Cyber security

Prevention and Protection

We dedicate significant time and resources to cyber security

DSV’s business is reliant on successful operation of information technology and systems to fulfil its mission and deliver high-quality service to its customers. As a result, the organisation considers its information and information systems important assets that are crucial to its operational excellence. To protect these assets, DSV has established an Information Security Programme that follows information security best practices and is based on principles from leading international standards, and DSV is ISO27001:2022 certified.

Information Security Policy 
The Information Security Programme in DSV is underpinned by our corporate Information Security Policy, which is the top-level policy for the security of information and information systems in DSV that ensures that information security is an integral part of DSV’s business. The policy outlines top management’s direction and commitment to information security, sets objectives and principles for information security, and defines DSV’s approach to managing information security in accordance with business requirements and relevant laws and regulations. The Information Security Policy applies to DSV globally, covers all types of information and information systems, and compliance with it is mandatory.

Core Information Security Objectives and Principles  
In its approach to information security DSV strives to support the corporate strategy and values as well as to ensure that appropriate safeguards are in place to preserve the confidentiality, integrity and availability of information. This enables DSV to maintain its information in a secure manner, reduce the risk and potential impact of disruptive events, support business continuity, comply with laws and regulations as well as to ensure that our customers’ information is treated with utmost care and confidentiality. 

As such, our core principles are as follows:

• Effective governance with clear organisation and well-defined roles and responsibilities is key to maintaining information security throughout all levels of the organisation. We have dedicated resources to information security for both overall governance and day-to-day operational management of information security.
• A risk-based approach to information security across the organisation. We work towards continuous identification, assessment and mitigation of information risks across the organisation, implement prevention technologies and perform proactive monitoring of threats.
• Implementation of technical, procedural and organisational information security controls in alignment with best practices and standardisation of the information security setup across the technical infrastructure.
• Resilience of our processing facilities and technical infrastructure to ensure availability of information systems.
• Collaboration with external information security partners to ensure that our security measures stay up to date and protect us from rapidly evolving cyber threats.
• 24/7 security monitoring by our Security Operations Centre to detect and respond to any type of security event on our systems and contain it before it escalates into a serious security incident.
• Clear business continuity and disaster recovery processes to minimise impact in case of a security breach.
• Continuous improvement of our information security capabilities across the entire spectrum.

Employee Awareness and Acceptable Use Policies Our employees are our first line of defence for protecting DSV from potential information security threats and breaches. Therefore, we are running a global information security awareness programme to foster a culture of information security and support correct security behaviour among employees.

The programme is aimed at all employees in the company. Our goal is therefore to make it accessible, understandable and engaging to all employees regardless of their work area.

To do this, we have created training that supports principles of sustainable learning by regularly subjecting our employees to training and practise along with identifying risk users and providing targeted training. We aim to promote awareness through different platforms such as traditional frequent organised elearning, newsletters on current events and relevant topics, simulated phishing campaigns as well as training based on behavioural science to impact positive secure behaviour.

 Additionally, we have created and published an Acceptable Use Policy for our employees to ensure that they are aware of their responsibility when it comes to using and protecting the information of DSV and its customers. 
 

Information Security Governance We have established a DSV Security Board to oversee that our global information security priorities are in alignment with our business and IT strategies. The Security Board is chaired by our CFO with the purpose of setting the direction for information security and governance of our portfolio of security initiatives and risks. Furthermore, the Security Board evaluates and approves the necessary response based on the current information security threat landscape. The Security Board approves deadlines on security initiatives, defines security key controls and sets the direction of strategic information security priorities. Security Board meetings are held bi-monthly. Reporting to the Board of Directors (Audit Committee) on information security is performed three times per year.

Customer Assurance We strive to communicate openly and transparently to our customers when it comes to information security. In DSV we have an internal IT compliance programme driven by Group IT Compliance which provides IT assurance globally on a risk-based approach. Scope and priorities are aligned with the Security Board – and findings are reported to the Security Board. Furthermore, we have engaged with our external IT auditors to validate that we deliver on our information security promises to our customers. The validation is performed through the independent and internationally recognised ISAE 3402 Type 2 report that demonstrates assurance and provides a unique insight into our information security practices. The assurance report is updated on an annual basis. Both the ISAE 3402 report and the ISO 27001 certificate can be shared with customers and collaboration partners for assurance purposes upon request.

Read more about our Management Systems

AI Governance in DSV

To safeguard DSV and ensure the responsible use of Artificial Intelligence, DSV has established an AI governance framework designed to support compliance, risk management, business value, trust, and transparency.

AI governance is anchored across DSV and represented by stakeholders from the business, Global IT, IT Compliance, Enterprise Architecture, and other relevant functions.

DSV has established a formal AI governance framework consisting of an AI Policy, AI Standard, AI User Guideline, governance boards, risk management processes, and approval workflows.

Security Board is overall accountable for information security in DSV and delegated the responsibility of AI governance to AI Governance Board. 

The AI Governance Board is accountable for overseeing AI governance and DSV's AI strategy, while ensuring that clear roles, responsibilities, and accountability mechanisms are established and maintained.

AI Policy is a part of DSV’s Information Security Management System (ISMS).  The policy establishes requirements for secure development, deployment, and operation of AI systems and models within or on behalf of DSV. It aims to protect confidentiality, integrity, and availability of associated data while ensuring ethical and responsible AI use.

Guideline for use of AI in DSV defines the end-user requirements for responsible and secure use of AI services in DSV.

DSV’s Responsible AI Principles 

• Accountability AI Governance Board ensures governance and oversight in line with the AI Strategy.
• Continuous Improvement AI performance, risk, and compliance are regularly reviewed and improved.
• Explainability Refers to the ability to describe an AI model's internal workings or outcomes in understandable terms.
• Fairness & Non-Discrimination AI must avoid unjust bias; fairness assessments must be performed both on the input and output
• Human Oversight Meaningful human control is maintained over AI-driven decisions.
• Privacy & Data Protection Personal data used for AI must comply with privacy laws (e.g., GDPR) and DSV internal data policies (e.g., Data Classification).
• Reliability & Safety AI systems must be robust, secure and safe throughout their entire lifecycle: AI systems must function as intended under defined conditions and fail safely.
• Transparency AI designs, data sources, and decision logic must be explainable and documented.

AI Risk Management and Oversight

DSV applies a formal AI risk management framework supported by risk assessments before approval and deployment of AI solutions. All AI solutions must have documented intended use cases, limitations, and prohibited uses. AI systems are subject to review and approval through the established AI governance process. The use of AI technologies that may pose heightened privacy, ethical, legal, or regulatory risks is subject to enhanced governance and approval requirements. 

DSV prohibits the development, acquisition, deployment, or use of AI systems classified as "Unacceptable Risk" under the EU AI Act, including systems involving social scoring, manipulation, exploitation of vulnerable persons, and unauthorized biometric surveillance.

AI solutions are subject to monitoring throughout their lifecycle. Monitoring activities may include performance evaluation, detection of model or data drift, security monitoring, and periodic assessments of fairness and bias. Where required, corrective actions are implemented to maintain the reliability, accuracy, and responsible operation of AI systems.

AI Transparency and Responsible Use

DSV promotes transparency in the use of AI. AI systems shall be appropriately documented to enable understanding of their purpose, ownership, intended use, key data sources, and decision-making logic

Where relevant, AI-generated content, recommendations, or outputs are identified as such, enabling users to understand when AI has contributed to the creation of information or decision-support outcomes. DSV promotes transparency in AI-enabled services by providing users with supporting references or source information where available, helping them assess the reliability and context of AI-generated outputs.

DSV maintains human oversight of AI-supported decisions and processes. Individuals affected by AI-assisted outcomes may raise concerns through established business, compliance, human resources, or data protection channels. Reported concerns are reviewed by appropriate personnel, with human intervention and corrective actions applied where necessary.

When implementing AI solutions, DSV considers operational efficiency and responsible resource utilization. Where relevant, AI initiatives may include monitoring of compute usage, associated costs, and energy consumption as part of the overall governance and lifecycle management process.