Download PDF

1. Maritime Cyber Risk refers to the extent to which Computer Based Systems (CBS) are exposed to a potential circumstance or event that may result in shipping-related operational, safety or security failures due to information or systems being corrupted, lost or compromised.

2. Cyber Risk Management is the process of identifying, analysing, assessing and communicating cyber-related risks and taking appropriate measures to manage such risks to an acceptable level, considering the costs and benefits of the actions taken by relevant stakeholders.

3. The overall objective of maritime cyber risk management is to support safe and secure shipping that is operationally resilient to cyber risks.

4. In this regard, the IMO has issued MSC-FAL.1/Circ.3/Rev.4 – Guidelines on Maritime Cyber Risk Management, which provides high-level recommendations for managing cyber risks in the maritime sector.

5. The Guidelines are intended to assist stakeholders in safeguarding shipping against current and emerging cyber threats and vulnerabilities. They include functional elements that support an effective cyber risk management process.

6. The recommendations may be incorporated into existing risk management processes and are intended to complement the safety and security management practices already established by IMO.

7. Cybersecurity Training and Awareness

The Guidelines emphasize the importance of appropriate training and awareness to ensure that personnel are able to recognize and appropriately respond to cyber risks. This includes:

• Basic cybersecurity training on an annual basis for relevant personnel;
• Operational Technology (OT)-specific training for personnel who use or manage OT systems, as applicable;
• Cybersecurity familiarization for personnel joining the ship; and
• Periodic testing and exercises to assess preparedness and response to cyber-related incidents.

Shipowners/ operators and Masters are advised to ensure that appropriate cybersecurity awareness, training, familiarization and exercises are incorporated into the shipboard cyber risk management arrangements, as applicable.

8. Cyber risk management should form part of the ship's existing risk management framework and should be implemented in a manner appropriate to the ship's operations, systems and level of cyber risk.

9. Ship Owners/ operators and Masters are encouraged to identify and assess cyber risks, establish appropriate safeguards, monitor the effectiveness of controls, and maintain preparedness to respond to and recover from cyber incidents. The measures adopted should support the safe, secure and resilient operation of ships while complementing existing safety and security management practices.

10. The IMO Guidelines may be referred to for further guidance on the identification, assessment and management of maritime cyber risks.

Enclosure:

• IMO MSC-FAL.1/Circ.3/Rev.4- Guidelines on Maritime Cyber Risk Management

This Technical Circular and the material contained in it is provided only for the purpose of supplying current information to the reader and not as an advice to be relied upon by any person. While we have taken utmost care to be as factual as possible, readers/ users are advised to verify the exact text and content of the Regulation from the original source/ issuing Authority.

 Download PDF