A transportation management system can become unavailable while a driver is approaching pickup, a customer is waiting for an ETA, and billing is looking for a delivery document. The useful question is not whether a vendor says it has backups. It is whether your brokerage can keep the right loads moving, control temporary records, and reconcile every change after service returns.
This guide is an original operating drill, not a security standard, service-level agreement, legal opinion, or promise that any system will recover. Run it as a controlled tabletop or test with synthetic or properly authorized data. Never manufacture an outage in production.
Define the event before choosing the response
Use three separate labels:
- Degraded: the system works, but a required page, document, integration, or device path does not.
- Unavailable: authorized users cannot complete the minimum live-load workflow.
- Suspected security incident: unusual access, altered records, payment-change messages, or other evidence means normal fallback channels may not be trustworthy.
Do not call every slow page a disaster, and do not treat suspicious activity as ordinary downtime. Name an incident lead, record the first observed time and timezone, identify affected users and functions, and use the vendor’s verified support or status route. If compromise is suspected, follow the brokerage’s incident-response plan and approved security contacts instead of improvising in a group text.
Run the 30-minute continuity drill
The clock tests handoffs, not the vendor’s recovery speed. Stop the exercise if it could affect live freight, data, security, or payments.
Minutes 0–5: declare, scope, and open one control log
Record who declared the drill, what is unavailable, which locations or users are affected, the last known good time, and the next review time. Open one temporary control log in a preapproved location independent of the TMS. Give it one owner and one backup.
Write down every temporary action with a timestamp, timezone, responsible person, source, and confidence level. A private notebook or scattered chat is not a shared operating record. Do not paste credentials, sensitive identity documents, bank information, or unnecessary personal data into the fallback log.
Pass evidence: the team can find the same incident header and control log without asking the incident lead where it is.
Minutes 5–10: build the active-load priority board
Do not try to reconstruct the whole database. Start with freight that can change in the next two hours:
- pickups not yet confirmed;
- in-transit loads with an exception or missed update;
- deliveries approaching an appointment;
- delivered loads missing documents or a billing decision; and
- scheduled loads that can safely wait.
For each priority load, capture only the minimum continuity card: brokerage load reference, customer reference, carrier and driver contact path, equipment, origin and destination, appointment times with timezone, current status and source, next action, owner, backup owner, and the location of the governing rate and document evidence.
If an essential value is unknown, write unknown. Do not turn a remembered rate, phone number, or appointment into a fact.
Pass evidence: a backup dispatcher can identify the next action and approved contact path for each priority load.
Minutes 10–20: communicate and control changes
Use independently approved contact information. Confirm who is speaking for operations, who contacts carriers, who updates customers, and who handles vendor support. Give customers verified facts: what load is affected, the last confirmed status, the action underway, and when the next update will arrive. Do not guess at restoration time.
Route rate, carrier, location, appointment, document, and payment changes through the brokerage’s existing approval rules. An outage does not lower the standard for changing a carrier or payment destination. Treat unexpected bank or remittance changes as a separate verification event.
Assign each temporary change a simple identifier such as `OUT-001`. Keep the original source, approver, effective time, and people notified. Save documents in the approved fallback location without overwriting earlier versions.
Pass evidence: every temporary change has one owner, one source, one approval result, and one identifier that can be reconciled later.
Minutes 20–30: complete two role handoffs
Have a dispatcher hand one active-load card to a backup dispatcher. The recipient should explain the current status, next deadline, contacts, open issue, and evidence without a private verbal backstory.
Then hand one delivered-load card to billing. The reviewer should identify what is present, what is missing, and whether the load is ready, held, or returned to operations. “Delivered” is not automatically “ready to invoice.”
Finish by announcing the next review time and recording who remains accountable for every open item.
Pass evidence: both recipients can act from the shared record, and unresolved facts remain visibly unresolved.
Reconcile after service returns
Recovery is not complete at the login screen. Freeze the temporary log, preserve a read-only copy, and reconcile in three passes.
Pass 1: identity and operations
Match every temporary card to the correct load, customer, carrier, stops, status, owner, and timestamps. Resolve duplicates and keep a reference from the restored record to the outage identifier.
Pass 2: documents and money
Compare rate evidence, accessorial approvals, carrier changes, delivery documents, customer charges, carrier costs, invoice state, and payable state. Escalate mismatches; do not average them away or silently replace an earlier value.
Pass 3: communications and closure
Confirm that customers, carriers, dispatch, and billing received the final state. Close each temporary item as entered, attached, rejected, duplicated, or still open. Record the reviewer and closure time. Afterward, hold a short review: what could not be accessed, which contact route failed, which field was ambiguous, and what must change before the next drill?
Questions to ask a TMS vendor before you rely on it
Ask for dated, written answers and distinguish a platform backup from a brokerage continuity plan:
- What customer, carrier, load, stop, contact, rate, status, document, invoice, and payable data can authorized users retrieve or export?
- Are offline exports or run sheets available, and how current can they be?
- Where are service status, planned maintenance, incident updates, and support routes documented?
- What backup frequency, retention, recovery-point objective, recovery-time objective, and restoration testing are actually committed or disclosed?
- After restoration, what history shows who changed each record and when?
- What happens to integrations, queued messages, generated documents, and duplicate submissions?
- Which continuity steps remain the brokerage’s responsibility?
LoadStop’s July 2026 cloud-TMS guide is commercial vendor content, but its recommendation to ask about backup frequency, retention, restore time, and a documented recovery plan is a useful buying prompt. It is not evidence about ServeOps or any other vendor.
Public facts and the ServeOps boundary
CISA advises businesses to inventory critical data, keep backups separate, test full and partial recovery, document procedures, train the team, and know how to access critical files without an internet connection. NIST SP 800-34 Rev. 1 provides federal information-system contingency-planning guidance. Those sources do not evaluate freight broker software or certify this drill.
Current 49 CFR 371.3 requires a broker to keep a record of each transaction, lists information the record must show, sets a three-year retention period, and gives each party a right to review the required transaction record. It does not require a particular TMS, outage board, backup design, or recovery target. Have qualified counsel determine how the rule applies to your records and continuity process.
This guide does not claim that ServeOps provides backups, offline access, exports, status notices, support coverage, recovery targets, restore testing, audit history, incident response, security controls, duplicate prevention, reconciliation, or any other continuity function. Those are evaluation questions until current product, operations, security, and legal evidence supports an answer.
If your brokerage wants to evaluate its normal workflow and continuity requirements, the verified offer language is unchanged: 60-day free trial; card collected upfront; no charge for 60 days; cancel anytime; then $49 per seat/month or $490 per seat/year. Card is required upfront. There is no charge during the trial. Start the ServeOps trial and use only synthetic or properly authorized data for the controlled drill.
Sources
- Cybersecurity and Infrastructure Security Agency, Back Up Business Data, backup inventory, separation, recovery testing, offline access, written procedures, and training guidance; accessed August 21, 2026.
- National Institute of Standards and Technology, SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, published May 2010 and updated November 11, 2010; accessed August 21, 2026.
- Electronic Code of Federal Regulations, 49 CFR 371.3—Records to be kept by brokers, current transaction-record requirements; accessed August 21, 2026.
- LoadStop, Data Security in Cloud-Based TMS Platforms: What Carriers and Brokers Should Know, July 2026 commercial vendor guidance used only for pre-purchase recovery questions; accessed August 21, 2026.