ClassNK has released the second version of the "Cybersecurity Management System Guidelines for Ships." These guidelines are designed for ship owners and management companies and define the requirements of a cybersecurity management system (CSMS) through which a company addresses the cybersecurity risks associated with ship operations.
New Structure and Requirements
The second version has been revamped with references to international standards ISO/IEC 27001 and ISO/IEC 27002, and the assessment criteria for each CSMS requirement are clearly explained. These requirements are also linked to the cybersecurity needs of major inspection schemes. Cybersecurity is increasingly covered in external assessments conducted by maritime stakeholders, and many of these requirements focus on how to manage cybersecurity risks. A CSMS certified based on these guidelines allows companies to demonstrate to external stakeholders how they manage cybersecurity risks.
Response to Changes and New Requirements
The International Maritime Organization (IMO) recommends that cybersecurity risks should be managed within safety management systems based on the ISM Code. To this end, ClassNK published the first version of the guidelines in 2019, which set the CSMS requirements based on the ISM Code framework, and has since been providing CSMS certification based on these guidelines.
As a collective effort from the International Association of Classification Societies (IACS), the application of UR E26 and E27 defines the cybersecurity resilience capabilities that ships and their onboard systems must have from the new construction stage. At the same time, the operational environment of a ship continuously changes throughout its service life as systems are updated and operations and organizations evolve. Therefore, addressing cybersecurity risks is not just a technical issue, and ongoing management is essential for the selection, implementation, maintenance, and review of these measures.
ClassNK will continue to provide guidelines as well as inspections and certifications to support cybersecurity efforts in the maritime industry and aims to assist companies in optimally managing cybersecurity risks through these initiatives.
