IMO Maritime Cyber Risk Management: What Ship Operators Must Do
How IMO expects companies to handle cyber risk inside their safety management systems.
Cyber risk is a safety risk
IMO Resolution MSC.428(98) encourages companies to treat cyber risk like any other risk to the ship, managed inside the safety management system required by the ISM Code. In practice that means assessing how IT and operational technology on board could be disrupted and putting safeguards and procedures in place. Administrations expected cyber risks to be addressed no later than the first annual verification of the company's Document of Compliance after 1 January 2021.
The guidelines to follow
IMO's Guidelines on Maritime Cyber Risk Management, MSC-FAL.1/Circ.3, give the recommendations companies build into their systems. They follow a familiar structure: identify systems and risks, protect them, detect incidents, respond, and recover. Many flag states and classification societies publish their own guidance on top of this, so check what your flag and class expect.
- Identify: an inventory of IT and OT systems on board and ashore.
- Protect: access control, segmentation, updates, training.
- Detect: monitoring and crew awareness.
- Respond and recover: procedures, backups, drills.
Shore and ship together
Many incidents start ashore, in email, booking systems or remote access used by vendors, and then reach vessels. Treat the company's office systems and the fleet as one environment for risk assessment, and include third-party remote access in every review.
- MSC.428(98) puts cyber risk inside the ISM safety management system.
- Cyber risks were expected to be addressed by the first DOC annual verification after 1 January 2021.
- MSC-FAL.1/Circ.3 gives the guideline structure most companies follow.
List the IT and OT systems on one vessel and in your shore office that could affect safe operation. Mark who supports each and how they are accessed remotely.
Check your understanding
1. Where does IMO expect cyber risk to be managed?
2. By when were cyber risks to be addressed?
3. Which document holds IMO's cyber risk management guidelines?
From USD 49 or INR 2,999 a month. A person approves every step.