SOC 2 by industry
SOC 2 for logistics software: shipments, partners and the integrations between them.
Logistics software sits between companies: shippers, carriers, warehouses, brokers and customs. Data arrives through dozens of feeds, and many outside users log in through partner portals. A buyer's worry is less about one database and more about the web of connections, and whether a wrong or missing message stops goods moving. This guide covers how to scope a SOC 2 around that web.
Back to SOC 2 services01 · Who asks
Who asks logistics companies for a SOC 2 report
The buyer decides the scope and the weight of the report, so start with who is asking.
| Asked by | What they want to see |
|---|---|
| Shipper or retailer supply chain team | Uptime during peak season, recovery plans and how quickly a failed feed is noticed. |
| Shipper's security or vendor risk team | How partner and carrier users are onboarded, limited to their own shipments, and removed. |
| Third-party logistics provider using your platform | Separation between their clients' inventory and orders, and accuracy of billing data. |
| Manufacturer with regulated goods | Integrity of traceability records and who can amend them. |
02 · What is in scope
What sits inside the system boundary
The report covers one system. In this sector the boundary usually takes in:
- Order, shipment and tracking data
- Consignee details, contents, values and status events, the core record customers rely on.
- Integration layer
- EDI, API and file feeds to carriers, marketplaces and customer ERPs, with their mapping rules and error queues.
- Partner and carrier portals
- External user access for carriers, suppliers and brokers, each seeing a slice of the data.
- Warehouse and driver devices
- Scanners, handhelds and mobile apps that create events in the field.
- Rating and billing
- Freight rates and accessorial charges that turn events into invoices.
03 · Categories
Which Trust Services Categories matter here
Security is always in. The rest depend on what you promise customers.
| Category | Weight in this sector | Why |
|---|---|---|
| Security | Always | Required; the hard part is external users in large numbers. |
| Availability | Strong | If the platform is down, docks stop and trucks wait. Customers press on recovery. |
| Processing Integrity | Often | Dropped or duplicated messages mean lost shipments or wrong invoices. |
| Confidentiality | Sometimes | Shipper volumes, rates and customer lists are commercially sensitive. |
| Privacy | Sometimes | Recipient names and addresses, plus driver location data, can bring it in. |
04 · Vendors in the report
The vendors that appear in your report
Each one is a subservice organization or a carve-out, and the report has to say which.
- Cloud host
- Usually carved out; multi-region and backup design on top of it stays in scope.
- EDI network or integration platform
- Carved out where a value-added network or integration service carries messages; monitor its report and outage notices.
- Mapping and telematics providers
- Name them if location or route data flows through them.
- Carriers and brokers
- Usually not subservice organizations: they are your customers' counterparties. Describe the integration controls, not their operations.
05 · Sector controls
Controls that this sector makes necessary
Examples only. Your own wording is what the auditor tests.
- S.1Message completeness monitoringEach integration tracks sent, received and acknowledged messages; gaps raise an alert to an owner.
- S.2Mapping change controlChanges to EDI or API mappings are tested with sample messages before going live for a partner.
- S.3Partner user lifecyclePartner admins invite their own users within limits, and accounts unused for a set period are disabled.
- S.4Shipment-level access rulesA carrier sees only shipments assigned to it; a supplier only its own purchase orders.
- S.5Device enrolment and loss handlingField devices are enrolled, locked to the app and can be wiped when lost.
- S.6Peak readiness reviewBefore known peaks, capacity, failover and on-call cover are reviewed and recorded.
- S.7Rate table approvalsChanges to customer rate tables are approved by someone other than the person who entered them.
06 · Traps
Where companies in this sector slip
Predictable, and cheaper to fix before fieldwork.
- Hundreds of partner users with no review. External accounts pile up. Without a lifecycle control, access reviews have no realistic population.
- Error queues nobody owns. Failed messages sitting in a queue are a completeness failure the auditor can find in a sample.
- Calling carriers subservice organizations. This muddles the report. They are counterparties; your controls cover the connection.
- Recovery tested only for the core app. If integrations aren't part of the recovery test, a restored platform may still receive nothing.
- Shared logins on warehouse devices. A single login per dock hides who scanned what, which hurts both security and integrity evidence.
07 · Partner integrations
Partner portals and integrations: the controls a reviewer looks for
Every connection is either a door for people or a pipe for data. Each needs different evidence.
Doors
Partner portals
- Delegated administration with limits on what partner admins can grant
- Single sign-on or multi-factor for partner users
- Inactivity disablement and periodic attestation by the partner
- Visibility scoped to assigned shipments or orders
Pipes
Integrations
- Authenticated endpoints with per-partner credentials
- Schema validation and rejection of malformed messages
- Acknowledgement tracking and gap alerts
- Replay and reprocessing with an audit trail
Many reports test the doors and assume the pipes. Buyers in this sector usually ask about both.
- Partner countLarger partner networks make delegated administration and automatic disablement more important than manual review.
- Message volumeAt high volume, completeness has to be measured automatically; spot checks won't do.
- Customer-built integrationsWhere customers wire their own feeds, list the controls they own as CUECs.
08 · Evidence
Evidence to have ready
What an auditor will ask for, in the order they usually ask.
- Integration inventory with owner, protocol and credential type per partner
- Message completeness reports and resolved error-queue tickets
- Partner user listing, inactivity disablement runs and attestation records
- Mapping change tickets with test messages
- Recovery test results that include integrations
- Peak readiness review records
- Device inventory and lost-device wipe records
Supply-chain security programmes ask overlapping questions
Customers enrolled in customs security programmes, such as the US Customs Trade Partnership Against Terrorism (CTPAT), may need to show that their business partners protect shipment data and systems. A SOC 2 can help a customer answer those partner questions. It is not membership of, or compliance with, any customs or trade programme.
Sources: AICPA Trust Services Criteria (TSP section 100, 2017, revised points of focus 2022), including A1.1 to A1.3 and PI1.1 to PI1.5; AICPA description criteria (DC section 200); AICPA SOC 2 guide; US Customs and Border Protection CTPAT Minimum Security Criteria.
More about SOC 2 for logistics
Our platform is mostly integrations. What does the auditor actually test?
Your monitoring and change control over them.
The auditor won't test a carrier's systems. They test that you know what each feed should deliver, notice when it doesn't, and control changes to mappings and credentials. Those records become the samples.
Do we have to review every partner user ourselves?
Not if the control says otherwise.
Many platforms delegate user administration to each partner's admin and rely on automatic disablement plus periodic partner attestation. The report must describe that design, and list what partners are expected to do.
Is Processing Integrity needed if we don't calculate invoices?
Often still useful.
Status events drive decisions such as releasing payment or reordering stock. If customers rely on them being complete and timely, Processing Integrity can fit even without billing.
Peak season falls in our observation period. Is that a problem?
It can be an advantage.
Controls that operate well under load are strong evidence. Just make sure on-call, capacity reviews and incident records are kept through the busy weeks, when people are most tempted to skip them.
Scope your logistics SOC 2 around what buyers ask.
A readiness assessment turns this into your boundary, your categories and your gaps.