ISO 22373:2025 PDF

Overview - What ISO 22373:2025 covers

ISO 22373:2025, "Security and resilience - Authenticity, integrity and trust for products and documents - Framework for establishing trustworthy supply and value chains," defines a technology‑agnostic framework to create and maintain a chain of trustworthiness across supply and value chains. The standard provides guidelines to identify information relevant to trustworthiness, an interoperable data structure (the trustworthiness profile) for negotiating and exchanging that information, and concepts to define and verify trust across multiple stakeholders. It is applicable to all organizations and product types, supporting systemization and automation of trustworthiness verification while preserving privacy and confidentiality.

Key technical topics and requirements

• Trust domains (TDs) and trust interaction points (TIPs): structure supply/value chains into responsible entities and interaction interfaces to map where trust must be demonstrated.
• Trustworthiness attributes and profile: identify measurable attributes (e.g., integrity, authenticity, accountability) and express expectations (TWE) and capabilities (TWC) in a technology‑agnostic trustworthiness profile.
• Interoperable data structure: a standardized format for exchanging trust expectations and verifiable claims between stakeholders to enable negotiation and automated evaluation.
• Verifiable claims and trust anchors: mechanisms for asserting and validating properties of products, processes or participants (can be implemented using PKI, DIDs, verifiable credentials, etc.).
• Threat and risk analysis (TRA): integrate threat/risk assessments to support required trustworthiness levels.
• Chain of trustworthiness topologies and evaluation: guidance for designing end‑to‑end trust chains, scoring/determination methods (see Annex D), and implementation considerations (Annex E).
• Technology neutrality: supports multiple implementations (PKI, decentralized identifiers, verifiable credentials) without mandating a specific technology.

Practical applications and who uses this standard

ISO 22373:2025 is valuable for organizations that need demonstrable trust across complex supply or value chains, including:

• Manufacturers, suppliers and integrators defining product provenance and production integrity.
• Logistics providers, distributors and retailers exchanging verifiable product claims.
• Certification authorities and regulators assessing conformity and issuing trust anchors.
• IT, security and procurement teams implementing interoperable trust exchanges and automated verification.
• System designers building digital supply‑chain platforms, marketplaces or IoT device management solutions.

Use cases include provenance tracking, secure maintenance data exchange, facility management, supplier qualification, and automated compliance evidence sharing.

Related standards (if applicable)

• ISO 22300 - Security and resilience: Vocabulary
• ISO/IEC TS 5723:2022 - Trustworthiness: Vocabulary
• References within ISO 22373 also draw on sector standards for supply‑chain and conformity processes

Keywords: ISO 22373:2025, trustworthiness, supply chain, value chain, trust domain, trust interaction point, trustworthiness profile, verifiable credentials, PKI, DID, chain of trustworthiness.