SGS India

Global supply chains now sit inside a genuinely interconnected risk landscape. Factors like geopolitical instability, cargo theft and logistics interruptions rarely stay contained to one function. When combined with supplier failures, cyber incidents, and shifting regulatory expectations, the schedule is further hampered. One delayed shipment can hit production schedules, customer commitments, and inventory at once. 

For Indian exporters and multinational businesses, resilience increasingly depends on anticipating vulnerabilities rather than reacting after the fact. This is where a formal security management system earns its place. ISO 28000:2022 gives organisations a structured way to establish, implement, and maintain a Security Management System, or SeMS, that identifies, assesses, and manages security risk across operations and supply chains.

The standard is not limited to the supply chain. Additionally, its scope, certification value, and limits are important to evaluate before businesses start treating it like a checkbox.

Why disruptions are becoming harder to contain

A compromised logistics partner creates physical and information risk at once. A supplier failure exposes an organisation to shortages, unauthorised access, or traceability gaps simultaneously. This interconnectedness is why fragmented, function-by-function security controls struggle.

For instance, a warehouse manager, a logistics coordinator, and an IT lead may each see one piece of the same disruption without a shared framework to connect them.

Regulatory expectations are tightening at the same time. Programmes such as the EU's Authorised Economic Operator scheme and the US Customs-Trade Partnership Against Terrorism now expect exporters to demonstrate verifiable security controls rather than simply describe them on paper, which is pushing formal security management further up the compliance agenda.

Security management system that extends beyond the supply chain

ISO 28000:2022 has a broader scope that goes beyond supply chain security. ISO's own scope statement describes it as applicable to all types and sizes of organisations, holistic rather than industry-specific. It applies to any activity, internal or external, across several levels in a given organisation. 

Supply chain security is one function under a broad, organisation-wide security benchmark framework. That makes it relevant well beyond manufacturers and logistics providers: freight forwarders, warehousing operators, ports and terminals, importers and exporters and any business managing complex third-party networks can all use the same framework, scaled to their own risk profile.

A conformant system typically covers the following:

security risk assessment

asset and facility protection

supplier and third-party security

transportation and cargo controls

incident preparedness

information-management interfaces

ongoing monitoring

These are tailored to context rather than being applied as a universal checklist.

Building resilience before disruption occurs

Clear risk visibility is the first sign of robust security management. This involves evaluating vulnerabilities across facilities, suppliers, logistics routes and partners. This allows the management to separate high-impact risks from routine operational noise, particularly across a supply chain that spans multiple countries and third parties. From there, security gets embedded into everyday processes, such as access control, cargo handling, supplier verification, documentation, and incident reporting.

Physical and digital risk increasingly overlap here too. A logistics operation depends on accurate shipment data and secure communication as much as on physical custody of goods; a disruption to those information flows can undercut visibility and erode digital trust even when cargo itself moves unimpeded.

ISO 28000 doesn't replace a dedicated information-security standard like ISO/IEC 27001, but the two can be coordinated, and that coordination is where cybersecurity and digital trust between manufacturers, logistics providers, and customers actually gets built.

Stage

Supply-chain security application

Plan

Identify threats, vulnerabilities, security objectives

Do

Implement controls and assign responsibility

Check

Monitor incidents and control effectiveness

Act

Correct weaknesses, improve continually

Where ISO 28000 sits alongside related standards

Because this article talks about disruption and resilience, it's worth being precise about what ISO 28000 is not. It's a security management standard, not a business-continuity standard or an information-security standard. However, all three complement each other in practice.

Standard

Primary focus

ISO 28000

Security management (including supply-chain security)

ISO 22301

Business continuity by preparing for and recovering from disruption

ISO/IEC 27001

Information security, which involves confidentiality, integrity, and availability

Certification itself demonstrates that an independent auditor has assessed the management system against ISO 28000's requirements. But it does not mean that disruptions, cargo theft, supplier failure, or cyber incidents will never happen. The value of ISO 28000 is offering a structured, auditable process for managing security risk, not a guarantee of zero incidents.

A practical example

An Indian pharmaceutical exporter shipping temperature-sensitive products to Europe, Southeast Asia and the Middle East works through several logistics providers. Its risk chain runs from warehouse access through third-party logistics handling, transportation routing, shipment documentation and cold-chain integrity, to incident reporting and customer communication. 

Rather than managing each link separately, it sets defined security expectations for logistics partners, standardises shipment documentation, and routes incidents through one escalation process. The next audit trail shows exactly what was identified, assessed, and acted on. 

This reduces operational vulnerabilities while reinforcing cybersecurity and digital trust with customers who depend on that shipment data being accurate.

Building resilient supply chains through iso 28000

Supply chain resilience depends on anticipating vulnerabilities before they turn into costly disruptions, and a broad, auditable security management system is a stronger foundation than fragmented, reactive controls. ISO is currently developing ISO/CD 28018, which is the guidance for applying ISO 28000 principles to supplier and client relationships across upstream and downstream supply chains. 

This is a sign that this area is still actively evolving, in addition to the climate-related Amendment 1:2024. This adds a requirement to determine whether climate change is relevant within the security management system's context.

India now hosts more than 2,100 Global Capability Centers, employing over 2.3 million people across banking, healthcare, manufacturing, retail, technology, and life sciences, per the Zinnov-Nasscom GCC Value Orbit report for FY2026. Most have moved past back-office work into cybersecurity, product engineering, analytics, and AI development for parent companies based thousands of miles away.

That shift changes what compliance means for a GCC. A function that once tracked timesheets now carries regulatory exposure across data privacy, labor law, vendor risk, and information security, across several states at once.

This guide covers that load and how leading GCCs manage it without slowing growth.

Rapid expansion brings new compliance challenges

Global enterprises continue to choose India for technical talent, cost efficiency, and a business ecosystem well beyond simple staff augmentation. Growth at this scale creates friction. For instance, a center with 200 people in one city can reach 2,000 across three locations within a few years, adding functions, vendors, and regulatory touchpoints at each stage.

Parent companies now reconcile two rulebooks, i.e, Indian statutory requirements and global standards written for a different jurisdiction. At scale, these compound each other rather than staying in separate lanes:

Multi-location operations

Data governance

Employment compliance

Vendor oversight

ESG reporting

Information security

That is why compliance needs a structured framework, not ad hoc fixes.

The compliance landscape every GCC should understand

Mature GCCs manage compliance as several connected areas, each carrying distinct risk.

Compliance Area

Corporate Governance

Employment Compliance

Information Security

Operational Risk

Assurance & Audits

Key Focus

Corporate Governance

Regulatory filings, statutory obligations, board oversight

Employment Compliance

Labor law, workplace policies, contractor management

Information Security

Data protection, cybersecurity, access controls

Operational Risk

Vendor management, internal controls, business continuity

Assurance & Audits

Internal reviews, external assessments, continual improvement

Corporate and regulatory governance

Regulatory filings and statutory recordkeeping sit at the foundation. A missed submission or inaccurate reporting may affect the regulatory assessment of the whole center.

Workforce and employment compliance

Labor Law Compliance, Workplace Safety, Contractor Management, and Grievance Redressal matter, especially when it comes to larger organizations with varying regulations in different states. Inclusion policies have to be implemented at a local level, too.

Information security and privacy

India’s Digital Personal Data Protection Act, 2023 became effective after regulations were issued in November 2025, with more obligations phased in until November 2026 and full compliance, which includes penalties for up to ₹250 crore per violation, until May 2027. For a center handling customer data or parent-company IP, that timeline is not abstract.

Operational and third-party risk

Vendor management, procurement controls, and business continuity planning determine how a center absorbs a vendor failure, a system outage, or a regulatory shift.

Building compliance into daily operations instead of an annual exercise

The following three steps outline how an organization can build GCC compliance into its daily operations:

Step 1: Establish clear governance ownership

Compliance works best when one team owns it, with responsibilities cutting across legal, HR, IT, and finance instead of a single silo. Leadership needs visibility into the gaps, not one report yearly.

Step 2: Integrate risk monitoring across business functions

Internal audits, compliance reviews, vendor assessments, and incident reporting work best on a rolling calendar, not an annual push. Documentation holds up better when built as you go; reconstructing a year of records later rarely holds.

Step 3: Align local operations with global standards

Corporate policies written for a global parent need translation into terms that hold up under Indian law, not a straight copy. Management system standards, ESG commitments, and security frameworks need that local layer, treated as ongoing work, not a project closed at launch.

Live case scenario: Scaling a GCC without losing control of compliance

A multinational financial services firm expanded its Global Capability Center in India from 400 to more than 2,000 employees in three years, adding cybersecurity, AI development, finance, and customer support along the way.

Growth at that pace brought new vendor onboarding, employee compliance spread across cities, information security governance, and a backlog of global policies to localize. To manage it, the company:

Created a centralized compliance governance group

Ensured that risk assessment was standardized within all divisions

Implemented periodic internal compliance reviews

Brought processes in line with established management systems principles

Provided feedback on compliance efforts to the leadership via a compliance dashboard

This brought consistency in all the business units and made the firm more audit-ready.

Independent assurance provides confidence as GCCs mature

Independent evaluations offer an external and objective view of whether the governance practices are solid, while certifications offer confirmation that controls work as designed. External audits also catch gaps before a regulator or customer review does.

Organizations running Global Capability Centers in India increasingly bring in independent assurance to support governance, risk management, and operational discipline while scaling. That shift often shows up in practical terms: internal audit calendars get mapped against external certification cycles, and gaps flagged by one get closed before the other arrives. 

The two working together, rather than as separate exercises, is what tends to hold up when growth accelerates.

Compliance becomes a competitive advantage when built into growth

As Global Capability Centers in India take on more strategic work, compliance has to scale with the business rather than trail behind it. Centers that treat GCC compliance in India as a running discipline, not a once-a-year exercise, move faster when regulations shift and field tougher questions from headquarters. 

Built into daily operations, compliance stops being overhead and becomes a reason a center earns more mandates over time. SGS India, for instance, works with organizations on auditing, certification, and assurance services that map onto these needs, turning governance work into evidence that holds up under scrutiny.

Sources:

Zinnov-Nasscom GCC Value Orbit report, FY2026 — GCC count, revenue, talent figures

https://zinnov.com/centers-of-excellence/zinnov-nasscom-india-gcc-landscape-2026-report/

Lexology — "Enforcement of the DPDP Act and notification of the DPDP rules" — DPDP timeline verification

https://www.lexology.com/library/detail.aspx?g=314d0a35-26eb-45ef-b4df-5ee32f7ba127

Shardul Amarchand Mangaldas & Co — "Enforcement of the DPDP Act and notification of the DPDP rules" — DPDP timeline cross-check (same underlying legal analysis as the Lexology posting, published directly by the firm)

https://www.amsshardul.com/insight/enforcement-of-the-dpdp-act-and-notification-of-the-dpdp-rules/

DLA Piper — Data Protection Laws of the World, India — DPDP phased enforcement dates (Phase II/III), penalty framework

https://www.dlapiperdataprotection.com/?t=law&c=IN

india-gcc.com/resources — client-flagged link

https://india-gcc.com/resources

Inductus GCC — "Compliance & Governance Best Practices for GCC 3.0" — client-flagged link; contained unverifiable/inflated statistics with no attribution, so not used as a factual source