Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
Who we protect

Cyber security for customs at ports

Declarations flow between authorities, lines, forwarders and terminals; when data is wrong or late, cargo waits.

Take the 2-minute test
See the launch offer
Your cyber risks

What public sources say about customs and data exchange teams

Each card links to its source. We kept only what the sources say.

Public administration in NIS2
NIS2 Annex I lists public administration entities of central governments, as defined by each Member State in its national law.
A port ecosystem, not one system
ENISA's port guidance was written for the CIOs and CISOs of the whole port ecosystem, where systems of many organisations connect.
Ports stop for many reasons
In May 2020 the computers that manage vessels, trucks and cargo at Shahid Rajaee port failed and trucks queued on the roads.
Know your incident chain
The team self-test asks who decides and who informs the authorities, and how fast, when an incident starts.

Sources: EUR-Lex: Directive (EU) 2022/2555, Annex I · ENISA, port cyber security good practices, 26 November 2019 · Al Jazeera, 19 May 2020

Isometric illustration of terminal data contracts and schemas
What PCA gives you

What Port Cyber Alliance gives you

Team self-test
For whoever leads IT or operations: people, visibility, exercises and the logistics chain.
Engineer self-test
Twelve questions on access, network, detection and recovery. About two minutes, answers kept in your browser.
NIS2 in plain words
Who is covered, the ten Article 21 measures and the 24 h, 72 h and one-month deadlines, with the article numbers.
Best practices
The IMO guidelines, the NIS2 measures and ENISA's port guidance in one page, with the sources.
Case studies
Five public incidents at lines, ports and terminals, and what each one showed.
Launch offer
Ten one-hour video calls of engineering advice and two site visits a year, for every member.
Open source

Open-source packages for customs and data exchange teams

Free tools we build for port and terminal engineers. Some are public, the others we send on request. Open a card for the details.

  • Isometric illustration: VBS API

    PublicTerminal integration

    VBS API

    Connect a transport management system to a terminal's truck appointment system.

    REST · JSON · API key · UML sequence diagram

    Details about VBS API
  • Isometric illustration: Terminal data contracts

    On requestTerminal integration

    Terminal data contracts

    Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

    JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace

    Details about Terminal data contracts
  • Isometric illustration: Terminal integration kit

    On requestTerminal integration

    Terminal integration kit

    A small core and plugins to connect a TOS, a gate, a booking system or your back office.

    Python 3.10+ · Standard library only · plugin.json · Standard Webhooks

    Details about Terminal integration kit
  • Isometric illustration: TOS Groovy recipes

    On requestTerminal integration

    TOS Groovy recipes

    Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

    Groovy · Navis N4 extensions · PHP relay

    Details about TOS Groovy recipes
  • Isometric illustration: Terminal devtools

    On requestTerminal integration

    Terminal devtools

    Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

    Python · PHP · ISO 6346 · UN/EDIFACT

    Details about Terminal devtools
  • Isometric illustration: Container tracking core

    On requestTerminal integration

    Container tracking core

    Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

    Python 3.11+ · PHP 8.1+ · HTTP facade

    Details about Container tracking core
  • Isometric illustration: Terminal integration map

    ComingTerminal integration

    Terminal integration map

    Where to plug what at a container terminal, and what costs three weeks when you ignore it.

    Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE

    Details about Terminal integration map

See every package and how to get them

Isometric illustration: VBS API

PublicTerminal integration

VBS API

Connect a transport management system to a terminal's truck appointment system.

For
Developers of hauliers and transport management systems (TMS)
Stack
REST · JSON · API key · UML sequence diagram · Code examples
Licence
Apache-2.0
State
The code is on our public GitHub. Use it today.

What is in it today

  • The five-step workflow: prevalidate an operation, create it, read the slots of a day, prevalidate an appointment, create it
  • Authentication by x-api-key and a portId header
  • One error shape: status 400 and an error field
  • Examples folder and a sequence diagram
View on GitHubTalk to us about it
Isometric illustration: Terminal data contracts

On requestTerminal integration

Terminal data contracts

Language-neutral contracts for container-terminal data, with fixtures and a conformance runner.

For
Engineers who connect a terminal operating system (TOS) to anything else
Stack
JSON Schema 2020-12 · OpenAPI 3.1 · Python · DCSA Track & Trace
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Schemas: container tracking answer, structured not-found, one error shape, booking lookup, bill of lading
  • Six reference fixtures (fictitious containers, valid ISO 6346 check digits)
  • OpenAPI 3.1 of the tracking facade: GET /v0/tracking/{container_number} and by booking
  • A conformance runner (exit 0 / 1 / 2) and a mapping to DCSA Track & Trace 2.2.0

Next

  • OpenAPI 3.1 of the read-only terminal data API

What it will never do

  • Invent data: no data means the field is absent, never « unknown », never a default
Get the package and talk to us
Isometric illustration: Terminal integration kit

On requestTerminal integration

Terminal integration kit

A small core and plugins to connect a TOS, a gate, a booking system or your back office.

For
Integration engineers of terminals, ports and logistics platforms
Stack
Python 3.10+ · Standard library only · plugin.json · Standard Webhooks
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • The core and two reference plugins, tested
  • A mock terminal shaped like Navis N4
  • A read-only N4 connector
  • Health is green, red or undetermined: « could not check » is never « all good »

Next

  • The other connectors are specified, not written yet
Get the package and talk to us
Isometric illustration: TOS Groovy recipes

On requestTerminal integration

TOS Groovy recipes

Read-only recipes for terminal operating systems: answer tracking questions, push gate events anywhere.

For
Terminal IT teams running Navis N4 with the extension option
Stack
Groovy · Navis N4 extensions · PHP relay
Licence
MIT
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • n4-gate-event-push: every N4 gate passage pushed to an HTTPS receiver, PHP relay with queue and retries (relay tested, Groovy to run on a real N4)

Next

  • Container status, customs holds, charges, booking lookup, free time and demurrage
  • A read-only guard (a write attempt is refused, tested), rate limit and cache
  • Tideworks after N4, same facade

What it will never do

  • Write into a TOS, ever
  • Ship a recipe that never ran on a real TOS
Get the package and talk to us
Isometric illustration: Terminal devtools

On requestTerminal integration

Terminal devtools

Small tools every terminal developer rewrites: ISO 6346 check digit and a fake TOS for tests.

For
Developers who write terminal software or test against a TOS
Stack
Python · PHP · ISO 6346 · UN/EDIFACT · UN/LOCODE
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • ISO 6346 check digit in Python and PHP, tested against one shared set of test vectors
  • tos-mock: a fake TOS that serves the tracking facade on six fictitious containers

Next

  • ISO 6346 in TypeScript
  • An EDIFACT pretty-printer (COPARN, CODECO, BAPLIE, COARRI)
  • Offline UN/LOCODE
Get the package and talk to us
Isometric illustration: Container tracking core

On requestTerminal integration

Container tracking core

Where a container is and whether a truck can pick it up, the same answer whatever TOS is behind.

For
Terminals and port communities that publish container status
Stack
Python 3.11+ · PHP 8.1+ · HTTP facade
Licence
To be decided (Apache-2.0 proposed)
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • One library, two bindings (Python and PHP) that give identical answers
  • An HTTP facade that passes the conformance runner
  • Works before any API, on six fictitious demonstration containers

What it will never do

  • Serve an answer it cannot vouch for
Get the package and talk to us
Isometric illustration: Container tracking and history for WordPress

On requestTerminal integration

Container tracking and history for WordPress

Two plugins for a terminal's website: find a container, or a bill of lading and all its containers.

For
Terminals whose public website runs on WordPress
Stack
PHP 8.1+ · WordPress 6.4+ · Shortcodes and block
Licence
GPL-2.0-or-later
State
The code exists and is tested, not public yet. We send it to you.

What is in it today

  • Container search: where it is, whether a truck can pick it up, and each hold with its reason
  • Bill of lading search: every container of a B/L; a container alone is refused, so nobody sees another customer's cycle
  • ISO 6346 check digit on every container number
  • Works at activation on demonstration data

Next

  • Drupal and Joomla versions
Get the package and talk to us
Isometric illustration: Terminal integration map

ComingTerminal integration

Terminal integration map

Where to plug what at a container terminal, and what costs three weeks when you ignore it.

For
Integrators starting a project at a container terminal
Stack
Markdown · Sequence diagrams · ISO 6346 · UN/LOCODE · UN/EDIFACT · SMDG MIGs
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Layers: operations, customs holds, billing, gate and booking, EDI
  • « Am I allowed? » in 30 seconds, per TOS licence
  • Paths that work without the TOS extension licence

What it will never do

  • Republish vendor manuals
  • Quote licence prices
  • Advise bypassing a licence
Get the package and talk to us
Questions

Customs: questions

Click a question to read the answer.

Annex I of Directive (EU) 2022/2555 lists public administration entities of central governments, as defined by each Member State in accordance with national law. Your national law says whether, and how, it applies to you.

Yes. The engineer self-test and the team self-test are free, take about two minutes and run in your browser; nothing is sent to us.

Talk to us first in confidence: membership is open to the organisations of the port chain, and we will see with you what fits. See the launch offer.

Yes. What you share with us stays between us, and we never name a member without its written agreement.

Launch offer

Talk to engineers who work inside ports

Two free self-tests, about two minutes each, then a first call in confidence with engineers who work inside ports.

Want to know where you stand?

Take the 2-minute test

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting