Issuing agency: Bureau Veritas Marine & Offshore
Column: Business Insights
source: https://marine-offshore.bureauveritas.com/insight/business-insights/ship-owners-guide-achieving-cyber-security
The maritime world is increasingly connected, with the majority of newbuilds and in-service vessels being fitted with digital systems. While this represents a technological leap forward, and has numerous benefits for data collection and ship monitoring, it also dramatically increases surface of attack for cybersecurity criminals. Ship owners have already been the targets of cyber-attacks that have cost them time, money and credibility. In response to these changes, the maritime industry moved to develop a comprehensive solution for improving cyber security and safety for all vessels. In June 2017, the International Maritime Organization (IMO) adopted Resolution MSC.428(98) for Maritime Cyber Risk Management in Safety Management Systems. This resolution aims to protect vessels from cyber-attacks by requiring ships to account for cyber risk management in their safety management system, in compliance with the ISM code. On January 1, 2021, IMO Resolution MSC.428(98) officially came into force. Owners must now implement an effective and robust cybersecurity risk management onboard their vessels. This must be reflected in their Safety Management Systems to be audited by Flag administrations and Port State Controls.
Ship owners and technicians can undertake several actions to assess and mitigate cybersecurity risks, methodically developing, applying and maintaining IMO-compliant cybersecurity risk management. These include:
A variety of resources are available to help ship owners undergo these steps. The IMO has published general guidelines that help ships owners identify and detect risks, protect their assets and respond to attacks. Several maritime coalitions and classification societies have also developed more in-depth guidance, offering ship owners step-by-step methods for developing the necessary procedures and documentation. This enables owners to address cybersecurity in compliance the International Safety Management (ISM) Code, the International Ship and Port Facility Security (ISPS) Code and Flags requirements.
Flag authorities worldwide are now scrutinizing vessels for compliance with cyber regulations. While the approach may vary from country to country, certain requirements feature on every nation’s list. This includes the creation of a policy (or management plan) detailing the basic measures used to achieve the ship owner’s cybersecurity objectives. Owners must be able to demonstrate a clear cybersecurity organization. Owners should also have monitoring and reporting procedures in place to chart both incidents and any corrective and preventive actions implemented. Most flags specify the need for a clear division of responsibilities among onboard and onshore personnel. Among flag administrations taking a particularly rigorous approach to cyber security enforcement are the US Coast Guard and the French Direction Générale des affaires maritimes, de la pêche et de l’aquaculture (DGAMPA) administration.
In 2024, two IACS Unified Requirements (UR) will become mandatory:
For all contracts signed after 1 January 2024, shipyards and equipment suppliers will have to meet UR E26 and UR E27 requirements for a newbuild to be accepted by a class society. They will also have to provide documentation attesting to the vessel’s compliance, which ship owners will have to update during a vessel’s whole lifecycle.
An assortment of maritime stakeholders supports ship owners in their efforts to protect their vessels, each working to develop a complete ecosystem for cyber safety:
The entire marine value chain is working together and in tandem with ship owners to present a united front and ensure the cyber security of both in-service vessels and new builds.
At Bureau Veritas, we draw on our comprehensive knowledge of the cyber security ecosystem to help ship owners address cyber threats and comply with Flag authorities and IMO regulations. Our goal is to enable ship owners to protect their assets, define and certify digital designs for shipyards and equipment manufacturers. To this end, Bureau Veritas has developed three notations for cyber security that cover a wide range of organizational and technical measures.
To boost our cyber expertise even further, in January 2021, Bureau Veritas acquired Secura, an independent service company providing security testing, audits, training and certification services. By integrating Secura’s knowledge of cyber security for networks, systems, applications and data with Bureau Veritas classification expertise, we can offer clients value-added cyber services such as penetrations tests worldwide.