IMO MSC.428 Maritime Cyber Risk Management: ISM Code Implementation Guide

IMO Resolution MSC.428(98), adopted in June 2017 and mandatory since January 1, 2021, requires that cyber risks be appropriately addressed in Safety Management Systems (SMS) established under the International Safety Management (ISM) Code. The ISM Code is mandatory for vessels over 500 gross tons operating internationally under SOLAS.

MSC-Circ.1526 provides implementation guidance, specifying that cyber risk management should cover five functional elements: identify, protect, detect, respond, and recover. These map directly to the BIMCO cybersecurity guidelines and the NIST Cybersecurity Framework.

Compliance is verified during Document of Compliance (DOC) audits of the company and Safety Management Certificate (SMC) audits of the vessel, both conducted by flag state administrations or recognized organizations (classification societies). Port state control officers can detain vessels with demonstrably inadequate SMS cyber provisions, though detention specifically for cyber gaps remains rare as of 2025.

Key documentation requirements include: a written cyber risk assessment covering both OT and IT systems, documented procedures for protecting identified vulnerabilities, detection procedures and monitoring practices, incident response procedures including notification to flag state, and recovery procedures with backup and restoration processes.

P&I clubs increasingly require evidence of ISM-compliant cyber risk management as a condition of hull and machinery coverage. Skuld, Gard, and West of England have all published guidance tying cyber coverage conditions to ISM SMS compliance.

BIMCO's cybersecurity guidelines, now in their third edition, provide the most widely accepted practical framework for maritime cyber risk management. They organize vessel systems into three categories: IT systems (crew internet, administrative networks, email), OT systems (propulsion, steering, ballast, cargo control, safety systems), and navigation systems (ECDIS, AIS, GNSS, radar, GMDSS).

The identify phase requires inventory of all networked systems and their connectivity. Many vessels have dozens of OT components with network interfaces installed by equipment manufacturers for remote diagnostics, often without the ship operator's awareness. Conduct a full network discovery scan during dry dock or when the vessel is in port with time for extended assessment.

The protect phase prioritizes network segmentation between IT and OT zones, default credential changes on all networked equipment, removal of unnecessary remote access capabilities, and patch management procedures for systems where patches are available from vendors.

The detect phase requires network monitoring capability on the IT zone (OT monitoring is often impractical given legacy system constraints) and log collection from navigation system computers and satcom gateways.

The respond phase mandates documented incident response procedures including: isolation procedures for affected systems, notification contacts for flag state, company security officer, and P&I club, and preservation procedures for forensic evidence.

The recover phase requires backup and restoration procedures for ECDIS chart data, navigation system configurations, and administrative systems.

Electronic Chart Display and Information Systems (ECDIS) represent the most critical navigation system from a safety perspective and one of the most frequently targeted in maritime cyber incidents. ECDIS failures can directly impact vessel navigation safety.

ECDIS security measures start with operating system hardening. Many ECDIS units run Windows XP or Windows 7 on embedded platforms that cannot be patched due to vendor restrictions. For these systems, compensating controls are required: network isolation from the internet and crew IT networks, disabled USB ports except for chart update procedures, and application allow-listing where the ECDIS vendor supports it.

Chart update procedures represent a primary infection vector. Charts are updated via USB drives or internet connections. Establish a dedicated chart update workstation that is isolated from crew internet access, scanned for malware before each use, and used exclusively for chart update operations. Never update ECDIS via the same network used for crew email or internet access.

AIS (Automatic Identification System) is vulnerable to spoofing attacks that inject false position data. While AIS spoofing detection is primarily a flag state and VTS responsibility, vessels should configure ECDIS to alert on AIS data inconsistencies and cross-reference with radar tracks for critical navigation decisions.

GNSS (GPS) receivers are vulnerable to jamming and spoofing in high-risk regions including the Persian Gulf, Eastern Mediterranean, and areas near conflict zones. Maintain traditional navigation competency and ensure officers can conduct celestial navigation if GNSS is unavailable or unreliable.

Engine room automation networks connect propulsion, steering, ballast, bilge, cargo control, and safety systems. These networks have traditionally been isolated from IT networks but increasingly interface with shore-based monitoring platforms through vendor remote access connections.

Network segmentation architecture should place engine room OT systems in a dedicated network segment with no direct connectivity to IT networks, satcom gateways, or crew internet. Any data transfer between OT and IT zones should traverse a data diode or unidirectional gateway that prevents traffic from flowing from IT back to OT.

Vendor remote access connections for maintenance and diagnostics are the primary OT network exposure. Require all vendor remote access to use jump server architecture: a dedicated jump host in a DMZ that the vendor connects to, with separate controlled connections from the jump host to the OT network. Disable vendor remote access connections when not actively in use. Maintain a log of all vendor remote access sessions.

Inventory all OT network components. Focus particularly on components installed by equipment manufacturers for telemetry and diagnostics, often without explicit operator authorization. Common examples include engine monitoring systems (MAN B&W COMOS, Wartsila NACOS) with built-in network interfaces, and cargo management systems with satellite connectivity for cargo tracking.

For systems that cannot be segmented due to integrated architecture, implement enhanced monitoring and restrict vendor remote access to documented maintenance windows with two-person authorization from the vessel's crew.

Satellite communications (VSAT, Fleet Broadband, Iridium Certus) are the primary internet connectivity path for vessels at sea and the most common initial access vector for maritime cyber attacks. Satcom gateways bridge the vessel IT network to the internet and are frequently exposed with default credentials and minimal security configuration.

Satcom gateway hardening starts with changing all default credentials on the gateway hardware and management interface. Disable Telnet and use SSH only for administrative access. Enable firmware auto-update or implement a manual update schedule at least quarterly. Many maritime satcom providers offer managed security services that include gateway configuration auditing.

Network segmentation at the satcom boundary is critical. The satcom gateway should connect only to a DMZ network segment, not directly to the vessel's main IT network or any OT network. The DMZ provides internet access for specific services (crew email, chart downloads, weather data) through explicit allow rules. All other traffic from the internet to vessel networks should be blocked by default.

Crew internet access should be provided through a separate Wi-Fi network that is completely isolated from operational systems. Many vessels now use dedicated crew internet terminals (tablets or kiosk computers) that connect only to the crew Wi-Fi segment, preventing infected personal devices from reaching operational networks.

Satcom provider selection affects security posture. Evaluate providers on their ability to supply connection logs for incident investigation, their support for traffic monitoring and anomaly detection, and their documented incident response procedures for maritime cyber events.

Maritime cyber incident response plans must satisfy two distinct audiences: flag state and port state control auditors verifying ISM compliance, and P&I club underwriters assessing coverage eligibility. These audiences have different documentation requirements.

For ISM compliance, the incident response plan must be integrated into the SMS and cover: roles and responsibilities including the Designated Person Ashore (DPA) and Company Security Officer (CSO), notification procedures for flag state administration and class society, isolation procedures for affected systems that do not compromise vessel safety, and documentation requirements for incident records.

For P&I club purposes, document your cyber risk management maturity level, the testing frequency for your incident response procedures, and your cyber insurance coverage limits and terms. Skuld and Gard require vessels to demonstrate that their SMS cyber provisions have been audited against ISM requirements.

Conduct tabletop exercises at least annually. Maritime-specific scenarios that stress test realistic incident types include: ECDIS chart corruption discovered mid-passage, engine room automation network intrusion detected during a port approach, satcom gateway compromise identified through unusual traffic, and ransomware affecting administrative systems during cargo operations.

Maintain incident records as required by ISM Code Clause 9. Records should document: the date and nature of the cyber event, affected systems, response actions taken, parties notified, and lessons learned. These records are subject to review during DOC and SMC audits.

Engage a maritime cybersecurity specialist at least every three years for third-party SMS cyber review. Lloyd's Register, DNV, Bureau Veritas, and BIMCO-affiliated consultancies provide ISM-focused maritime cyber assessments.