ISO 37001
International standard for anti-bribery management systems
ISO 28000
International standard for supply chain security management systems
Quick Verdict
ISO 37001 provides anti-bribery management systems for all organizations worldwide, mitigating corruption risks through due diligence and controls. ISO 28000 establishes supply chain security frameworks for logistics-heavy sectors, enhancing resilience against theft and disruptions. Companies adopt them for compliance, risk reduction, and certification credibility.
ISO 37001
ISO 37001:2025 Anti-Bribery Management Systems
Key Features
- Risk-based bribery risk assessment and controls
- Third-party due diligence and monitoring requirements
- Leadership commitment and anti-bribery policy mandates
- PDCA cycle for continual improvement
- Internationally certifiable management system standard
ISO 28000
ISO 28000:2022 Security management systems — Requirements
Key Features
- Risk-based supply chain security assessment and treatment
- PDCA cycle for continual SMS improvement
- Controls for external providers and processes
- Integration with ISO 31000 and 22301 standards
- Documented security plans and incident response
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
ISO 37001 Details
What It Is
ISO 37001:2025 is an international certifiable standard for Anti-Bribery Management Systems (ABMS). It provides requirements and guidance to prevent, detect, and respond to bribery risks. Scope covers direct/indirect bribery by/for organizations, personnel, and associates across sectors/sizes. Employs a risk-based, proportionate approach via PDCA (Plan-Do-Check-Act) harmonized structure.
Key Components
- Clauses 4-10: context, leadership, planning, support, operation, evaluation, improvement.
- Core controls: policy, risk assessment, due diligence, financial/non-financial controls, training, reporting/investigations.
- Built on ISO Harmonized Structure for integration (e.g., ISO 9001).
- Optional third-party certification with audits.
Why Organizations Use It
Mitigates legal risks (FCPA, UK Bribery Act), reduces liability via "reasonable steps" evidence. Drives efficiencies (15% compliance cost cuts), builds trust, enhances reputation/ESG. Addresses 95% third-party bribery cases.
Implementation Overview
Phased: gap analysis, risk assessment, controls/training, audits. Scalable for SMEs/multinationals; 6-12 months typical. Certification involves Stage 1/2 audits, annual surveillance.
ISO 28000 Details
What It Is
ISO 28000:2022 is an international standard specifying requirements for security management systems (SMS) focused on supply chain security. It adopts a risk-based, PDCA (Plan-Do-Check-Act) approach to manage threats like theft, sabotage, and disruptions.
Key Components
- Clauses 4-10 cover context, leadership, planning, support, operation, evaluation, and improvement.
- Emphasizes risk assessment (aligned with ISO 31000), operational controls, and security plans.
- Built on harmonized ISO structure for integration; supports third-party certification per ISO 28003.
Why Organizations Use It
- Reduces supply chain risks and incidents.
- Meets contractual, regulatory, and insurance needs.
- Enhances resilience, market access, and partner trust.
- Provides governance for compliance and continuity.
Implementation Overview
- Phased: gap analysis, risk assessment, controls, audits.
- Applicable to all sizes/industries; tailored proportionality.
- Involves training, supplier controls, internal audits, management reviews; optional certification via Stage 1/2 audits.
Key Differences
| Aspect | ISO 37001 | ISO 28000 |
|---|---|---|
| Scope | Anti-bribery management systems | Supply chain security management |
| Industry | All sectors worldwide | Logistics, manufacturing, transport |
| Nature | Voluntary certifiable standard | Voluntary certifiable standard |
| Testing | Internal audits, certification audits | Internal audits, certification audits |
| Penalties | No legal penalties, certification loss | No legal penalties, certification loss |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about ISO 37001 and ISO 28000
ISO 37001 FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
TISAX Tabletop Exercises for ADAS Suppliers: Simulating Prototype IP Leaks and Ransomware in Hybrid Supply Chains (2025 Edition with Hero Scenario Visual)
Master TISAX 'Very High' tabletop exercises for ADAS suppliers with 2024 breach simulations like CAD leaks and ransomware. Get scripts, AAR templates, hybrid ti
The SOC Maturity Roadmap: A 5-Step Blueprint for Scaling from Ad-Hoc to Optimized Operations
Unlock SOC excellence with our 5-step maturity roadmap. Compare SOC-CMM, NIST CSF, and CMMC frameworks to scale from ad-hoc to automated operations. Start your
CIS Controls v8.1 for Cloud & Kubernetes: A Practical Implementation Playbook (AWS/Azure/GCP + IaC)
Translate CIS Controls v8.1 to cloud-native: Kubernetes patterns for IAM, logging, vuln mgmt, hardening on AWS, Azure, GCP + IaC. Practical playbook for teams.
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
Six Sigma vs 23 NYCRR 500
Explore Six Sigma vs 23 NYCRR 500: Harness DMAIC for NYDFS cybersecurity compliance, risk reduction & process excellence. Unlock strategies to align quality with regs now!
ISA 95 vs CSA
Compare ISA-95 vs CSA: ISA-95 enables ERP-MES integration for manufacturing efficiency; CSA Z1000/Z1002 ensures OHS compliance. Key differences, benefits & strategies. Dive in!
C-TPAT vs CIS Controls
Compare C-TPAT vs CIS Controls: Master supply chain security & cybersecurity frameworks. Discover key differences, implementation tips, benefits & gaps for compliance success. Optimize now!