ClassNK Releases Second Edition of Cyber Security Management Guidelines

ClassNK has released the second edition of its "Guidelines for Cyber Security Management System for Ships." Intended for shipowners and ship management companies, the guidelines set out the requirements for a Cyber Security Management System (CSMS), through which a Company addresses the cyber risks associated with ship operations as part of its day-to-day work, from governance and responsibilities ashore and onboard to the technical controls applied to shipboard systems. 

The Guidelines also make ClassNK’s certification audits transparent by showing the assessment criteria applied in them. In audits, ClassNK looks at the governance behind a company’s cyber security: policy and management commitment, defined roles and responsibilities, risk assessment, implementation and operation of controls, and preparedness for incidents.

The second edition has been restructured with reference to ISO/IEC 27001 and ISO/IEC 27002, and the assessment criteria for each CSMS requirement have been clarified. The requirements have also been mapped to the cyber security requirements of major vetting schemes. Cyber security is increasingly covered in the external assessments conducted by maritime stakeholders, and many of those requirements focus on how cyber risk is managed. A CSMS certified against these guidelines gives companies an objective means of demonstrating that governance to external stakeholders, and a single foundation for responding to multiple vetting requirements.

Background

The IMO recommends that cyber risks be managed within the Safety Management Systems under the ISM Code. In response, ClassNK published the first edition of the Guidelines in 2019, setting out CSMS requirements built on the framework of the ISM Code, and has since been providing CSMS certification based on the guidelines.

As a collective effort of the International Association of Classification Societies (IACS), the application of IACS UR E26 and E27 has defined the cyber resilience capabilities that ships and their onboard systems must have from the newbuild phase. At the same time, a vessel’s operating environment keeps changing throughout its service life, as the systems are updated and operations and organizations change. Addressing cyber risks is therefore not a matter of technical measures alone; continuous management is essential to select, implement, maintain and review those measures appropriately. In recent years, cyber risk management covering practices such as access control, software updates, education and training, and incident response have also become a part of the assessment criteria as part of the subject to the schemes established by DryBMS, OCIMF, RightShip and others, each with their own criteria.

The first edition offered the elements for establishing a CSMS as a high-level objective, leaving each Company to interpret how to achieve them within its own organization. Putting those elements into practice requires wide efforts across the whole Company, from shore-based organizations to shipboard operations, and time to achieve. Through its audits since 2019, ClassNK has built up practical knowledge of what effective implementation looks like. Drawing on that experience, the second edition makes clear what is verified in audits and has been designed with other external assessments in mind, so that a CSMS built on the guidelines also prepares a company to meet them.

Main revisions

• Clarification of audit criteria, structured with reference to international standards
  • The guidelines now consist of two parts: Part 1 sets out the CSMS requirements, and Part 2 specifies the audit criteria and the objective evidence required for each requirement. This allows companies to understand in advance what will be verified in audits and prepare accordingly, and makes it easier to identify where there is room for improvement in their own practices.
• Mapping to external assessment criteria set by major industry bodies
  • The assessment criteria in Part 2 have also been mapped against the cyber security requirements or benchmarks of major vetting bodies (covering RISQ, SIRE 2.0, DryBMS and TMSA*3). Rather than interpreting each scheme separately, Companies can use the CSMS as a common framework for meeting them and can expect the reduction of the time and burden needed for compliance.

ClassNK will continue to support cyber security efforts in the maritime industry through the provision of guidelines as well as audits and certification.

How to access guidelines

The guidelines are available to download via "Guidelines" of My Page on ClassNK’s website after registration: ClassNK MyPage Login