain security management framework
- PDCA cycle with continual improvement requirements
- Integration via ISO High Level Structure
- Supplier and third-party risk governance
- Certification with internal/external audits
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
ISO 26000 Details
What It Is
ISO 26000:2010 is a non-certifiable international guidance standard providing a framework for social responsibility (SR). Its primary purpose is to help organizations integrate SR into governance, strategy, and operations across all sectors, sizes, and locations. It uses a principles-based, stakeholder-engaged approach emphasizing context-specific prioritization of impacts.
Key Components
- Seven **core principlesaccountability, transparency, ethical behavior, respect for stakeholder interests, rule of law, international norms, human rights.
- Seven **core subjectsorganizational governance, human rights, labor practices, environment, fair operating practices, consumer issues, community involvement.
- No auditable requirements; focuses on holistic integration rather than certification.
Why Organizations Use It
- Enhances sustainability commitment, risk management, and stakeholder trust.
- Aligns with SDGs, OECD, GRI for credible reporting.
- Builds resilience, reduces reputational risks, improves operational efficiency.
- Provides competitive edge through transparent SR communication.
Implementation Overview
- Phased approach: materiality assessment, stakeholder engagement, policy integration, training, reporting.
- Integrates with ISO 14001/45001 systems.
- Applicable universally; no certification, uses self-assessment and external assurance.
ISO 28000 Details
What It Is
ISO 28000:2022 is an international management system standard titled Security and resilience — Security management systems — Requirements. It provides a risk-based framework for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain protection against threats like theft, sabotage, and disruptions.
Key Components
- Core clauses follow PDCA cycle and ISO High Level Structure (context, leadership, planning, support, operation, evaluation, improvement).
- Emphasizes risk assessment, controls (physical, personnel, procedural), incident response, and supplier governance.
- No fixed controls; scalable to organization size.
- Supports third-party certification via accredited bodies per ISO 28003.
Why Organizations Use It
- Reduces incidents, insurance costs, and disruptions.
- Meets contractual/regulatory demands (e.g., C-TPAT equivalents).
- Enhances resilience, market access, and stakeholder trust.
- Integrates with ISO 27001, ISO 22301 for efficiency.
Implementation Overview
- Phased approach: scoping, gap analysis, risk assessment, deployment, audits.
- Applicable to all sizes/industries in logistics, manufacturing, etc.
- Involves training, supplier engagement, KPIs; certification optional but common.
Key Differences
| Aspect | ISO 26000 | ISO 28000 |
|---|---|---|
| Scope | Social responsibility core subjects, principles | Supply chain security risks, resilience |
| Industry | All organizations, all sectors globally | Supply chain, logistics, manufacturing worldwide |
| Nature | Non-certifiable guidance standard | Certifiable management system standard |
| Testing | Self-assessment, stakeholder reporting | Internal/external audits, certification audits |
| Penalties | No formal penalties, reputational risk | Loss of certification, no legal penalties |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about ISO 26000 and ISO 28000
ISO 26000 FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
The DORA 'Hot Seat' Blueprint: Preparing Leadership and the Management Body for Regulatory Interviews
Prepare your Board & Management Body for DORA audits. Master the human element: demonstrate active oversight & accountability in regulatory interviews. Get the
Top 5 Reasons NIST SP 800-53 Rev 5 Overlays Unlock AI Risk Management for Private Sector Enterprises in 2025
Top 5 reasons NIST SP 800-53 Rev 5 AI overlays unlock risk management for private enterprises. Tailorable controls combat model poisoning & data leakage. CISO i
NIST CSF 2.0 Plain English Decoder: Translating Govern, Supply Chain, and Core Functions from Jargon to Actionable Insights
Demystify NIST CSF 2.0 jargon with plain English tables for Govern, Supply Chain & Core Functions. Actionable steps for risk oversight & vendor management. Empo
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
PMBOK vs COBIT
PMBOK vs COBIT: Compare project management standards vs IT governance frameworks. Unlock strategies, pitfalls, benefits for value delivery, compliance & success. Discover now!
ISO 9001 vs APPI
Uncover ISO 9001 vs APPI: Compare global QMS excellence with Japan's data privacy law. Boost compliance, efficiency & trust. Essential insights for business leaders.
NIST 800-53 vs NERC CIP
Compare NIST 800-53 vs NERC CIP: Key differences in controls, baselines & risk management for federal & grid security. Boost compliance—expert insights await!