ClassNK Releases Second Edition of Ship Cyber Security Guidelines
ClassNK, the Japanese classification society, has released the second edition of its Guidelines for Cyber Security Management System for Ships (CSMS). The guidelines are written for shipowners and ship management companies and replace the first edition published in 2019.
The guidelines explain what a company needs in place to manage cyber risks, covering governance, the roles of shore staff and shipboard personnel, and technical controls on systems on board. The new edition has been restructured with reference to the international information security standards ISO/IEC 27001 and ISO/IEC 27002, and the criteria for checking each requirement have been made clearer.
The document is in two parts. Part 1 sets out the CSMS requirements. Part 2 lists the audit criteria and the objective evidence needed to show that each requirement is being met. According to ClassNK, the new edition “makes clear what is verified in audits.”
The assessment criteria have also been mapped to the cyber requirements in widely used industry schemes, including RISQ, OCIMF’s SIRE 2.0 and TMSA, and DryBMS. This should help companies avoid duplicating work when they face class audits, vetting inspections and charterer checks.
The guidelines build on the ISM Code approach to cyber risk management, while the IACS Unified Requirements E26 and E27 cover cyber resilience for ships and onboard equipment from the newbuilding stage. ClassNK guidelines are generally available through its free-to-register My Page service.
For crews, clearer audit criteria usually mean more defined onboard duties, such as password and access control, handling of USB devices, software updates and incident reporting. Officers can expect cyber procedures to feature more often in internal audits and vetting inspections, and regular cyber awareness training is likely to become a firmer requirement.
