Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
Who we protect

Cyber security for shippers and beneficial cargo owners

You depend on lines, forwarders and terminals you do not run. Here are the documented risks.

Take the 2-minute test
See the launch offer
Your cyber risks

What public sources say about shippers and cargo owners

Each card links to its source. We kept only what the sources say.

Your cargo, their outage
In November 2023 DP World Australia's terminals stopped for three days; almost 30,000 containers were stranded.
Possibly in scope yourself
NIS2 Annex II lists, among others, chemicals, food production and distribution, and several manufacturing sectors.
Supply chain security
Article 21 of NIS2 asks entities in scope to address the security of their direct suppliers and service providers.
Ask before you buy
Public guidance from CISA and partner agencies lists the questions to ask an OT vendor before buying.

Sources: The Record, 13 November 2023 · EUR-Lex: Directive (EU) 2022/2555, Annex II · EUR-Lex: Directive (EU) 2022/2555, Article 21 · CISA, Secure by Demand for OT owners and operators, 13 January 2025

Isometric illustration of a container and bill of lading search
What PCA gives you

What Port Cyber Alliance gives you

Launch offer
Ten one-hour video calls of engineering advice and two site visits a year, for every member.
Team self-test
For whoever leads IT or operations: people, visibility, exercises and the logistics chain.
Engineer self-test
Twelve questions on access, network, detection and recovery. About two minutes, answers kept in your browser.
NIS2 in plain words
Who is covered, the ten Article 21 measures and the 24 h, 72 h and one-month deadlines, with the article numbers.
Choosing security tools
Questions to ask a vendor before you buy an OT product, from public guidance. No rankings.
Case studies
Five public incidents at lines, ports and terminals, and what each one showed.
Open source

Open-source packages for shippers and cargo owners

Free tools we build for port and terminal engineers. Some are public, the others we send on request. Open a card for the details.

  • Isometric illustration: VBS API

    PublicTerminal integration

    VBS API

    Connect a transport management system to a terminal's truck appointment system.

    REST · JSON · API key · UML sequence diagram

    Details about VBS API
  • Isometric illustration: Terminal data contracts

    On requestTerminal integration

    Terminal data contracts

    Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

    JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace

    Details about Terminal data contracts
  • Isometric illustration: Terminal integration kit

    On requestTerminal integration

    Terminal integration kit

    A small core and plugins to connect a TOS, a gate, a booking system or your back office.

    Python 3.10+ · Standard library only · plugin.json · Standard Webhooks

    Details about Terminal integration kit
  • Isometric illustration: TOS Groovy recipes

    On requestTerminal integration

    TOS Groovy recipes

    Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

    Groovy · Navis N4 extensions · PHP relay

    Details about TOS Groovy recipes
  • Isometric illustration: Terminal devtools

    On requestTerminal integration

    Terminal devtools

    Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

    Python · PHP · ISO 6346 · UN/EDIFACT

    Details about Terminal devtools
  • Isometric illustration: Container tracking core

    On requestTerminal integration

    Container tracking core

    Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

    Python 3.11+ · PHP 8.1+ · HTTP facade

    Details about Container tracking core
  • Isometric illustration: Terminal integration map

    ComingTerminal integration

    Terminal integration map

    Where to plug what at a container terminal, and what costs three weeks when you ignore it.

    Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE

    Details about Terminal integration map

See every package and how to get them

Isometric illustration: VBS API

PublicTerminal integration

VBS API

Connect a transport management system to a terminal's truck appointment system.

For
Developers of hauliers and transport management systems (TMS)
Stack
REST · JSON · API key · UML sequence diagram · Code examples
Licence
Apache-2.0
State
The code is on our public GitHub. Use it today.

What is in it today

  • The five-step workflow: prevalidate an operation, create it, read the slots of a day, prevalidate an appointment, create it
  • Authentication by x-api-key and a portId header
  • One error shape: status 400 and an error field
  • Examples folder and a sequence diagram
View on GitHubTalk to us about it
Isometric illustration: Terminal data contracts

On requestTerminal integration

Terminal data contracts

Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

For
Engineers who connect a terminal operating system (TOS) to anything else
Stack
JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Schemas: container tracking answer, structured not-found, one error shape, booking lookup, bill of lading
  • Six reference fixtures (fictitious containers, valid ISO 6346 check digits)
  • OpenAPI 3.1 of the tracking facade: GET /v0/tracking/{container_number} and by booking
  • A conformance runner (exit 0 / 1 / 2) and a mapping to DCSA Track & Trace 2.2.0

Next

  • OpenAPI 3.1 of the read-only terminal data API

What it will never do

  • Invent data: no data means the field is absent, never « unknown », never a default
Get the package and talk to us
Isometric illustration: Terminal integration kit

On requestTerminal integration

Terminal integration kit

A small core and plugins to connect a TOS, a gate, a booking system or your back office.

For
Integration engineers of terminals, ports and logistics platforms
Stack
Python 3.10+ · Standard library only · plugin.json · Standard Webhooks
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • The core and two reference plugins, tested
  • A mock terminal shaped like Navis N4
  • A read-only N4 connector
  • Health is green, red or undetermined: « could not check » is never « all good »

Next

  • The other connectors are specified, not written yet
Get the package and talk to us
Isometric illustration: TOS Groovy recipes

On requestTerminal integration

TOS Groovy recipes

Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

For
Terminal IT teams running Navis N4 with the extension option
Stack
Groovy · Navis N4 extensions · PHP relay
Licence
MIT
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • n4-gate-event-push: every N4 gate passage pushed to an HTTPS receiver, PHP relay with queue and retries (relay tested, Groovy to run on a real N4)

Next

  • Container status, customs holds, charges, booking lookup, free time and demurrage
  • A read-only guard (a write attempt is refused, tested), rate limit and cache
  • Tideworks after N4, same facade

What it will never do

  • Write into a TOS, ever
  • Ship a recipe that never ran on a real TOS
Get the package and talk to us
Isometric illustration: Terminal devtools

On requestTerminal integration

Terminal devtools

Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

For
Developers who write terminal software or test against a TOS
Stack
Python · PHP · ISO 6346 · UN/EDIFACT · UN/LOCODE
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • ISO 6346 check digit in Python and PHP, tested against one shared set of test vectors
  • tos-mock: a fake TOS that serves the tracking facade on six fictitious containers

Next

  • ISO 6346 in TypeScript
  • An EDIFACT pretty-printer (COPARN, CODECO, BAPLIE, COARRI)
  • Offline UN/LOCODE
Get the package and talk to us
Isometric illustration: Container tracking core

On requestTerminal integration

Container tracking core

Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

For
Terminals and port communities that publish container status
Stack
Python 3.11+ · PHP 8.1+ · HTTP facade
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • One library, two bindings (Python and PHP) that give identical answers
  • An HTTP facade that passes the conformance runner
  • Works before any API, on six fictitious demonstration containers

What it will never do

  • Serve an answer it cannot vouch for
Get the package and talk to us
Isometric illustration: Container tracking and history for WordPress

On requestTerminal integration

Container tracking and history for WordPress

Two plugins for a terminal's website: find a container, or a bill of lading and all its containers.

For
Terminals whose public website runs on WordPress
Stack
PHP 8.1+ · WordPress 6.4+ · Shortcodes and block
Licence
GPL-2.0-or-later
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Container search: where it is, whether a truck can pick it up, and each hold with its reason
  • Bill of lading search: every container of a B/L; a container alone is refused, so nobody sees another customer's cycle
  • ISO 6346 check digit on every container number
  • Works at activation on demonstration data

Next

  • Drupal and Joomla versions
Get the package and talk to us
Isometric illustration: Terminal integration map

ComingTerminal integration

Terminal integration map

Where to plug what at a container terminal, and what costs three weeks when you ignore it.

For
Integrators starting a project at a container terminal
Stack
Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE · UN/EDIFACT · SMDG MIGs
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Layers: operations, customs holds, billing, gate and booking, EDI
  • « Am I allowed? » in 30 seconds, per TOS licence
  • Paths that work without the TOS extension licence

What it will never do

  • Republish vendor manuals
  • Quote licence prices
  • Advise bypassing a licence
Get the package and talk to us
Questions

Shippers and BCOs: questions

Click a question to read the answer.

Yes. Any organization in the port chain can join: terminals, port authorities, marinas, oil and gas ports, shipping lines, hauliers, freight forwarders and the industrial shippers that depend on them. Start with the launch offer.

Possibly. Annex II of Directive (EU) 2022/2555 lists sectors such as the manufacture and distribution of chemicals, the production and distribution of food, and the manufacture of machinery, vehicles and electronics. Medium-sized and large companies of those sectors are generally in scope; check your country's law. Read our NIS2 page.

Start with your own list: who can reach your systems, and what your contracts say about incidents. The team self-test asks both questions.

Yes. What you share with us stays between us, and we never name a member without its written agreement.

Launch offer

Talk to engineers who work inside ports

Ten hours of engineering advice and two site visits a year, to look at your systems and your links with the port chain.

Want to know where you stand?

Take the 2-minute test

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting