Cyber security management plan

Contents of the Plan

1. Introduction & training
2. Threats / risks
3. Managing the risk
4. General Data Protection
5. Cyber security policy & General Data Protection policy
6. Office contingency plan
7. Vessel contingency plan
8. Cyber security incident investigation
9. Forms (including Data Protection impact Assessment & Privacy Note)
10. Risk assessment library (with already prepared assessments)

The ISM Code, supported by the IMO Resolution MSC.428(98), requires ship owners and managers to assess cyber risk and implement relevant measures across all functions of their safety management system, until the first Document of Compliance after 1 January 2021.

In combination with the resolution, the IMO also released Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3) in July 2017. As both leave much of the interpretation to the company responsible for the safety management system, there are still many uncertainties of how to handle the requirements.

Below follow some concrete suggestions on how to ensure compliance with the IMO requirements and recommendations.

Recommended steps to ensure IMO`s Cyber Security compliance

The IMO agreed that cyber risk management should be integrated into existing management systems under the ISM Code and ISPS Code.

Accordingly, the following PDCA process should be applied:

Plan

The first step is to identify cyber security objectives relevant for the safe operation of the vessel. In addition to the IMO requirements, other internal and external stakeholder requirements on cyber security should be accounted for when determining the objectives.

Pursuant to the defined objectives, an inventory list of all safety and business-critical systems and software should be generated. The inventory, as well as network drawings showing the system connectivity, are prerequisites for executing a cyber risk assessment. The assessment should include:

1. Consequence analysis in terms of loss of confidentiality, integrity and availability of each system
2. Likelihood analysis to determine how often the specific system is expected to be compromised
3. Ranking of the asset according to its cyber security risks
4. Determination of required barriers in terms of people, processes and technology improvements (for suggestions of barriers, see DNV’s Cyber secure class notation)

Do

The cyber risk assessment results should be utilized to define an implementation plan for rolling out suitable barriers.

Furthermore, as a minimum, the following functional requirements for the Safety Management System are applicable:

1. A cyber security policy
2. Instructions and procedures to ensure cyber-secure operation
3. Defined levels of authority and lines of communication between, and amongst, shore and shipboard personnel concerning cyber security
4. Procedures for reporting cyber-attacks, incidents and non-conformities
5. Procedures to prepare for and respond to cyber-attacks and incidents
6. Procedures for internal cyber security audits and management reviews

Check

The effectiveness of the cyber security measures must be checked on a continuous basis.

Internal checks include:

1. Evaluation of effectiveness of achieving cyber security objectives
2. Analysis of cyber incident and event reports
3. Evaluation of logs and intrusion detection systems
4. Execution of internal audits of cyber security
5. Execution of cyber security incident response drills

Furthermore, external checks are recommended in order to ensure

1. increased cyber security resilience,
2. improved customer and business partner confidence, and
3. compliance with IMO requirements.

Act

Based on the findings of the internal and external review reports, corrective and preventive actions should be implemented.

As the vessels and systems are increasingly interconnected and malicious cyber threats are continually changing, key to future successful cyber security resilience is to continuously improve by updating the cyber risk assessment, policies and procedures.