ClassNK releases updated cybersecurity management guidelines

ClassNK has released the second edition of its Guidelines for Cyber Security Management System for Ships as the shipping industry increases its requirements and audits to check that owners and managers are mitigating the risks of cyber attacks.

These guidelines introduce the requirements for a cybersecurity management system (CSMS), through which an organisation should address the cyber risks associated with daily ship operations. 

They cover governance and responsibilities ashore and on board through to the technical controls applied to shipboard systems, while making ClassNK’s certification audits more transparent by showing the assessment criteria.

In audits, the Tokyo-headquartered classification society looks at the governance behind a company’s cyber security, including policy and management commitment, defined roles and responsibilities, risk assessment, controls implementation, and incident preparedness.

This second edition has been restructured to align with international standards ISO/IEC 27001 and ISO/IEC 27002, and the assessment criteria for each CSMS requirement and multiple vetting schemes.

ClassNK said cybersecurity was increasingly covered in the external assessments conducted by maritime stakeholders, and many of those requirements focus on how cyber risk is managed.

A CSMS certified against these guidelines gives shipowners, managers and operators an objective means of demonstrating that governance to external stakeholders, and a single foundation for responding to multiple vetting requirements.