Marine Security Advisory: 02/2020 (Rev. 2) - Maritime Cyber Risk Management in Safety Management Systems
18 September 2026
Marine Security Advisory 02/2020 (Rev. 2)
18 September 2026
Marine Security Advisory: 02/2020 Rev.2
SUBJECT: Maritime Cyber Risk Management in Safety Management Systems
Ref: a) Marine Notice ISM-001
The following changes have been included:
- Updated reference c).
- Deleted paragraph regarding computer-based training (CBT) developed by the Administration
Dear Shipowner/Operator/Master:
The purpose of this Marine Advisory is to provide guidance to shipowners, operators and Master’s on actions to be taken to ensure that safety management systems take into account cyber risk management in accordance with the objectives and functional requirements of the International Safety Management (ISM) Code no later than the first annual verification of the company's Document of Compliance after 1 January 2021.
Background
Cyber technologies have become essential to the operation and management of numerous systems critical to the safety and security of shipping and protection of the marine environment. The vulnerabilities created by accessing, interconnecting or networking these systems can lead to cyber risks which should be addressed. Rapidly changing technologies and threats make it difficult to address these risks only through technical standards. As such, a risk management approach to cyber risks is recommended that is resilient and evolves as a natural extension of existing safety and security management practices.
The safety management objectives of a company under the ISM Code includes, inter alia, the provision of safe practices in ship operation and a safe working environment, the assessment of all identified risks to ships, personnel and the environment, the establishment of appropriate safeguards, and the continuous improvement of safety management skills of personnel ashore and aboard ships.
Liberian Marine Notice ISM-001 in Paragraph 6.10 - Development of Plans for Shipboard Cyber Risk Management, makes addressing cyber risks in the SMS mandatory.
Definitions
Cyber risk management is defined as the process of identifying, analyzing, assessing, and communicating a cyber-related risk and accepting, avoiding, transferring, or mitigating it to an acceptable level, considering costs and benefits of actions taken to stakeholders.
Maritime cyber risk is defined as a measure of the extent to which a technology asset could be threatened by a potential circumstance or event, which may result in shipping related operational, safety, or security failures as a consequence of information or systems being corrupted, lost, or compromised.
Action
Shipowners and operators shall ensure their safety management system takes into account cyber risk management in accordance with the objectives and functional requirements of the ISM Code, including assessment of all identified risks to their ships, personnel and the environment, and the establishment of appropriate safeguards and the continuous improvement of safety management skills of personnel ashore and aboard ships. In addressing cyber risk management, shipowners, operators and Masters should consider the guidance provided in reference c) and the latest version of The Guidelines on Cyber Security Onboard Ships developed by a consortium of shipping industry associations.
Reference c) provides high level recommendations regarding the elements of an appropriate approach to implementing cyber risk management and the industry guidelines provide the minimum measures that all companies should consider implementing so as to address cyber risk management in an approved SMS. Both refer to several standards to help identify and mitigate cyber risk consistent with the US National Institute of Standards and Technology (NIST) framework for Improving Critical Infrastructure Cybersecurity (the NIST 2.0 Framework), including six functional elements:
- Govern: Establish and monitor risk management strategy, expectations and policy. Define personnel role and responsibilities for cyber risk management.
- Identify: Determine the current cyber risk to ships and ship/port interfaces.
- Protect: Implement risk control processes and measures, and contingency planning to protect against cybersecurity events and ensure continuity of shipping operations, human safety, safety of the vessel and/or threat to the environment.
- Detect: Develop and implement activities necessary to detect a cybersecurity event in a timely manner.
- Respond: Develop and implement activities and plans to provide resilience and to restore systems necessary for shipping operations or services impaired due to a cyber-event.
- Recover: Identify measures to back-up and restore cyber systems necessary for shipping operations impacted by a cybersecurity event.
Reporting of Cyber Incidents
Cyber incidents should be reported to the Administration in accordance with Liberian Marine Notice ISM- 001 para 6.12. “Reports and Analysis of Non-Conformities, Accidents and Hazardous Occurrences, as soon as possible after the incidents.
Please note that data received by the Administration will remain confidential and, if reported to IMO or other interested parties, the incidents will not be attributed to any particular ship or Company, unless such identification is agreed to by the Company.
Potential Compliance Assessments by Port States
Port State Authorities have advised their intention to carry out assessments to determine if cyber risk management has been incorporated into the ship's SMS, as required, from 1 January 2021. If objective evidence is found that cyber risk management is not addressed in the ships SMS and/or the ship has failed to implement cyber risk management on board, the ship may be issued a deficiency and required to undergo an internal audit prior to departure or detained pending rectification of the deficiency.
For more information regarding the guidance in this Advisory, please contact Security at Security@liscr.com / +1 703 790 3434).
* * * * *
