ISO 27001 and Cyber Essentials for logistics, freight and transport firms

If you run a haulier, freight forwarder, 3PL or warehouse business, the security questions usually come from your customers, not a regulator. Retailers, NHS bodies, defence suppliers and port operators all depend on you to move their goods and handle their data, so they want proof you won't be the weak link. For most transport and logistics firms, Cyber Essentials is the sensible first step. ISO 27001 follows when a larger contract, tender or customer asks for it, or when the questionnaires start taking more time than you have.

This guide covers who asks and why, the risks they're worried about, which to do first, and how to keep it going without hiring a compliance team. It's general information as of October 2026, not legal advice: always check what your contracts and tenders actually say.

Why your customers ask

Logistics sits in the middle of everyone else's supply chain. You have logins to customer portals, sight of their orders and stock, and in many cases the ability to stop their goods moving. That's why the questions arrive from several directions at once.

• Retail and e-commerce. Large retailers and brands run supplier onboarding and annual reviews that include a security questionnaire. They want to know how you protect their order and customer delivery data, and how quickly you'd recover if your systems went down in peak.
• Public sector and the NHS. Since 2014, central government has required Cyber Essentials for contracts that involve handling personal information and providing certain ICT products and services (Procurement Policy Note 09/14), and many other public bodies ask for it too. If you deliver for NHS organisations and handle patient data, such as home deliveries of medical supplies, you may also be asked to complete the NHS Data Security and Protection Toolkit.
• Defence. Ministry of Defence contracts include cyber requirements in DEFCON 658, which is written to flow down the supply chain to subcontractors. If you move goods for a defence prime or one of its suppliers, expect those requirements to reach you through the contract.
• Ports and international freight. Port operators, terminals and shipping lines ask the hauliers and forwarders who use their systems about access control and incident handling. If you hold or are applying for HMRC's Authorised Economic Operator (AEO) status, the criteria include IT security measures and a safety and security risk assessment, and HMRC says it takes relevant ISO standards into account when deciding how much checking to do.
• Insurers. Cyber and goods-in-transit insurers ask about multi-factor authentication, backups, patching and admin rights: the same ground Cyber Essentials covers.

The NCSC's supply chain security guidance is written for the buyers asking these questions, and it's worth reading to see the issue from their side.

The risks they're actually worried about

Most questionnaires boil down to a handful of concerns specific to how logistics firms work.

TMS and WMS access

Your transport management system and warehouse management system hold every customer's orders, addresses and stock. They're often shared by many staff, agency workers and subcontracted drivers, and sometimes customers log in too. Common gaps are shared logins on warehouse terminals, accounts left open after agency staff leave, and supplier support access that's always on. Buyers want to see named accounts, multi-factor authentication where it's available, and regular access reviews.

Customs and trade data

Forwarders and customs agents handle commercial invoices, tariff codes, values and EORI numbers for their clients, and submit declarations on their behalf. That data is commercially sensitive, and a compromised account used to make false declarations is a serious problem for you and your client. Keep access to customs software and the government services you use limited to the people who need it, and know who has it.

Telematics and driver data

Vehicle tracking, tachograph and dashcam systems record where drivers are and how they drive. That's personal data under UK GDPR, and live location of high-value loads is useful to thieves. These systems are usually cloud services with their own admin accounts, often set up once and forgotten. They belong in your asset list, with an owner and multi-factor authentication.

Ransomware and downtime

For a logistics business, the cost of an attack is mostly measured in time: vehicles that can't be dispatched, a warehouse that can't pick, and customers who move their freight elsewhere. The NCSC's ransomware guidance stresses offline backups that you've actually tested restoring. Your customers will ask how long it would take you to recover and whether you've ever tried. Having a written, rehearsed plan for working without the TMS for a day is a strong answer.

Email and payment fraud

Freight invoices, changes of bank details and booking confirmations are prime targets for email fraud. A hijacked mailbox can redirect a customer's payment or a collection. Multi-factor authentication on email and a simple rule for confirming bank detail changes by phone go a long way.

If personal data is involved in an incident and it's likely to pose a risk to people's rights and freedoms, UK GDPR requires you to report it to the ICO, where feasible within 72 hours. Knowing who decides that, before anything happens, is part of being ready.

Cyber Essentials first

Cyber Essentials is backed by the National Cyber Security Centre and checks five technical controls that stop the most common attacks:

1. Firewalls on your network and every device, including laptops used from home.
2. Secure configuration: no default or shared passwords, unused software removed, devices that lock themselves.
3. User access control: everyone has their own account, admin rights are limited, and multi-factor authentication is on for cloud services.
4. Malware protection on every device in scope.
5. Security update management: supported software only, with critical and high-risk updates applied within 14 days.

Cyber Essentials is an online self-assessment signed off by a director and marked by an assessor. Cyber Essentials Plus adds hands-on testing of a sample of your devices. Both renew every year, and the certificate comes from a certification body licensed by IASME, the NCSC's delivery partner.

Where logistics firms usually get stuck

• Shared depot and warehouse devices. Shared logins on terminals, handhelds and the transport office PC fail the access control questions. Give people their own accounts, or lock shared devices down to a single job.
• Drivers' phones and in-cab tablets. If they access company email or apps, they're in scope. Manage them, or change how drivers reach company data.
• Old kit. A yard PC or label printer running an unsupported operating system has to be replaced, isolated or taken out of scope.
• Cloud services left out. Microsoft 365, your TMS, telematics portal and customer portals all count. Turning on multi-factor authentication everywhere is the biggest single win.
• Treating it as one-off. The certificate shows your position on the day. If patching, leavers and admin reviews stop, next year's renewal starts from scratch.

Then ISO 27001

Cyber Essentials covers technical basics. It doesn't cover your suppliers and subcontractors, incident handling, staff training, business continuity, or how you decide which risks to accept. ISO 27001 covers all of that as a management system: you set a scope, assess your risks, choose controls, keep records, and review and improve on a regular cycle. An accredited certification body audits it in two stages, then carries out surveillance audits.

Logistics firms tend to need it when:

• a large retailer, NHS framework or defence customer asks for it, or scores it in a tender;
• you run systems or portals that customers log into, or integrate directly with theirs;
• you subcontract haulage or warehousing and need to show you control those suppliers too;
• security questionnaires are eating into the time of whoever runs IT.

The work overlaps: your device list, access controls, patching and multi-factor authentication all count as evidence for the matching ISO 27001 controls. For more on how they fit together, read Cyber Essentials vs ISO 27001. Business continuity deserves real attention in logistics, because "how quickly can you dispatch again?" is the question your customers care about most.

A practical order to do it in

1. List what's being asked. Read your contracts, tenders and customer questionnaires and note exactly what each wants: Cyber Essentials, Plus, ISO 27001, the DSPT, or just answers.
2. List your systems and devices. TMS, WMS, telematics, customs software, email, customer portals, depot PCs, handhelds and in-cab devices, each with an owner.
3. Answer the current Cyber Essentials questions in draft and note every "no" or "not sure".
4. Fix the gaps, keep the evidence, and submit through a certification body.
5. Write and test a recovery plan for losing your TMS or WMS for a day.
6. Put the year on rails. Recurring checks for patching, leavers, agency accounts, admin rights, supplier access and backup restores, so the controls stay true between renewals.
7. Move to ISO 27001 when a customer or tender needs it, building on what you've done.

If you're in Hull or elsewhere on the Humber, the port and freight trade around you means these questions are common. We're based in Hull and can meet you in person. See also ISO 27001 in Hull and East Yorkshire.

How ClearIMS helps

ClearIMS has a Cyber Essentials plan at £39 a month (no VAT charged), with unlimited users, so depot managers and transport office staff who own a task can all be added. You work through the Cyber Essentials (and Plus) questions with owners, due dates and linked evidence, and it tracks what's missing or out of date. When ISO 27001 comes up, you upgrade and the evidence and owners carry across to the matching controls, so you don't start again. On the full plan, ClearIMS works like a virtual ISMS manager that emails people about their overdue actions, includes business continuity planning, and has AI draft customer security questionnaire answers from your approved records, with sources. People still approve everything; ClearIMS doesn't submit your assessment or approve anything for you.

We make the software. Your certification is yours, awarded by your certification body.

There's no free trial on the Cyber Essentials plan, so book a 20-minute call and we'll walk you through it. If you need ISO 27001 now, you can also apply for a founding place.