ClassNK Updates Ship Cyber Security Guidelines to Align with Major Vetting Schemes

ClassNK has released the second edition of its Guidelines for Cyber Security Management System for Ships, revising its audit criteria to align with four major maritime vetting and assessment schemes.

The updated guidelines are intended to help shipowners and ship managers address cyber security requirements across multiple industry assessments through a common management framework. The Japanese classification society has also clarified its certification requirements and restructured the guidelines to distinguish between management system requirements and the evidence needed to demonstrate their implementation.

The second edition divides the framework into two parts. Part 1 outlines the requirements for establishing a Cyber Security Management System (CSMS), while Part 2 specifies the audit criteria and supporting evidence expected during assessments.

The framework covers management commitment, responsibilities of shore-based and onboard personnel, risk assessment, operational controls and incident preparedness. It has also been restructured with reference to ISO/IEC 27001 and ISO/IEC 27002, the international standards covering information security management systems and security controls.

ISO/IEC 27001 establishes requirements for organisations to identify and manage information security risks, while ISO/IEC 27002 provides guidance on implementing security measures, including access management, personnel security and incident response.

ClassNK aligns audit criteria with four maritime vetting schemes

A key revision is the mapping of ClassNK’s CSMS audit criteria against four established maritime vetting and assessment frameworks:

• RightShip Inspection Ship Questionnaire (RISQ)
• Ship Inspection Report Programme (SIRE 2.0), operated by the Oil Companies International Marine Forum (OCIMF)
• Dry Bulk Management Standard (DryBMS)
• Tanker Management and Self Assessment (TMSA), developed by OCIMF

The mapping is intended to help shipowners and managers identify overlapping cyber security requirements and reduce the need to interpret each assessment framework separately.

The revised guidelines are accessible through ClassNK’s My Page portal following user registration.

Cyber security requirements under the IMO framework

Cyber security has increasingly become part of ship safety management as digital systems play a larger role in vessel operations. Cyber incidents can compromise information, disrupt onboard systems and potentially affect the safety and security of ships.

In June 2017, the International Maritime Organization (IMO) adopted Resolution MSC.428(98) through its Maritime Safety Committee. The resolution established that cyber risks should be addressed within an approved Safety Management System (SMS), in accordance with the International Safety Management (ISM) Code.

It encouraged flag administrations to ensure that cyber risks were incorporated into company safety management systems no later than the first annual verification of a company’s Document of Compliance (DOC) after 1 January 2021.

The IMO’s guidance also calls on shipping companies to identify, assess and manage cyber risks as part of their existing risk management and safety procedures. This places cyber security within the wider responsibilities of ship operators and management companies rather than limiting it to information technology departments.

ClassNK incorporates IACS cyber resilience requirements into ship rules

Alongside management system certification, ClassNK has incorporated the International Association of Classification Societies’ (IACS) Unified Requirements E26 and E27 into its rules covering cyber resilience.

These requirements address the cyber resilience of ships and onboard equipment, including computer-based systems. They apply to ships contracted for construction on or after 1 July 2024.

ClassNK also provides interpretation guidance covering approval procedures and technical requirements for shipyards, equipment manufacturers and shipowners.

The CSMS certification process separately evaluates how a company’s cyber security management arrangements are implemented both ashore and onboard. ClassNK issues separate certification application documents for companies and individual ships, reflecting the distinction between organisational management arrangements and their implementation at vessel level.

The revised guidelines bring these management and audit considerations together while providing a common reference for shipowners and managers preparing for different maritime vetting assessments.

FAQs

1. What has ClassNK changed in its ship cyber security guidelines?

ClassNK’s second edition separates Cyber Security Management System requirements into Part 1 and audit criteria with supporting evidence into Part 2. It also aligns the audit criteria with four maritime vetting schemes and references ISO/IEC 27001 and ISO/IEC 27002.

2. Which maritime vetting schemes are covered by the revised ClassNK guidelines?

The revised guidelines map their audit criteria against RightShip’s RISQ, OCIMF’s SIRE 2.0, the Dry Bulk Management Standard (DryBMS) and OCIMF’s Tanker Management and Self Assessment (TMSA).

3. Is cyber security part of mandatory ship safety management?

Yes. IMO Resolution MSC.428(98), adopted in June 2017, established that cyber risks should be addressed within an approved Safety Management System under the ISM Code. The implementation deadline was linked to the first annual verification of a company’s Document of Compliance after 1 January 2021.

4. What are IACS Unified Requirements E26 and E27?

IACS Unified Requirements E26 and E27 address cyber resilience for ships and onboard equipment, including computer-based systems. They apply to ships contracted for construction on or after 1 July 2024.

5. Where can shipowners access ClassNK’s revised cyber security guidelines?

The second edition of Guidelines for Cyber Security Management System for Ships is available through ClassNK’s My Page portal after registration.

ClassNK’s revised ship cyber security guidelines introduce a two-part Cyber Security Management System framework, separating management requirements from audit criteria and supporting evidence. The second edition also maps its audit criteria against RISQ, SIRE 2.0, DryBMS and TMSA to help shipowners and managers prepare for multiple maritime vetting assessments.