Introduction

This document has been prepared to provide requirements for identification and assessment of cyber hazards and risks affecting the safe and environmentally sound operation of ships throughout their operational life. This document provides specifications for procedures designed to be included or referenced in the company safety management system (SMS) in order to support effective cyber risk management as defined in MSC-FAL.1/Circ.3 on Guidelines for Maritime Cyber Risk Management^[¹^], as well as any additional requirements of the company or other identified stakeholder.

Operational technology (OT) includes devices, sensors, software and associated networking that monitor and control onboard systems required to safely and efficiently operate the ship. OT includes, but is not limited to, navigation, main and auxiliary machinery, propulsion management and cargo management systems.

The risks associated with OT differ from those associated with information technology (IT). In general, the risks associated with OT have the potential for physical impacts affecting the safety of the ship, the personnel and cargo onboard, and the marine environment. The risks associated with IT generally relate to business and other non-physical impacts which are not safety-critical. Where IT and OT systems are integrated for particular functions, there is a potential for IT to contribute to safety-critical impacts.

The information security management system (ISMS) recommended by ISO/IEC 27000 addresses the preservation of the confidentiality, integrity and availability (CIA) of information and data stored and processed by IT systems. This document uses CIA but focuses on risks associated with the loss of availability or integrity of OT systems and data which are necessary for the safe and environmentally sound operation of a ship.

The objective of the company security management system (SMS) required by SOLAS^[³^] chapter IX and the ISM Code^[⁴^] is to provide a safe working environment by establishing appropriate safe practices and procedures based on an assessment of all identified risks to the ship, personnel and the environment.

The loss of availability or integrity of safety critical systems and data, and disruption of safety related operational technology (OT) is expected to have physical consequences for the safe operation of ships and prevention of pollution. Consequently, it is essential that cyber risk management be incorporated into the company’s overall approach to safety management and compliance with the requirements of SOLAS chapter IX and the ISM Code, and as required by resolution MSC.428(98)^[⁵^]. The IMO has recognized that aspects of cyber risk management, including physical security aspects of cyber security, should be addressed in ship security plans under the ISPS Code^[⁶^]; however, this should not be considered as requiring a company to establish a separate cyber security management system operating in parallel with the company safety management system.

BS ISO 23806:2022

Ships and marine technology. Cyber safety

Current

Published:

30 Nov 2022