Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
Who we protect

Cyber security for 3PL and logistics providers

You run warehouses and transport for others, connected to your clients' systems and to the port.

Take the 2-minute test
See the launch offer
Your cyber risks

What public sources say about 3PL and logistics providers

Each card links to its source. We kept only what the sources say.

Logistics businesses are targets too
In June 2017 A.P. Moller-Maersk said NotPetya mainly hit Maersk Line, APM Terminals and Damco, its logistics business.
Your clients' supply chain
Clients in scope of NIS2 must address the security of their suppliers and service providers (Article 21).
Courier services are listed
NIS2 Annex II lists postal service providers, including providers of courier services.
Remote access and vendors
The engineer self-test asks whether vendor and remote-maintenance accounts are named, limited in time and logged.

Sources: CNBC, 16 August 2017 · EUR-Lex: Directive (EU) 2022/2555, Article 21 · EUR-Lex: Directive (EU) 2022/2555, Annex II

Isometric illustration of a terminal integration kit connecting systems
What PCA gives you

What Port Cyber Alliance gives you

Launch offer
Ten one-hour video calls of engineering advice and two site visits a year, for every member.
Engineer self-test
Twelve questions on access, network, detection and recovery. About two minutes, answers kept in your browser.
Team self-test
For whoever leads IT or operations: people, visibility, exercises and the logistics chain.
Choosing security tools
Questions to ask a vendor before you buy an OT product, from public guidance. No rankings.
Ten checks in one week
A short list of cyber checks your team can do in a week, before anything else.
Report an incident in confidence
Tell us what you see. We answer within one working day and help you prepare the next steps.
Open source

Open-source packages for 3PL and logistics providers

Free tools we build for port and terminal engineers. Some are public, the others we send on request. Open a card for the details.

  • Isometric illustration: VBS API

    PublicTerminal integration

    VBS API

    Connect a transport management system to a terminal's truck appointment system.

    REST · JSON · API key · UML sequence diagram

    Details about VBS API
  • Isometric illustration: Terminal data contracts

    On requestTerminal integration

    Terminal data contracts

    Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

    JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace

    Details about Terminal data contracts
  • Isometric illustration: Terminal integration kit

    On requestTerminal integration

    Terminal integration kit

    A small core and plugins to connect a TOS, a gate, a booking system or your back office.

    Python 3.10+ · Standard library only · plugin.json · Standard Webhooks

    Details about Terminal integration kit
  • Isometric illustration: TOS Groovy recipes

    On requestTerminal integration

    TOS Groovy recipes

    Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

    Groovy · Navis N4 extensions · PHP relay

    Details about TOS Groovy recipes
  • Isometric illustration: Terminal devtools

    On requestTerminal integration

    Terminal devtools

    Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

    Python · PHP · ISO 6346 · UN/EDIFACT

    Details about Terminal devtools
  • Isometric illustration: Container tracking core

    On requestTerminal integration

    Container tracking core

    Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

    Python 3.11+ · PHP 8.1+ · HTTP facade

    Details about Container tracking core
  • Isometric illustration: Terminal integration map

    ComingTerminal integration

    Terminal integration map

    Where to plug what at a container terminal, and what costs three weeks when you ignore it.

    Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE

    Details about Terminal integration map

See every package and how to get them

Isometric illustration: VBS API

PublicTerminal integration

VBS API

Connect a transport management system to a terminal's truck appointment system.

For
Developers of hauliers and transport management systems (TMS)
Stack
REST · JSON · API key · UML sequence diagram · Code examples
Licence
Apache-2.0
State
The code is on our public GitHub. Use it today.

What is in it today

  • The five-step workflow: prevalidate an operation, create it, read the slots of a day, prevalidate an appointment, create it
  • Authentication by x-api-key and a portId header
  • One error shape: status 400 and an error field
  • Examples folder and a sequence diagram
View on GitHubTalk to us about it
Isometric illustration: Terminal data contracts

On requestTerminal integration

Terminal data contracts

Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

For
Engineers who connect a terminal operating system (TOS) to anything else
Stack
JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Schemas: container tracking answer, structured not-found, one error shape, booking lookup, bill of lading
  • Six reference fixtures (fictitious containers, valid ISO 6346 check digits)
  • OpenAPI 3.1 of the tracking facade: GET /v0/tracking/{container_number} and by booking
  • A conformance runner (exit 0 / 1 / 2) and a mapping to DCSA Track & Trace 2.2.0

Next

  • OpenAPI 3.1 of the read-only terminal data API

What it will never do

  • Invent data: no data means the field is absent, never « unknown », never a default
Get the package and talk to us
Isometric illustration: Terminal integration kit

On requestTerminal integration

Terminal integration kit

A small core and plugins to connect a TOS, a gate, a booking system or your back office.

For
Integration engineers of terminals, ports and logistics platforms
Stack
Python 3.10+ · Standard library only · plugin.json · Standard Webhooks
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • The core and two reference plugins, tested
  • A mock terminal shaped like Navis N4
  • A read-only N4 connector
  • Health is green, red or undetermined: « could not check » is never « all good »

Next

  • The other connectors are specified, not written yet
Get the package and talk to us
Isometric illustration: TOS Groovy recipes

On requestTerminal integration

TOS Groovy recipes

Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

For
Terminal IT teams running Navis N4 with the extension option
Stack
Groovy · Navis N4 extensions · PHP relay
Licence
MIT
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • n4-gate-event-push: every N4 gate passage pushed to an HTTPS receiver, PHP relay with queue and retries (relay tested, Groovy to run on a real N4)

Next

  • Container status, customs holds, charges, booking lookup, free time and demurrage
  • A read-only guard (a write attempt is refused, tested), rate limit and cache
  • Tideworks after N4, same facade

What it will never do

  • Write into a TOS, ever
  • Ship a recipe that never ran on a real TOS
Get the package and talk to us
Isometric illustration: Terminal devtools

On requestTerminal integration

Terminal devtools

Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

For
Developers who write terminal software or test against a TOS
Stack
Python · PHP · ISO 6346 · UN/EDIFACT · UN/LOCODE
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • ISO 6346 check digit in Python and PHP, tested against one shared set of test vectors
  • tos-mock: a fake TOS that serves the tracking facade on six fictitious containers

Next

  • ISO 6346 in TypeScript
  • An EDIFACT pretty-printer (COPARN, CODECO, BAPLIE, COARRI)
  • Offline UN/LOCODE
Get the package and talk to us
Isometric illustration: Container tracking core

On requestTerminal integration

Container tracking core

Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

For
Terminals and port communities that publish container status
Stack
Python 3.11+ · PHP 8.1+ · HTTP facade
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • One library, two bindings (Python and PHP) that give identical answers
  • An HTTP facade that passes the conformance runner
  • Works before any API, on six fictitious demonstration containers

What it will never do

  • Serve an answer it cannot vouch for
Get the package and talk to us
Isometric illustration: Container tracking and history for WordPress

On requestTerminal integration

Container tracking and history for WordPress

Two plugins for a terminal's website: find a container, or a bill of lading and all its containers.

For
Terminals whose public website runs on WordPress
Stack
PHP 8.1+ · WordPress 6.4+ · Shortcodes and block
Licence
GPL-2.0-or-later
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Container search: where it is, whether a truck can pick it up, and each hold with its reason
  • Bill of lading search: every container of a B/L; a container alone is refused, so nobody sees another customer's cycle
  • ISO 6346 check digit on every container number
  • Works at activation on demonstration data

Next

  • Drupal and Joomla versions
Get the package and talk to us
Isometric illustration: Terminal integration map

ComingTerminal integration

Terminal integration map

Where to plug what at a container terminal, and what costs three weeks when you ignore it.

For
Integrators starting a project at a container terminal
Stack
Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE · UN/EDIFACT · SMDG MIGs
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Layers: operations, customs holds, billing, gate and booking, EDI
  • « Am I allowed? » in 30 seconds, per TOS licence
  • Paths that work without the TOS extension licence

What it will never do

  • Republish vendor manuals
  • Quote licence prices
  • Advise bypassing a licence
Get the package and talk to us
Questions

3PL providers: questions

Click a question to read the answer.

Yes. Any organization in the port chain can join: terminals, port authorities, marinas, oil and gas ports, shipping lines, hauliers, freight forwarders and the industrial shippers that depend on them. Start with the launch offer.

Warehousing and third-party logistics are not listed as such. Annex II lists postal service providers, including courier services, and your clients may be in scope and ask you about your security under Article 21. Check your country's law.

With a short list you can do in a week: ten cyber checks for one week, then the two free self-tests.

No. They are benevolent checklists of twelve questions each, about two minutes, and the answers stay in your browser. Use them inside your team, then talk to us if something worries you.

Launch offer

Talk to engineers who work inside ports

Ten hours of engineering advice a year on your own systems and the links you keep with your clients.

Want to know where you stand?

Take the 2-minute test

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting