I85PREP
⌘ K
CPSS study materials
CPSS study resources

CPSS: Information and Cyber Security in the Supply Chain

CPSS · Work through your exam, one topic at a time.

All guide sections

Information and Cyber Security in the Supply Chain

This domain tests whether you understand data as the connective tissue of logistics - and that a cyber event becomes a physical one when a load is diverted, a port stops, or a warehouse management system is encrypted.

Frameworks

  • NIST Cybersecurity Framework: identify, protect, detect, respond, recover - usable for gap analysis and board reporting.
  • ISO/IEC 27001: an ISMS with risk assessment, statement of applicability and audit cycle. A supplier certificate is evidence of a process, not a guarantee for your integration.

Controls that matter in logistics

  • Identity and access: multi-factor authentication for remote and third-party access, role-based least privilege, privileged access management, prompt deprovisioning when staff leave.
  • Segregation of IT and OT: warehouse management systems, terminal operating systems, PLCs and building controls should not share a flat network with email.
  • Data protection: encryption in transit and at rest, integrity checks on EDI and API messages, tested backups held offline.
  • Transaction integrity: out-of-band verification of changes to bank details, consignee, routing or pickup authority, with dual approval for high-value changes.
  • Email defences: SPF, DKIM and DMARC, plus a habit of verifying through a separate channel.
  • Third and fourth parties: questionnaires, contract clauses, audit rights, attestations such as ISO 27001 or SOC 2, and mapping of who else touches your data.
  • Detection: logging, monitoring, alert thresholds and a reporting route staff actually use.

Worked example

A supplier emails updated bank details three days before a large payment, attaching a PDF on matching letterhead. Reasoning: letterhead is not a control, and the change arrived through the channel the attacker controls. Verified action: call the supplier contact from the contract record, confirm the change, require dual authorisation, and inspect the headers - the reply-to differed from the display address. Payment held, attempted fraud logged and reported.

Traps

Treating cyber as an IT-only issue; assuming a certified supplier is secure in your integration; forgetting legacy OT and unpatched dock terminals; ignoring the integrity of shipping documents themselves; and having no playbook for ransomware at a single-point provider.