How to Use This Checklist
This checklist covers 7 key cybersecurity areas for logistics companies. Each item is classified by priority:
- Critical — implement immediately, absence = risk of operational paralysis or data breach
- Important — implement within 3 months
- Recommended — implement within 6-12 months
The checklist aligns with NIS2, GDPR, and ISO 27001 requirements in the TSL industry context.
TMS and WMS Systems
Critical:
- TMS/WMS in a dedicated network segment (VLAN), isolated from the office network
- MFA on all TMS/WMS user accounts
- Regular TMS/WMS platform updates (monthly patching cycle)
- Database encryption at rest and in transit (TLS 1.2+)
- TMS/WMS backup isolated from the network (air-gapped or immutable)
Important:
- RBAC — minimal permissions per role (dispatcher, warehouse operator, admin)
- Logging of all critical operations (rate changes, routes, assignments)
- Automatic disabling of inactive accounts > 90 days
- Penetration testing of TMS/WMS web interfaces and APIs (annually)
Recommended:
- Database Activity Monitoring on TMS database
- Anomaly detection on TMS operations (mass export, off-hours changes)
- CI/CD pipeline with security scanning for custom TMS code
Fleet and Telematics Security
Critical:
- Encrypted telematics → server connection (TLS/mTLS)
- Changed default passwords on all telematics devices
- GPS anomaly monitoring (sudden location changes, signal loss > 15 min)
- Geofencing with real-time alerts
Important:
- Multi-sensor location (GPS + cellular) for vehicles with valuable cargo
- Regular telematics device firmware updates
- Physical security of J1939/OBD-II diagnostic ports
- Dedicated APN or VPN for fleet communication
Recommended:
- GPS anti-spoofing (Galileo OS-NMA or multi-frequency)
- Hidden secondary tracker (independent of main telematics)
- Cabin video monitoring with event-based alerts
Access Control and Authentication
Critical:
- MFA on all administrative accounts (AD, TMS, WMS, telematics)
- Strong password policy (min. 14 characters, no reuse)
- Separate administrative accounts (separated from daily accounts)
- Account lockout after 5 failed login attempts
Important:
- Privileged Access Management (PAM) for admins
- VPN/ZTNA for remote access (not RDP directly)
- Regular permission reviews (quarterly)
- Login logging with anomaly alerts
Recommended:
- SSO with MFA for all systems
- Just-in-Time access for administrative operations
- Service account per integration (not shared)
Network and Infrastructure Security
Critical:
- Firewall at the network-internet boundary
- Segmentation: office network / TMS-WMS / telematics / IoT / guest WiFi
- DDoS protection (min. at ISP level)
- Antivirus/EDR on all workstations and servers
Important:
- WAF on public web interfaces
- DNS filtering (blocking known malicious domains)
- Email security: SPF + DKIM + DMARC + anti-phishing
- Infrastructure vulnerability scanning (weekly)
Recommended:
- Network Detection and Response (NDR)
- Microsegmentation of critical systems
- Deception technology (honeypots on the logistics network)
ICT Supply Chain Security
Critical:
- ICT vendor inventory with criticality assessment
- Security requirements in vendor contracts (SLA, right to audit)
- Separate accounts and credentials per partner/subcontractor
- Ability to immediately cut partner access
Important:
- Security audit of critical vendors (annually)
- Anomaly monitoring in EDI/API communication with partners
- EDI transmission encryption (AS2/SFTP)
- Partner onboarding/offboarding procedures
Recommended:
- Vendor security rating (continuous monitoring)
- SBOM (Software Bill of Materials) for critical systems
- Tabletop exercise with critical vendor (annual incident simulation)
Backup, Continuity, and Recovery
Critical:
- 3-2-1 backup rule (3 copies, 2 media, 1 off-site)
- Backup isolated from production network (air-gapped or immutable)
- Regular recovery testing (monthly)
- Defined RTO and RPO for critical systems
Important:
- Business continuity plan (BCP) with manual procedures
- Tested disaster recovery plan (DRP)
- Emergency procedures: fleet management without TMS
- Configuration backups for firewalls, routers, switches
Recommended:
- DR site (hot/warm) for TMS
- Automatic failover for critical systems
- Tabletop exercise with management (ransomware simulation, every 6 months)
Monitoring, Response, and Compliance
Critical:
- Centralized logging from all systems (SIEM)
- 24/7 security monitoring with alerts
- Incident response procedure (who, what, when)
- NIS2 incident reporting plan (24h / 72h / 1 month)
- Record of data processing activities (GDPR Art. 30)
Important:
- Escalation contacts (CERT, supervisory authority, vendors, lawyers)
- Employee awareness training (every 6 months)
- Security log reviews (weekly)
- Annual security audit
Recommended:
- TSL sector threat intelligence feed
- Red team / purple team exercise (annually)
- Cyber insurance covering ransomware and supply chain
- Cybersecurity training for management (NIS2 requirement)
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
Frequently asked questions
Does this checklist meet NIS2 requirements?
The checklist covers key technical and organizational NIS2 requirements (Art. 21). Full compliance requires additional documentation of policies, incident reporting procedures, and formal risk analysis. We recommend a NIS2 audit as a supplement.
Where should I start implementation?
Start with critical items in the TMS/WMS Systems and Access Control sections — these are operationally critical systems. Then Backup and monitoring. In parallel, begin work on supply chain security (NIS2 requirement).
How often should the checklist be reviewed?
Review quarterly, full update annually. After every incident — immediate review and supplementation. When implementing a new system (TMS, WMS, telematics) — review related sections.
