ISO 27001 for logistics: the certificate your customers ask for

A logistics provider knows what its customers ship, to whom, on which day and from which warehouse. Often it is also connected to the customer's own systems through EDI, an API or a portal login. If that data leaks or the dispatch system stops, the customer's business stops with it.

Purchasing departments know this. Their supplier questionnaires now contain pages on information security, and answering them again for every customer takes your dispatcher or IT contact days. A certificate replaces most of those pages. Tenders often include it as a required document, and a customer audit gets shorter when the auditor can open a verification page instead of reading your answers.

ISO 27001 suits this because it does not prescribe products. It asks you to identify your own risks, choose controls that fit them and show that you keep them running.

• ISO 27001 at a glance

The standard works from your risk assessment. In logistics, the same few areas come up again and again.

Consignment and consignee data

Names, addresses, phone numbers and delivery windows of your customers' customers. They sit in the transport management system, in driver apps and in e-mail threads with dispatchers.

Warehouse and transport systems

If ransomware locks the warehouse management system, picking and dispatch stop. Backups, a tested restore and a plan for working without the system belong here.

Customer interfaces

EDI links, API keys and portal accounts connect you to several customers at once. The risk is that one customer's staff or system can see another customer's data.

Subcontractors and temporary staff

Partner carriers, agency workers and seasonal staff need access for a short time. Shared logins on handhelds and accounts that outlive the contract are the typical weak points.

Mobile devices and shared workstations

Handheld scanners, driver phones and PCs at the ramp are used by many people and can be lost or left unlocked. Device management and screen locks reduce the exposure.

Fraudulent orders

Fake pickup requests and altered bank details in freight invoices arrive by e-mail. Verification steps and staff awareness are the controls that count.

The standard asks for decisions and evidence, not for a specific tool. The table shows what the main requirements can look like in a forwarder, a carrier or a warehouse operator.

Most of the work is knowing your own operation. Five points will get you through the questions without searching for answers halfway.

1. 01

   Define the scope

   Decide which sites, services and systems the certificate covers. A single warehouse and its systems is a valid scope.

2. 02

   List systems and data flows

   Write down where consignment data enters, where it is stored and who receives it, including customer interfaces.

3. 03

   Name a responsible person

   One person owns information security. In a small firm this is often the managing director or the IT lead.

4. 04

   Check access

   Review who has access to the warehouse and transport systems, including subcontractors, and remove accounts that are no longer needed.

5. 05

   Collect what already exists

   Backup routines, password rules, training records and contracts with partner carriers count as evidence of controls you already run.

• ISO for small and medium businesses

You complete an online self-assessment with 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 need a yes. No on-site audit takes place. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before it is issued.

The certificate is a PDF with a number and a QR code. Your customer's purchasing department can enter the number or scan the code and see the certificate on a public verification page. It is valid for 3 years and confirmed every year by a short online re-audit.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If your company also holds or wants ISO 9001, the multi-standard discount is 20% for two standards and applies to the yearly fee as well. You do not need an account to buy.

• Start the free self-assessment
• See pricing
• ISO 27001 at Zertify

The classic route means an on-site audit by a certification body. It takes more of your calendar and involves auditors visiting your depot. Zertify works entirely online and is built for companies that need a verifiable certificate quickly.

Before you choose, read the wording in the tender or the supplier questionnaire. Some customers ask for an ISO 27001 certificate without further conditions. Others describe the route they want. If the text is unclear, ask the purchasing contact what they will check.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs