ClassNK Releases Second Edition of Cybersecurity Guidelines for Ships
Cubierto por 2 fuentesPublicado
ClassNK has published the second edition of its Guidelines for Cyber Security Management System (CSMS) on board Ships, aimed at shipowners and ship management companies. The document sets out the requirements through which a company addresses cyber risks associated with shipping operations as part of its day-to-day work, ranging from governance and responsibilities ashore and on board to technical controls applied to shipboard systems.
Transparency in Audits
The guidelines aim to bring transparency to certification audits by setting out the evaluation criteria applied during them. In audits, ClassNK reviews a company's cybersecurity governance, taking into account policy and management commitment, defined roles and responsibilities, risk assessment, the implementation and operation of controls, and incident preparedness.
Structure and Alignment with Standards
The second edition has been restructured with reference to the ISO/IEC 27001 and ISO/IEC 27002 standards, and the evaluation criteria for each CSMS requirement have been clarified. In addition, the requirements have been mapped against the cybersecurity criteria of major industry verification schemes, including RISQ, SIRE 2.0, DryBMS and TMSA.
Regulatory Background
IMO recommends that cyber risks be managed within Safety Management Systems under the ISM Code. In response, ClassNK published the first edition of these guidelines in 2019, based on the ISM Code framework, and has since offered CSMS certification in accordance with that document. As a collective effort by the International Association of Classification Societies (IACS), the application of IACS UR E26 and E27 has further defined the cyber resilience capabilities that ships must have from the newbuilding stage onward.
A Common Framework for Multiple Requirements
According to ClassNK, a CSMS certified under these guidelines gives companies an objective means of demonstrating their cybersecurity governance to external stakeholders, as well as a single basis for responding to multiple verification requirements, rather than having to interpret each scheme separately. The classification society will continue to support cybersecurity efforts across the maritime industry by providing guidelines, audits and certification.
