GB/T 43632-2024Security management systems for the supply chain - Development of resilience in the supply chain - Requirements with guidance for use (English PDF)

0.1 Overview

Organizations around the world are accelerating the development of risk management and resilience programs to address the uncertainty in achieving their goals.

Organizations need to ensure that their suppliers and extended supply chains have planned and implemented measures to prevent and mitigate the threats and risks they face.

To ensure supply chain resilience, organizations must implement comprehensive and systematic prevention, protection, preparation, mitigation, and A series of tasks including mitigation, response, continuity and recovery.

The survival of organizations in the supply chain depends largely on the resilience of their suppliers and customers. Therefore, building resilience into the supply chain as well as improving the resilience of organizations in the supply chain must focus on the organization internally and its external suppliers and customers.

During supply chain disruptions, it is important to emphasize that the exact nature of the disruption may not be fully understood at first and can only be understood over time.

Therefore, resilience plans and policies should emphasize the adaptation and continuous evaluation of new information to ensure that the measures taken are effective.

Appropriateness. If the supply chain is severely disrupted, it is likely to attract the attention of the news media. If the relationship with the news media is not properly managed, If the relationship is not well understood, it may have a negative impact on recovery response activities, which may lead to a loss of confidence among stakeholders. This loss of confidence may lead to customer this document is intended for private, non-profit, and in government and public sector environments, it is a management framework for action planning and decision making that can be used to anticipate and, where feasible, prevent disruptive events (emergency Implementation of this document in the management system can improve the organization's ability to respond to related events.

management and survivability in the event and can help ensure the continued viability of the organization by taking all appropriate measures.

The leadership has the responsibility to develop a survival plan that ensures the interests of stakeholders. The body of this document provides auditability criteria for building Establish, review, maintain and improve the resilience approach implemented in the management system to strengthen prevention, preparedness (preparedness), mitigation, response and capacity building for disruptive events.

response, continuity and recovery efforts.

This document is intended to be an integral part of a supply chain security management system. In addition, (Plan-Do-Check-Act. PDCA) model, this document can also be incorporated into other internal management systems.

If a certification is established, the overall management system standard including this document will be certified.

By adopting a comprehensive recovery approach that is adaptive, proactive, and reactive, it is possible to leverage the perspectives, knowledge, and capabilities of various departments and individuals within the organization.

Because many natural, intentional or unintentional threats and dangers that organizations face have relatively low probability, but the consequences may be very high.

An integrated approach allows an organization to prioritize its risk management needs in a manner that is economically justifiable.

0.2 Supply Chain Environment

When managing risks in the supply chain, it is necessary to understand the organizational environment and the global environmental context of the entire supply chain.

Each node in the process involves a series of risks and management processes such as planning, raw materials, manufacturing, delivery and returns. All these management processes should be Included in the organization's overall resilience policy. Within this context, the organization will determine the level and tier of resilience initiatives included in its supply chain.

Figure 1 Resilience management principles in the supply chain [Source. Supply Chain Council (SCC).2007]

0.3 Process Approach

The management systems approach encourages organizations to analyze their organizational and stakeholder needs and identify the processes that will contribute to their success.

The system provides a framework for continuous improvement to increase the potential for enhanced safety, preparedness, responsiveness, continuity and resilience.

The management system also provides the organization and its customers with confidence that the organization can provide safe, reliable and efficient services that meet the requirements of the organization and its stakeholders.

environment.

This document adopts a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization's resilience to supply chain disruptions.

Organizations need to identify and manage many activities to ensure that they operate effectively. Any activity that involves the use and management of resources and the conversion of inputs into any activity that produces an output can be considered a process. Usually, the output of one process directly becomes the input of the next process.

The application of a set of processes within an organization, and the identification and interaction of these processes and their management can be called the "process approach".

Figure 2 depicts the supply chain resilience management process approach proposed in this document, and users are encouraged to emphasize the importance of the following aspects.

a) understand the organization's risk, security, preparedness, response, continuity and recovery requirements;

b) Establish risk management policies and objectives;

c) implement controls to manage organizational risks in the context of organizational objectives;

d) monitor and review the performance and effectiveness of the resilience management approach;

e) Continuous improvement based on target assessment.

Figure 2 Supply Chain Resilience Management Process Approach

0.3.1 Develop supply chain resilience plans and apply resources.

---Regard supply chain risk management as a top priority;

---Ensure top management support for supply chain resilience initiatives;

---Ensure that the resources required to implement the plan are in place.

0.3.2 Establish supply chain and resilience goals.

---Establish supply chain scope and map to supply chain;

---Establish risk management objectives in the subject supply chain.

0.3.3 Identify supply chain risks.

---Comprehensively review the supply chain to identify risks;

---Record identified risks as much as possible.

0.3.4 Risk Quantification and Prioritization.

---Quantify each risk based on the likelihood of occurrence and potential impact;

---Use risk quantification to prioritize risks based on identified objectives.

0.3.5 Execution of risk response plan.

---Develop risk management measures based on the priority of each risk;

---Define the value of each measure based on reducing the likelihood and impact of the risk;

---Develop and implement plans for identified measures.

0.3.6 Monitor the supply chain environment to identify risks.

---Continuously monitor the supply chain environment to identify risk events or precursors;

---When the threshold is triggered, execute applicable mitigation measures;

---Record the review and program results after measures are taken.

0.4 Plan-Do-Check-Act (PDCA) Model

This document is intended to be incorporated into a management system using the Plan-Do-Check-Act (PDCA) model, which in turn will guide

Figure 3 illustrates how a resilience management policy can be incorporated into a management system; this policy can be

The requirements and expectations of stakeholders are determined and the necessary actions and processes are used to produce risk management results that meet these requirements and expectations.

Understand the connections between the processes described in Chapter 4 of this document.

Figure 3.Flowchart of the management system including the resilience policy

plan

(Establishment of management system) Build and manage risk and improve safety, preparedness, mitigation, response, continuity and recovery management system policies, objectives, processes and procedures in order to and target delivery results Implementation (Implementation and operation of management system) Implement and operate management system policies, controls, processes and procedures examine (Monitoring and reviewing management systems) Evaluate process performance based on management system policies, objectives and practical experience and report the results Results reported to management for review Disposal (Maintain and improve the management system) Take corrective and preventive measures based on the results of internal management system audits and management reviews.

Continuously improve the management system Management systems that incorporate this document as a policy may be aligned with ISO 28000:2007, ISO 14001:2004 Compliance is verified through an audit process that is compatible and consistent with the ISO/IEC 27001:2005 methodology and PDCA model.

Reference guidelines for the use of this document are provided in Appendix B. Further information on restrictions on the use of this document is provided in Appendix C.

See Appendix D for the terminology conventions used.

This document provides generic requirements as a framework that are applicable to an organization (or organizational sector), regardless of the size of the organization and its function in the supply chain.

This document provides guidance to organizations in developing their own specific performance standards, enabling them to develop and implement standards that are appropriate for their organization and its A resilience management approach to stakeholder needs.

This document emphasizes the resilience and adaptability of organizations in complex and changing environments, as well as the protection of critical supply chain assets and processes.

By using this document, organizations can more easily prevent and prepare for a variety of disruptive events, whether intentional, unintentional, and/or natural, if possible.

This document covers disruptive events.

All phases of incident management before, during and after an incident.

This document provides a framework for organizations to.

a) Develop a prevention, protection, preparedness, mitigation and response/continuity/resilience approach;

b) establishing objectives, procedures and processes to achieve the policy commitments;

c) ensuring relevant competence, awareness and training;

d) setting standards for measuring performance and demonstrating success;

e) take action measures as necessary to improve performance;

f) this document is necessary to demonstrate conformity of the management system;

g) Establish and apply a continual improvement process.

Appendix A provides reference guidance on system planning, implementation, testing, maintenance, and improvement.

Supply Chain Security Management System Supply Chain Resilience Development Requirements and Usage Guide