How to Use This Checklist
This checklist covers 7 key cybersecurity areas for logistics companies. Each item is classified by priority:
- Critical — implement immediately, absence = risk of operational paralysis or data breach
- Important — implement within 3 months
- Recommended — implement within 6-12 months
The checklist aligns with NIS2, GDPR, and ISO 27001 requirements in the TSL industry context.
TMS and WMS Systems
Critical:
- TMS/WMS in a dedicated network segment (VLAN), isolated from the office network
- MFA on all TMS/WMS user accounts
- Regular TMS/WMS platform updates (monthly patching cycle)
- Database encryption at rest and in transit (TLS 1.2+)
- TMS/WMS backup isolated from the network (air-gapped or immutable)
Important:
- RBAC — minimal permissions per role (dispatcher, warehouse operator, admin)
- Logging of all critical operations (rate changes, routes, assignments)
- Automatic disabling of inactive accounts > 90 days
- Penetration testing of TMS/WMS web interfaces and APIs (annually)
Recommended:
- Database Activity Monitoring on TMS database
- Anomaly detection on TMS operations (mass export, off-hours changes)
- CI/CD pipeline with security scanning for custom TMS code
Fleet and Telematics Security
Critical:
- Encrypted telematics → server connection (TLS/mTLS)
- Changed default passwords on all telematics devices
- GPS anomaly monitoring (sudden location changes, signal loss > 15 min)
- Geofencing with real-time alerts
Important:
- Multi-sensor location (GPS + cellular) for vehicles with valuable cargo
- Regular telematics device firmware updates
- Physical security of J1939/OBD-II diagnostic ports
- Dedicated APN or VPN for fleet communication
Recommended:
- GPS anti-spoofing (Galileo OS-NMA or multi-frequency)
- Hidden secondary tracker (independent of main telematics)
- Cabin video monitoring with event-based alerts
Access Control and Authentication
Critical:
- MFA on all administrative accounts (AD, TMS, WMS, telematics)
- Strong password policy (min. 14 characters, no reuse)
- Separate administrative accounts (separated from daily accounts)
- Account lockout after 5 failed login attempts
Important:
- Privileged Access Management (PAM) for admins
- VPN/ZTNA for remote access (not RDP directly)
- Regular permission reviews (quarterly)
- Login logging with anomaly alerts
Recommended:
- SSO with MFA for all systems
- Just-in-Time access for administrative operations
- Service account per integration (not shared)
Network and Infrastructure Security
Critical:
- Firewall at the network-internet boundary
- Segmentation: office network / TMS-WMS / telematics / IoT / guest WiFi
- DDoS protection (min. at ISP level)
- Antivirus/EDR on all workstations and servers
Important:
- WAF on public web interfaces
- DNS filtering (blocking known malicious domains)
- Email security: SPF + DKIM + DMARC + anti-phishing
- Infrastructure vulnerability scanning (weekly)
Recommended:
- Network Detection and Response (NDR)
- Microsegmentation of critical systems
- Deception technology (honeypots on the logistics network)
ICT Supply Chain Security
Critical:
- ICT vendor inventory with criticality assessment
- Security requirements in vendor contracts (SLA, right to audit)
- Separate accounts and credentials per partner/subcontractor
- Ability to immediately cut partner access
Important:
- Security audit of critical vendors (annually)
- Anomaly monitoring in EDI/API communication with partners
- EDI transmission encryption (AS2/SFTP)
- Partner onboarding/offboarding procedures
Recommended:
- Vendor security rating (continuous monitoring)
- SBOM (Software Bill of Materials) for critical systems
- Tabletop exercise with critical vendor (annual incident simulation)
Backup, Continuity, and Recovery
Critical:
- 3-2-1 backup rule (3 copies, 2 media, 1 off-site)
- Backup isolated from production network (air-gapped or immutable)
- Regular recovery testing (monthly)
- Defined RTO and RPO for critical systems
Important:
- Business continuity plan (BCP) with manual procedures
- Tested disaster recovery plan (DRP)
- Emergency procedures: fleet management without TMS
- Configuration backups for firewalls, routers, switches
Recommended:
- DR site (hot/warm) for TMS
- Automatic failover for critical systems
- Tabletop exercise with management (ransomware simulation, every 6 months)
Monitoring, Response, and Compliance
Critical:
- Centralized logging from all systems (SIEM)
- 24/7 security monitoring with alerts
- Incident response procedure (who, what, when)
- NIS2 incident reporting plan (24h / 72h / 1 month)
- Record of data processing activities (GDPR Art. 30)
Important:
- Escalation contacts (CERT, supervisory authority, vendors, lawyers)
- Employee awareness training (every 6 months)
- Security log reviews (weekly)
- Annual security audit
Recommended:
- TSL sector threat intelligence feed
- Red team / purple team exercise (annually)
- Cyber insurance covering ransomware and supply chain
- Cybersecurity training for management (NIS2 requirement)
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
