Regulatory Frameworks and Industry Guidelines

International Maritime Organization (IMO) Guidelines

The International Maritime Organization (IMO) puts great emphasis on the importance of cyber risk management in safeguarding maritime operations against emerging cyber threats. The IMO encourages shipping companies to integrate cyber risk management into their safety and security protocols to protect against vulnerabilities in bridge systems, cargo handling, propulsion controls, access management, and communication networks.

According to the IMO, there are five key functional elements of cyber risk management:

1. Identify - Define critical systems, assets, and personnel roles.
2. Protect - Implement security controls and contingency plans.
3. Detect - Develop methods to identify cyber threats in real time.
4. Respond - Establish resilience measures and system restoration plans.
5. Recover - Ensure backup and recovery strategies for critical operations.

The International Maritime Organization (IMO) has recognized the escalating cyber threats in the maritime sector and has taken proactive measures to enhance cyber risk management. In June 2017, the IMO adopted Resolution MSC.428(98), which mandates that cyber risks be addressed in Safety Management Systems (SMS) by the first annual verification of the company's Document of Compliance after January 1, 2021.

To assist organizations in implementing these requirements, the IMO issued the "Guidelines on Maritime Cyber Risk Management" (MSC-FAL.1/Circ.3), offering high-level recommendations for integrating cyber risk management into existing safety and security protocols.

The IMO also emphasizes that cyber risk management is an ongoing process, requiring regular assessments, continuous employee training, and adherence to international cybersecurity frameworks to adapt to the evolving threat landscape.

International Safety Management (ISM) Code and Cyber Risk Integration

The International Safety Management (ISM) Code is a framework established by the International Maritime Organization (IMO) to ensure the safe management and operation of ships and pollution prevention. The ISM mandates that shipowners integrate cyber risk management into their Safety Management Systems (SMS), treating digital threats like physical hazards. Compliance requires risk assessments, emergency preparedness, and systematic cybersecurity implementation. Non-compliance can lead to fines, detention, or increased cyberattack vulnerability.

To support this integration, the IMO released guidelines on maritime cyber risk management, offering high-level recommendations that can be incorporated into existing risk management processes. These guidelines are complementary to the safety and security management practices already established by the IMO. In this way, the ISM Code serves as a foundation for risk management in the maritime industry, emphasizing cyber risk management as an integral part of every ship's Safety Management System.

Integrating cyber risk management into the International Safety Management (ISM) Code presents both challenges and opportunities for the maritime industry. One significant challenge is the industry's varying levels of cybersecurity maturity, with some organizations lacking robust infrastructures and incident response plans. This disparity can hinder effective implementation of cyber risk measures.

To address these challenges, organizations can adopt best practices such as:

• Comprehensive Training Programs: Educating all personnel, regardless of rank, on cyber hygiene and the importance of distinguishing between operational and recreational network use.
• Collaborative Knowledge Sharing: Pooling insights into cyber threats and vulnerabilities across the industry to enhance collective defense mechanisms.
• Adherence to Established Frameworks: Implementing recognized cybersecurity frameworks, such as the NIST Cybersecurity Framework, to systematically identify, protect, detect, respond to, and recover from cyber threats.

EU NIS Directive

The Network and Information Systems (NIS) Directive, established in 2016, was the European Union's first comprehensive cybersecurity legislation, aiming to achieve a high common level of cybersecurity across Member States. Recognizing the evolving cyber threat landscape, the EU introduced the NIS2 Directive (Directive (EU) 2022/2555) in December 2022, which entered into force in January 2023.

NIS2 broadens its reach to include a wider array of maritime entities, such as inland, sea, and coastal passenger and freight water transport companies (excluding individual vessels), managing bodies of ports and their facilities, and operators of vessel traffic services (VTS). These entities are now classified as essential services, reflecting their critical role in the EU's infrastructure.

The NIS2 Directive introduces cybersecurity risk management measures and reporting obligations for critical sectors, including water transport. The directive applies to shipping companies, port authorities, and vessel traffic services (VTS), requiring them to adopt technical, operational, and organizational measures to mitigate cyber risks. Some of the key requirements include:

• Cyber risk governance - Management bodies must approve and oversee cybersecurity strategies.
• Training obligations - Essential entities must provide regular cybersecurity training for employees.
• Incident response - Organizations must establish protocols for cyber incidents, including backup management and crisis handling.
• Supply chain security - Companies must assess the cybersecurity risks of suppliers and service providers.

NIS2 also emphasizes the accountability of management bodies, requiring them to oversee and approve cybersecurity measures, with potential liability for non-compliance. Leadership is required to:

• Approve Cybersecurity Strategies: Ensuring alignment with organizational objectives.
• Oversee Implementation: Monitoring the effective deployment of cybersecurity measures.
• Undergo Training: Participating in regular cybersecurity education to stay abreast of evolving threats.

Failure to comply with these obligations can result in substantial penalties, including fines up to €10 million or 2% of the total turnover, underscoring the importance of robust cybersecurity governance.

NIS2 aligns with broader EU strategies, such as the updated European Union Maritime Security Strategy (EUMSS) of 2023, which addresses evolving threats like hybrid and cyber-attacks targeting maritime infrastructure. This alignment ensures a cohesive approach to securing the maritime domain.

The Baltic International Maritime Council (BIMCO)

The Baltic International Maritime Council (BIMCO) is the world's largest direct-membership shipping association, established in 1905. It represents over 2,000 companies from more than 130 countries, covering approximately 62% of the world's tonnage. The guidelines provided by BIMCO emphasize the importance of cyber risk management to ensure the safety of seafarers, ships, cargo, and the environment. They outline strategies for identifying threats, vulnerabilities, and implementing protective measures to mitigate cyber risks.

In November 2024, BIMCO released Version 5 of the "Guidelines on Cyber Security Onboard Ships." This update incorporates new insights into cyber threat actors and their methodologies, emphasizing the necessity for regular updates to cybersecurity risk assessments in response to evolving networks, systems, and processes. The guidelines advocate for a risk-based approach, integrating cyber risk management into existing Safety Management Systems (SMS) in alignment with the International Maritime Organization's (IMO) requirements.

The guidelines stress that cyber risk management should be integrated into the Safety Management System (SMS), in line with IMO resolutions, ensuring that digital threats are treated as critical as physical safety risks. Senior management involvement is crucial in fostering a cybersecurity culture, ensuring risk assessments, training, and security frameworks are properly implemented. To combat potential cyber risks, the guidelines recommend risk assessments, system protection measures, incident response planning, and continuous monitoring. The approach follows five key phases: Identify, Protect, Detect, Respond, and Recover.

BIMCO also actively participates in policy development to enhance maritime cybersecurity. The organization collaborates with international bodies to align cybersecurity efforts with global standards, ensuring that new ships are built with secure systems and components in accordance with relevant unified requirements. BIMCO also emphasizes the importance of training and awareness, advocating for pragmatic solutions that account for the rapidly changing cyber threat landscape.

The International Association of Classification Societies (IACS)

The International Association of Classification Societies (IACS) is a non-governmental organization that sets technical standards and regulations for the design, construction, and maintenance of ships and offshore structures. The IACS implemented Unified Requirements (UR) E26 and E27 to enhance the cyber resilience of ships. Effective from July 1, 2024, these requirements aim to ensure the secure integration of both Operational Technology (OT) and Information Technology (IT) systems throughout a vessel's lifecycle, from design and construction to operation. UR E26 focuses on the overall cyber resilience of ships, while UR E27 addresses the cyber resilience of onboard systems and equipment. These measures are designed to protect vessels from cyber incidents that could impact safety, property, and the environment, aligning with the International Maritime Organization's resolutions.

The implementation of IACS UR E26 and E27 highlights the increasing recognition of cyber threats as a critical factor in maritime risk management, influencing insurance policies, regulatory compliance, and even vessel marketability. Shipowners who fail to meet these cyber resilience standards may face higher insurance premiums, operational restrictions, or reduced charter opportunities. Additionally, the integration of cybersecurity in ship design creates new demands on shipbuilders and technology providers, driving innovation in secure-by-design maritime systems. As cyber threats evolve, these regulations could pave the way for continuous auditing mechanisms, ensuring long-term compliance rather than a one-time certification.