Cyber Security Management System for Ships: What the IMO Guidelines and ClassNK’s Second Edition Expect

A cyber security management system for ships sits on two layers. The first is IMO: resolution MSC.428(98) affirms that an approved safety management system should take cyber risk management into account in accordance with the objectives and functional requirements of the ISM Code, and the guidelines behind it, MSC-FAL.1/Circ.3, are now at Revision 4, dated 28 May 2026. The second layer is the audit. On 30 October 2026 ClassNK released the second edition of its guidelines for a cyber security management system (CSMS), which set out the assessment criteria and objective evidence its auditors apply and map them to RISQ, SIRE 2.0, DryBMS and TMSA.

This article sets the two layers side by side, from the IMO texts, ClassNK’s public announcement and the guideline itself. The guideline is available only to registered users of ClassNK’s My Page, so it is described here, not reproduced, and anyone building a CSMS should work from the document.

The IMO Baseline, and What Revision 4 Changed

Resolution MSC.428(98), adopted on 16 June 2017, does two things. It affirms that an approved SMS should take cyber risk management into account in accordance with the objectives and functional requirements of the ISM Code, and it encourages Administrations to ensure that cyber risks are appropriately addressed in safety management systems no later than the first annual verification of the company’s Document of Compliance after 1 January 2021. The resolution does not set out controls. That is left to MSC-FAL.1/Circ.3, whose own wording is that it provides high-level recommendations.

Revision 4 was approved by the Facilitation Committee at its fiftieth session (23 to 27 March 2026) and the Maritime Safety Committee at its 111th session (13 to 22 May 2026). The guidelines present six functional elements: govern, identify, protect, detect, respond and recover. They state that the elements are not sequential, that all should run concurrently and continuously, and that the controls listed under them are the minimum that should be implemented. Under protect, for example, the minimum controls include unique credentials for all users, changed default passwords, segmentation of OT networks from IT networks, controls on unauthorised removable media, annual basic cybersecurity training for all employees, regular backups and incident response plans.

A sentence-by-sentence comparison with Revision 3 (4 April 2025) found a limited revision. The functional elements and their controls are unchanged. Paragraph 3.1 now points to the definition of cyber risk management in paragraph 2.1 instead of repeating it, and the list of additional guidelines in section 4 gains the IAPH Cyber Resilience Guidelines for Emerging Technologies in the Maritime Supply Chain. The annex still lists IACS UR E26 and E27 and ISO/IEC 27001 as additional standards, and still describes the referenced standards as non-exhaustive and outside IMO’s own issue.

What a Cyber Security Management System for Ships Has to Contain Under ClassNK’s Second Edition

ClassNK issued the first edition in April 2019 as a response to MSC.428(98), with requirements aligned to the ISM Code. The second edition, issued as a full revision, is restructured with reference to ISO/IEC 27001 and 27002 and is in two parts. Part 1 sets out twelve chapters of requirements: policy, governance and responsibility, resources and competence, supply chain, cyber risk assessment, configuration management, controls, emergency preparedness, non-conformities, documentation, and internal audit and management review. Part 2 gives, for each requirement, the assessment criteria, the objective evidence required and the external references.

The guideline defines a Cyber Security Management Certificate as a document issued to a ship which signifies that the Company and its shipboard management operate in accordance with the approved CSMS. It does not prescribe a risk assessment methodology or a particular technical product. The cyber risk assessment covers IT and OT systems that may affect the safe operation of the ship, protection of the environment or continuity of operation, including connected shore-side systems, while general corporate IT that neither connects to onboard systems nor affects the ship’s operation is in principle outside it. Where a control from Chapter 8 is not implemented, the remaining risk, the rationale and the acceptance decision are to be recorded.

Chapter 8 lists 23 controls in six domains: access and use control, network and communication security, system configuration and maintenance, media and physical interface control, monitoring, logging and detection, and backup and recovery.

What Part 2 Says an Auditor Will Look For

Part 2 is more specific than the IMO circular. The points below are a selection, in the guideline’s own terms.

• Governance. A cyber security policy formally approved by top management; a Company Cybersecurity Officer who can report directly to top management and raise resource needs with it; a Ship Cybersecurity Officer identified for each vessel; and a statement that the Master’s overriding authority under paragraph 5.2 of the ISM Code extends to decisions arising from cyber security events.
• Twelve-month intervals. Training and awareness, review of the cyber risk assessment, and internal cyber security audits on board and ashore are each to be carried out at intervals not exceeding twelve months.
• An inventory and a network diagram. For each IT and OT system, the equipment type, manufacturer, software version and patch status, covering where fitted cargo management, bridge, propulsion and machinery management, access control, administrative and crew welfare, and communication systems; and a diagram showing network zones, the connections between them and the external connection points.
• Access and media. Generic user profiles and passwords not passed on at crew changes; approval records for third-party and remote access showing who, who authorised it and when; removable media not normally used, with approved exceptions scanned; unused USB and RJ-45 ports physically blocked, including on ECDIS.
• Logging, backup and recovery. Logging of authentication events, administrator privilege use, configuration changes, remote sessions and traffic at network boundaries where technically feasible; backups for systems critical to navigation, propulsion and operations, with restore testing; recovery procedures for each system that name who carries them out.
• Emergency preparedness. Cyber incident procedures available in non-electronic form, covering situations such as loss of navigational equipment, loss of GNSS, loss of GMDSS connectivity, loss of propulsion or steering control, and ransomware or denial of service; a drill programme with a post-drill review.
• Suppliers. The cyber security requirements and level of control expected of suppliers defined, verified, and the verification recorded.

One note in the backup section is specific to bridge equipment. ClassNK points out that duplication required for safety, such as the two ECDIS units carried under statutory requirements, provides redundancy against equipment failure but does not in itself ensure recovery from a cyber incident, for example where both units share the same network or update path. It encourages companies to consider this in the cyber risk assessment.

How Part 2 Lines Up With SIRE 2.0, RISQ, DryBMS and TMSA

These four schemes do not inspect the same thing. SIRE 2.0 and RISQ are ship inspections: an inspector goes on board and looks at the vessel, its records and its crew. SIRE 2.0 applies to tankers and gas carriers, and its cyber question 7.5.1 is listed for oil, chemical, LPG and LNG vessel types, while RISQ is RightShip’s dry bulk inspection questionnaire. DryBMS and TMSA are standards for the company, assessed at the office, not on board a ship. The table sets what each says about the same subject, next to the ClassNK Part 2 clause. The ship-side entries come from the SIRE 2.0 Question Library Part 1 (version 1.0, January 2022) and RISQ 3.2 (November 2025); the company-side entries from Subject Area 28 of the Dry Bulk Management Standard (2021).

RISQ 3.2, effective from November 2025, is the one that connects ClassNK’s certificate to dry bulk vetting. Question 12.7 asks whether cyber security policies and procedures are integrated into the safety management system and whether the cyber security management system has been evaluated and certified. Its guide to inspection records a finding if cyber security management was not incorporated into the SMS by the company’s first annual verification of the DOC after 1 January 2021, and urges managers to have the system evaluated and certified by a cyber security expert firm, with classification societies given as an example. RISQ 3.2 added a definition of that term: a professional entity with proven expertise in certifying management systems under the ISM Code or cyber security frameworks aligned with ISO/IEC 27001. For more on RISQ itself, see RightShip Requirements for Dry Bulk Vessels: What Revision 4.0 Changes.

One caution on TMSA. ClassNK maps every Chapter 8 control to TMSA 3 element 13, stage 4, KPI 13.4.5. In TMSA 3 that KPI says that the company is involved in the testing and implementation of innovative security technology and systems, with physical measures and software enhancements to IT systems as examples. TMSA 3 deals with cyber security at the level of policy and procedures (13.2.3), awareness (13.2.4) and the internal audit programme (13.3.3). The technical controls come from ClassNK’s reading of the KPI, not from the KPI’s wording. The wider structure of TMSA is covered in TMSA Compliance: A Practical Guide to All 13 Elements, and Where DryBMS Fits.

What Is Mandatory, and What Is Not

MSC.428(98) encourages Administrations; MSC-FAL.1/Circ.3/Rev.4 is a set of recommendations; and the ClassNK guideline is a certification scheme offered by one classification society. Neither ClassNK’s announcement nor the IMO texts make that certificate a requirement, and flag State requirements are separate from all three. What the vetting schemes add is a question: RISQ 12.7 asks about certification and SIRE 7.5.1 asks to see the procedures, the register and the records on board. IACS UR E26 and E27 set cyber resilience requirements for ships and onboard systems from the newbuilding stage, as ClassNK’s announcement notes, while the ship’s service-life management is what the CSMS covers.

Software maintenance and remote access on bridge equipment have their own IMO instrument. MSC.1/Circ.1704 sets cybersecurity conditions on remote maintenance, and the SMS-level view is in Ship Safety Management System: A Practical Guide to Keeping the SMS Usable.

Sources

The IMO positions above are taken from the circular and resolution texts. The ClassNK content is from the second edition of its guideline, available to registered users of ClassNK My Page, and its public announcement. The cross-references to other schemes were checked against each scheme’s own text, and the TMSA 13.4.5 point is a comparison of ClassNK’s mapping with the KPI wording.

• IMO Resolution MSC.428(98), Maritime Cyber Risk Management in Safety Management Systems, adopted 16 June 2017
• IMO MSC-FAL.1/Circ.3/Rev.4, Guidelines on Maritime Cyber Risk Management, 28 May 2026
• IMO MSC-FAL.1/Circ.3/Rev.3, 4 April 2025 (compared with Revision 4)
• ClassNK press release, ClassNK releases “Guidelines for Cyber Security Management System for Ships (Second Edition)”, 30 October 2026
• ClassNK, Guidelines for Cyber Security Management System for Ships, Second Edition, October 2026 (Parts 1 and 2; available to registered users of ClassNK My Page)
• RightShip, RightShip Inspection Ship Questionnaire (RISQ) version 3.2, November 2025, questions 12.7 and 12.8 and the revision table
• OCIMF, SIRE 2.0 Question Library Part 1, Version 1.0, January 2022, question 7.5.1 (Cyber Security)
• Dry Bulk Management Standard 2021, Subject Area no. 28, Cyber security
• OCIMF, Tanker Management and Self Assessment 3, element 13 (Maritime Security), KPIs 13.2.3, 13.2.4, 13.3.3 and 13.4.5

More from the Amendment Log