Vessel systems are becoming increasingly complex and are integrated with other systems both on board and onshore. This requires an extended risk and safety assessment involving cyber security, with the aim to continuously ensure the safety of the crew, passengers and assets.
There are various reasons why owners and ship managers need cyber security, including:
New technology, more automation and digitalization, which are being introduced to enable our industry to be more efficient
The ISM Code, underscored by IMO Resolution MSC.428(98) (see also IMO Guidelines on Maritime Cyber Risk Management.)
IACS unified requirements for Cyber security mandatory for new vessels contracted for construction after 1st of January 2024, E26 and E27
Rating schemes, such as TMSA 3 and OVMSA 2, and RightShip’s vetting and IADC requirements, which may impact your chances of getting a charter
Standard insurance contracts, which exclude coverage of cyber incidents (CL.380); more and more insurance companies are offering to buy back this exclusion if proper cyber security can be proven
Banks, which may want to see proof of proper cyber security in order to grant loans for buying/building vessels
Ensuring continuous operation of vessels during and after an unintentional cyber incident or a malicious targeted/untargeted cyber-attack
Building cyber security resilience includes assessing the status quo, defining your cyber security objectives, developing measures to reach them and striving for continuous improvement.
DNV recommends assessing all three dimensions relevant to achieve cyber security resilience on board vessels and in offices: people, processes and technology.
Typical actions to build cyber security resilience in the improvement phase include:
Perform general/specialized training and incident response drills for crew and onshore staff
Implement a cyber security management system for your fleet
Implement technical barriers such as network segregation, USB control, virus scanning, secure local/remote access, and backup and recovery
Document vessel topology and SW/HW inventory
Cyber secure class notation
DNV’s Cyber secure class notation provides a framework for third-party verification of a vessel’s cyber resilience across people, process and technology barriers. It covers the IMO requirements as well as IACS unified requirements, and uses recognised IEC standards for easy industry uptake. The different levels are defined to ensure a suitable level of security controls and effort for you as an owner or manager, regardless of the segment or the vessel’s complexity:
