Information security
WiseTech places information security at the forefront of its operations and culture, recognizing that safeguarding sensitive information is not only a legal and regulatory obligation but also a fundamental responsibility to our customers, employees and stakeholders.
The Board, through the Audit & Risk Committee, oversees the management of material technology and cybersecurity risks. Management oversight is supported by the Information Security Committee, which brings together relevant technology, security, risk, audit, legal and business representatives. The Committee supports the implementation, operation and ongoing management of the Information Security Management System through a process of regular review and action.
The Information Security Committee regularly considers information security risks and incidents, industry and technology developments, legislative and regulatory changes, and relevant threat intelligence. The Head of Information Security provides regular reporting to the Board and management on key risks, incidents, control matters and security performance.
Our information security program is led by dedicated Information Systems and Information Security functions, supported by specialist teams responsible for security operations, application security, governance, risk and compliance, identity and access management, infrastructure security, vulnerability management and data protection.
Our Information Security Risk Management Framework guides the assessment of risks and associated controls by systematically identifying potential threats and vulnerabilities, evaluating their potential impact on our information assets and operations, and determining appropriate risk-treatment strategies. The framework establishes common policies, standards and expectations for protecting information and technology across our global operations.
As we grow, including through acquisitions, security assessment and integration activities form a key part of our broader risk management and operating model. These activities include incorporating acquired businesses into relevant security governance, risk-management and assurance processes, and progressively applying group standards, capabilities and technology.
Our Information Security Policy provides direction for managing risks associated with information, source code, cloud services and technology systems. Compliance with the policy and its supporting standards and procedures is mandatory for employees, contractors and relevant third parties with access to WiseTech products, services, systems, corporate information or customer information.
WiseTech achieves and maintains ISO/IEC 27001 information security certifications and SOC 1 Type II and SOC 2 Type II attestations. Our ISO/IEC 27001:2022 certification covers the Information Security Management System supporting the CargoWise application and CargoWise Cloud services at specified global locations, including the relevant people, processes, systems and infrastructure supporting those services. Relevant controls are independently assessed by external auditors and certification bodies as part of maintaining these certifications and attestations.
Our external assurance is complemented by a risk-based Internal Audit program overseen by the Audit & Risk Committee. Findings from internal and external reviews are tracked through established remediation, reporting and governance processes.
We prioritize continuous education and training for our workforce, deploy state-of-the-art security technologies, conduct regular risk assessments, and maintain robust incident response protocols to ensure a resilient and proactive approach to addressing cyber threats and maintaining the trust of those we serve.
Our structured, proactive approach to managing information security risks applies a strong set of internal data protection controls.
These include access controls, encryption, network segregation, network traffic inspection and secure storage. This is overlaid by a program of continuous monitoring, collection and secure storage of audit and access logs, patching, threat protection and vulnerability detection processes.
Our architecture philosophy is founded upon the principles of defense-in-depth, least privilege, proactive threat mitigation, continuous monitoring, and a risk-based approach to safeguarding data and systems. We prioritize the implementation of robust security controls, adherence to industry best practices, and a culture of security awareness to ensure the confidentiality, integrity, and availability of our organization's critical information assets.
WiseTech relies on technology, cloud, data-center and other service providers in delivering and supporting its operations. Third parties are assessed according to the nature and criticality of the services they provide and their access to WiseTech or customer information and systems.
Our third-party security processes include risk-based due diligence, security and privacy requirements within contractual arrangements, consideration of relevant independent certifications and assurance reports, and ongoing review proportionate to the supplier’s risk. Higher-risk service providers may be subject to enhanced assessment and monitoring.
These processes support our management of risks arising from outsourced services, cloud platforms, software dependencies, data processors and other components of our technology supply chain.
WiseTech and its subsidiaries recognize the importance of privacy and data protection. We seek to comply with applicable privacy and data-protection laws and regulations in the jurisdictions in which we operate and to safeguard the personal information entrusted to us.
As an Australian-headquartered company, WiseTech is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our Privacy and Data Collection Notice explains how we collect, manage, use and disclose personal information.
WiseTech provides logistics software and services to customers operating in hundreds of countries. We therefore monitor privacy and data-protection developments globally, including the European Union General Data Protection Regulation. Our approach is to apply a consistent and high standard of privacy and data protection across our operations, informed by robust global requirements.
Applying consistent privacy and data-protection principles also helps our technical and product teams design and maintain capabilities that can support customers operating across multiple jurisdictions without requiring separate security and privacy features for every geography.
Our technical, product, Legal, Privacy and Information Security teams work together to incorporate applicable privacy and data-protection requirements into the design, development and operation of our products, services and supporting processes. Our external Data Protection Officer also supports our compliance with applicable GDPR requirements.
Our people are required to complete privacy and data-protection training, with additional or more specific training provided where relevant to a person’s role or responsibilities, including training relating to the GDPR.
We maintain data-processing terms with customers and publish notices explaining how we collect and process personal information. Our standard Data Processing Addendum establishes contractual commitments relating to the processing and protection of customer data.
Privacy and data-protection considerations also form part of our supplier assessment and engagement processes. We consider the ability of prospective suppliers and data processors to meet relevant privacy, data-protection and security requirements before entering into applicable engagements.
Our privacy program is supported by the security controls described above, including access management, encryption, vulnerability management, security monitoring, penetration testing and incident response. We also maintain processes for responding to privacy enquiries and requests and for assessing, escalating and managing privacy-related risks and incidents.
Business continuity and resilience
The performance, reliability and availability of our technology platform, data centers and global communication systems are critical to our business.
Our business continuity framework is designed to reduce the likelihood and impact of interruptions, maintain the highest practicable service levels and support the timely recovery of affected services. The framework encompasses crisis management, business continuity planning, incident response, crisis communications and disaster recovery.
It covers our crisis management response, business continuity planning, incident response and disaster recovery planning. Plans within this framework are reviewed and tested frequently, and controls related to continuity of service are continually assessed and, where necessary, modified and improved as the internal and external environment changes.
Resilience is supported by operating separate data centers across multiple geographical regions, reducing reliance on any individual data center, together with processes for replicating data between relevant environments. Our global support model provides 24-hour operational support, 365 days a year. Other resilience controls include data segregation, backups maintained on independent infrastructure and monitoring of critical access and systems.
Our Incident Management Procedure governs the logging, monitoring, escalation and resolution of incidents. It is supported by incident-management plans and playbooks that define responsibilities and response processes. Critical systems and recovery arrangements are tested to support our preparedness for significant operational or cybersecurity incidents.
Plans and controls within this framework are reviewed and tested, and are updated as our business, technology and external operating environment change.
Modern slavery
We are committed to conducting business in an ethical, lawful, and socially responsible manner and expect the same from our team members and suppliers.
We are committed to upholding and respecting human rights for all people as articulated in the UN Guiding Principles on Business and Human Rights, the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, the International Covenant on Economic, Social and Cultural Rights, and the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work.
WiseTech’s Modern Slavery Statement may be found on our website within the Corporate Governances pages.
Our Code of Conduct requires our team members and company Directors to be aware of the risks of modern slavery and conduct due diligence as relevant to their role. All employees and other workers are required to undertake annual Modern Slavery compliance training.
Modern slavery awareness training forms a part of WiseTech’s onboarding program for new employees, with refresher training required annually.
Cross-functional leaders determine additional activities to be undertaken to manage modern slavery risk in our business and supply chain.