Resilience & Supply Chain
Disruption comes from outages, suppliers, security incidents and extreme events. Continuity, security and risk standards help you anticipate it, respond and recover. We help you choose the right combination and prepare for certification.
Start from the disruption you must withstand
ISO 22301 and ISO 28000 are certifiable management systems. ISO 18788 covers security operations, and ISO 31000 gives the risk management principles behind them all.
Keep critical activities running through disruption, with tested plans.
ISO 22301 → Security management ISO 28000 ISO 28000:2022Protect people, assets and cargo across operations and supply chains.
ISO 28000 → Security operations ISO 18788 Private security providersManagement of private security operations and their risks.
ISO 18788 → Risk management ISO 31000 GuidelinesRisk principles and process behind every management system.
ISO 31000 →Side by side
| Standard | Answers the question | Certifiable | Who decides | Typical engagement |
|---|---|---|---|---|
| ISO 22301 | Can we keep operating through disruption? | Yes | Accredited certification body | 4 to 9 months |
| ISO 28000 | Are people, assets and cargo secure? | Yes | Accredited certification body | 4 to 9 months |
| ISO 18788 | Are security operations controlled? | Yes | Accredited certification body | 6 to 9 months |
| ISO 31000 | Is risk managed consistently? | No (guidelines) | Applied within your systems | 1 to 3 months |
One methodology across resilience standards
Delivered by registered lead auditors with hands-on sector experience.
- AssessGap assessment, scope and roadmap
- DesignProcesses, risks and documented information
- ImplementProcesses embedded on the ground
- TrainAwareness to internal auditor competence
- VerifyInternal audit, management review, mock audit
- Certify & sustainCertification audit support, then surveillance
Continuity, security and information security together.
ISO 22301, ISO 28000 and ISO/IEC 27001 share the harmonized structure. Run them with one risk process, one exercise programme and one audit schedule.
Resilience training
CQI/IRCA Approved Training Partner. In-house, public, virtual or hybrid.
- ISO 22301: Awareness, Implementer and Internal Auditor
- Crisis and continuity exercise facilitation
- In-house ISO 28000 awareness and internal auditor courses
Resilience and supply chain FAQ
Does AEC issue these certificates?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for those audits.
ISO 22301 or ISO 28000?
ISO 22301 focuses on continuing operations after any disruption. ISO 28000 focuses on preventing and responding to security threats. Logistics and port operators often need both.
Is ISO 31000 certifiable?
No. ISO 31000 provides risk management guidelines. Its principles are applied within certifiable systems such as ISO 22301, ISO 28000 and ISO/IEC 27001.
Do these help with DORA or NIS2?
They provide management frameworks for continuity, security and risk that those regulations expect. They do not replace the regulations' specific obligations, which we map to your system.
Plan your resilience programme
Tell us your operations, dependencies and threats. We recommend the right combination of standards and send a proposal covering implementation, exercises and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.