Laredo is the busiest inland port in the United States. More than half of all truck traffic between the United States and Mexico crosses here, and the businesses that make that happen, customs brokers, freight forwarders, third-party logistics firms, and the warehouses behind them, run on software that has to work during a very specific set of hours.
That changes what good IT looks like. A brokerage is not a generic small office that happens to have computers. Below is what actually matters when technology supports cross-border trade.
Downtime is measured in trucks, not minutes
For most small businesses, an hour of downtime is an inconvenience. For a brokerage filing entries against trucks staged at the bridge, an hour is drivers waiting, detention charges accruing, and a customer calling to ask why their load has not moved.
The practical consequence is that your uptime requirements are not evenly distributed. They are concentrated in your filing and crossing windows. Any IT plan worth paying for should be built around when your business actually needs to be online, not a generic service level copied from a template.
Two questions worth asking any provider:
- What happens if our internet drops at 10am on a Tuesday? Is there a failover connection, and has anyone tested it?
- How long does it take to get a workstation back to filing if it dies mid-shift? Is there a spare, an image, or a two-day wait?
Your dependency list is longer than you think
A brokerage typically depends on a stack that reaches well outside its own walls: CBP’s ACE portal, your customs software, EDI connections to carriers and clients, email, and document storage holding entry paperwork.
Most of that you do not control. What you do control is everything between your desk and those systems: your connection, your workstations, your browser configuration, your credentials, and your ability to keep working when one link fails.
An IT provider who has never looked at that chain will treat your business like a dental office. The right approach is to map the dependencies first and then decide where redundancy is actually worth paying for.
Invoice and wire fraud is the threat that should worry you most
Ransomware gets the headlines. For businesses that routinely move money across a border, the more likely and more expensive attack is business email compromise.
The pattern is consistent. An attacker gets into an email account, often through a stolen password rather than anything sophisticated. They read quietly for days or weeks, learning who pays whom and how invoices are worded. Then they send a message that looks entirely normal, from a real address, changing the bank details on a payment that was always going to happen.
International trade is an ideal target because payments to foreign accounts are routine. Nobody blinks at new banking details for an overseas counterparty.
What actually reduces this risk:
- Multi-factor authentication on every email account, without exceptions. This single control stops most account takeovers. Exceptions are where breaches begin.
- A verbal callback rule for any change to payment details, to a phone number you already had on file, never one from the email requesting the change.
- Email security that flags external senders and lookalike domains. Attackers register domains one character off from a real one and rely on nobody reading closely.
- A password manager, so credentials are not reused between your customs software and a personal account that was breached three years ago.
None of this is exotic. It is unglamorous and it works.
Recordkeeping is an IT problem, not just a compliance one
Customs recordkeeping obligations generally require entry records to be retained for five years, and the specifics depend on your filer status and what you are keeping. Your customs counsel is the authority on the requirement itself.
The IT side of that obligation gets overlooked. Retention means those records have to survive five years of hardware failures, staff turnover, ransomware, and software migrations. A folder on a machine under someone’s desk does not meet that bar, and neither does a backup nobody has ever restored from.
What a defensible setup looks like: records stored somewhere with versioning, backed up to a second location, with restores tested on a schedule and the results written down. If you were asked tomorrow to produce a document from four years ago, the honest answer should be yes, not probably.
If you are CTPAT certified, cybersecurity is already in scope
CTPAT’s minimum security criteria include cybersecurity requirements covering things like password policy, access control, system protection, and handling of removable media. Many members treat these as a paperwork exercise. They are also a reasonable baseline for a business of any size, which is a rare thing to be able to say about a compliance framework.
If you are pursuing or maintaining certification, your IT provider should be able to speak to those criteria directly rather than handing you back a form to fill in.
A short checklist
- Multi-factor authentication on email and your customs software, with no exempt accounts
- A tested failover for your internet connection
- Spare or imaged workstations so a hardware failure costs an hour, not a day
- Backups that are verified by restore, not just reported as successful
- A written callback rule for payment detail changes
- A password manager in actual use, not just purchased
- Offboarding that revokes access the same day someone leaves
- Someone who answers the phone in the language your staff is most comfortable working in
Common questions
What is different about IT for a customs broker compared to a normal office?
Three things: uptime requirements concentrated in specific filing and crossing windows, dependence on external systems like CBP’s ACE portal and EDI connections you do not control, and elevated exposure to invoice and wire fraud because cross-border payments are routine.
What is the biggest cybersecurity risk for a freight forwarder?
Business email compromise. An attacker gains access to an email account, studies normal invoicing patterns, then redirects a legitimate payment by changing bank details. Multi-factor authentication and a verbal callback rule for payment changes are the two controls that matter most.
How long do customs records need to be kept?
Customs recordkeeping obligations generally run five years, with specifics depending on filer status and record type. Confirm the requirement with your customs counsel, then make sure your backup and retention setup can actually meet it.
Do you support businesses in Spanish?
Yes. SolveIT supports clients in English and Spanish, which matters in an industry where teams work across the border daily.
Where to start
If you run a brokerage, forwarding operation, or warehouse in Laredo and are not confident about the checklist above, start with the two cheapest items: multi-factor authentication everywhere, and a written callback rule for payment changes. Those two cost almost nothing and remove most of your realistic risk.
For the rest, we are local, we are on Houston St. downtown, and we work without long-term contracts. Call 956-849-6174 or get in touch and we will walk your setup with you.