1 INTRODUCTION
1.1 These Guidelines provide high-level recommendations for maritime cyber risk
management. For the purpose of these Guidelines, maritime cyber risk refers to a
measure of the extent to which a technology asset is threatened by a potential
circumstance or event, which may result in shipping-related operational, safety or
security failures as a consequence of information or systems being corrupted, lost or
compromised.
1.2 Stakeholders should take the necessary steps to safeguard shipping from current and
emerging threats and vulnerabilities related to digitization, integration and automation
of processes and systems in shipping.
1.3 For details and guidance related to the development and implementation of specific
risk management processes, users of these Guidelines should refer to specific Member
Governments' and Flag Administrations' requirements, as well as relevant international
and industry standards and best practices.
1.4 Risk management is fundamental to safe and secure shipping operations. Risk
management has traditionally been focused on operations in the physical domain, but
greater reliance on digitization, integration, automation and network-based systems has
created an increasing need for cyber risk management in the shipping industry.
1.5 Predicated on the goal of supporting safe and secure shipping, which is
operationally resilient to cyber risks, these Guidelines provide recommendations that
can be incorporated into existing risk management processes. In this regard, the
Guidelines are complementary to the safety and security management practices established
by this Organization.
2 GENERAL
2.1 Background
2.1.1 Cybertechnologies have become essential to the operation and
management of numerous systems critical to the safety and security of shipping and
protection of the marine environment. In some cases, these systems are to comply with
international standards and Flag Administration requirements. However, the
vulnerabilities created by accessing, interconnecting or networking these systems can
lead to cyber risks which should be addressed. Vulnerable systems could include, but are
not limited to:
-
.1 Bridge systems;
-
.2 Cargo handling and management systems;
-
.3 Propulsion and machinery management and power control systems;
-
.4 Access control systems;
-
.5 Passenger servicing and management systems;
-
.6 Passenger facing public networks;
-
.7 Administrative and crew welfare systems; and
-
.8 Communication systems.
2.1.2 The distinction between information technology and operational technology systems
should be considered. Information technology systems may be thought of as focusing on
the use of data as information. Operational technology systems may be thought of as
focusing on the use of data to control or monitor physical processes. Furthermore, the
protection of information and data exchange within these systems should also be
considered.
2.1.3 While these technologies and systems provide significant efficiency gains for the
maritime industry, they also present risks to critical systems and processes linked to
the operation of systems integral to shipping. These risks may result from
vulnerabilities arising from inadequate operation, integration, maintenance and design
of cyber-related systems, and from intentional and unintentional cyberthreats.
2.1.4 Threats are presented by malicious actions (e.g. hacking or introduction of
malware) or the unintended consequences of benign actions (e.g. software maintenance or
user permissions). In general, these actions expose vulnerabilities (e.g. outdated
software or ineffective firewalls) or exploit a vulnerability in operational or
information technology. Effective cyber risk management should consider both kinds of
threat.
2.1.5 Vulnerabilities can result from inadequacies in design, integration and/or
maintenance of systems, as well as lapses in cyberdiscipline. In general, where
vulnerabilities in operational and/or information technology are exposed or exploited,
either directly (e.g. weak passwords leading to unauthorized access) or indirectly (e.g.
the absence of network segregation), there can be implications for security and the
confidentiality, integrity and availability of information. Additionally, when
operational and/or information technology vulnerabilities are exposed or exploited,
there can be implications for safety, particularly where critical systems (e.g. bridge
navigation or main propulsion systems) are compromised.
2.1.6 Effective cyber risk management should also consider safety and security impacts
resulting from the exposure or exploitation of vulnerabilities in information technology
systems. This could result from inappropriate connection to operational technology
systems or from procedural lapses by operational personnel or third parties, which may
compromise these systems (e.g. inappropriate use of removable media such as a memory
stick).
2.1.7 Further information regarding vulnerabilities and threats can be found in the
additional guidance and standards referenced in section 4.
2.1.8 These rapidly changing technologies and threats make it difficult to address these
risks only through technical standards. As such, these Guidelines recommend a risk
management approach to cyber risks that is resilient and evolves as a natural extension
of existing safety and security management practices.
2.1.9 In considering potential sources of threats and vulnerabilities and associated
risk mitigation strategies, a number of potential control options for cyber risk
management should also be taken into consideration, including amongst others,
management, operational or procedural, and technical controls.
2.2 Application
2.2.1 These Guidelines are primarily intended for all organizations in the
shipping industry, and are designed to encourage safety and security management
practices in the cyberdomain.
2.2.2 Recognizing that no two organizations in the shipping industry are the
same, these Guidelines are expressed in broad terms in order to have a widespread
application. Ships with limited cyber-related systems may find a simple application of
these Guidelines to be sufficient; however, ships with complex cyber-related systems may
require a greater level of care and should seek additional resources through reputable
industry and Government partners.
2.2.3 These Guidelines are recommendatory.
3 ELEMENTS OF CYBER RISK MANAGEMENT
3.1 For the purpose of these Guidelines, cyber risk management means the process
of identifying, analysing, assessing, and communicating a cyber-related risk and
accepting, avoiding, transferring or mitigating it to an acceptable level, considering
costs and benefits of actions taken to stakeholders.
3.2 The goal of maritime cyber risk management is to support safe and secure shipping,
which is operationally resilient to cyber risks.
3.3 Effective cyber risk management should start at the senior management level. Senior
management should embed a culture of cyber risk awareness into all levels of an
organization and ensure a holistic and flexible cyber risk management regime that is in
continuous operation and constantly evaluated through effective feedback mechanisms.
3.4 One accepted approach to achieve the above is to comprehensively assess and compare
an organization's current, and desired, cyber risk management postures. Such a
comparison may reveal gaps that can be addressed to achieve risk management objectives
through a prioritized cyber risk management plan. This risk-based approach will enable
an organization to best apply its resources in the most effective manner.
3.5 These Guidelines present the functional elements that support effective cyber risk
management. These functional elements are not sequential – all should be concurrent and
continuous in practice and should be incorporated appropriately in a risk management
framework:
-
.1 Identify: Define personnel roles and responsibilities for cyber
risk management and identify the systems, assets, data and capabilities that, when
disrupted, pose risks to ship operations.
-
.2 Protect: Implement risk control processes and measures, and
contingency planning to protect against a cyber-event and ensure continuity of
shipping operations.
-
.3 Detect: Develop and implement activities necessary to detect a
cyber-event in a timely manner.
-
.4 Respond: Develop and implement activities and plans to provide
resilience and to restore systems necessary for shipping operations or services
impaired due to a cyber-event.
-
.5 Recover: Identify measures to back-up and restore cyber systems
necessary for shipping operations impacted by a cyber-event.
3.6 These functional elements encompass the activities and desired outcomes
of effective cyber risk management across critical systems affecting maritime operations
and information exchange, and constitute an ongoing process with effective feedback
mechanisms.
3.7 Effective cyber risk management should ensure an appropriate level of
awareness of cyber risks at all levels of an organization. The level of awareness and
preparedness should be appropriate to roles and responsibilities in the cyber risk
management system.
4 BEST PRACTICES FOR IMPLEMENTATION OF CYBER RISK MANAGEMENT
4.1 The approach to cyber risk management described herein provides a
foundation for better understanding and managing cyber risks, thus enabling a risk
management approach to address cyberthreats and vulnerabilities. For detailed guidance
on cyber risk management, users of these Guidelines should also refer to Member
Governments' and Flag Administrations' requirements, as well as relevant international
and industry standards and best practices.
4.2 Additional guidance and standards may include, but are not limited
to:footnote
-
.1 The Guidelines on Cyber Security Onboard Ships produced and
supported by ICS, IUMI, BIMCO, OCIMF, INTERTANKO, INTERCARGO, InterManager, WSC
and SYBAss.
-
.2 Consolidated IACS Recommendation on cyber resilience (Rec 166).
-
.3 ISO/IEC 27001 standard on Information technology – Security
techniques – Information security management systems – Requirements. Published
jointly by the International Organization for Standardization (ISO) and the
International Electrotechnical Commission (IEC).
-
.4 United States National Institute of Standards and Technology's
Framework for Improving Critical Infrastructure Cybersecurity (the NIST
Framework).
-
.5 IAPH Cybersecurity Guidelines for Ports and Port Facilities.
4.3 Reference should be made to the most current version of any guidance or
standards utilized.