Cyber Risk Management in the SMS (MSC.428(98))
The ISM Code has never had a dedicated cyber risk chapter: Resolution MSC.428(98) folded it into the existing risk management framework, making it a mature and auditable requirement from 2021 onward.
Operational Explanation
Resolution MSC.428(98) (adopted in June 2017) does not introduce a new chapter into the ISM Code, but establishes that cyber risks must be appropriately addressed within the existing Safety Management System, under the Code's general risk management framework (in particular paragraphs 1.2.3.2 and 1.4 on risk assessment and operational procedures). Administrations were encouraged to ensure cyber risks were appropriately addressed in the SMS no later than the first annual verification of the Document of Compliance (DOC) after 1 January 2021: a requirement that is by now mature and well-established, no longer a recent novelty.
Technical support for this requirement is provided by the Guidelines on Maritime Cyber Risk Management (MSC-FAL.1/Circ.3), revised several times: the latest revision (Rev.3) was approved by the Maritime Safety Committee at its 108th session (May 2024), confirming that the topic remains under active development even years after the requirement was first introduced. The Guidelines structure cyber risk management around five functions: identify, protect, detect, respond and recover.
Regulatory Reference
Resolution MSC.428(98) (June 2017): cyber risks must be appropriately addressed in the SMS under the ISM Code's risk management framework (par. 1.2.3.2, 1.4), no later than the first annual DOC verification after 1 January 2021. Supported by the MSC-FAL.1/Circ.3 Guidelines, latest revision (Rev.3) approved at MSC 108 (May 2024).
Scope of Application
Every Company holding an ISM DOC, covering all IT (information technology) and OT (operational technology, e.g. machinery automation, ECDIS, GMDSS) systems on board and ashore that are relevant to operational safety.
Procedure / How to Complete It
- Integrate cyber risk into the SMS's general risk assessment, not as a separate document isolated from the rest of the safety management system.
- Apply the five functions of the MSC-FAL.1/Circ.3 Guidelines (Rev.3): identify critical systems, protect them, detect anomalies, respond to incidents and recover operability.
- Distinguish and map IT systems (management, communication) and OT systems (machinery automation, navigation, cargo) separately, as they require different countermeasures.
- Integrate cyber incidents into the existing NC/Near Miss register, applying the same root cause analysis and CAPA cycle already used for other non-conformities.
- Train crew and shore-based personnel on the most common cyber risks (phishing, uncontrolled USB devices, unauthorised remote access to onboard systems).
- Verify, at the first subsequent annual DOC verification, that the auditor has documentary evidence of cyber risk integration into the SMS.
Practical Example
Example: a Company maps ECDIS, GMDSS and machinery automation systems as critical OT systems, establishes a control procedure for the use of external USB devices on board, and logs a malware incident detected on a shipboard laptop into the existing NC register, with a corresponding CAPA and effectiveness check.
Real Cases
Common Mistakes Mistake Library
| Mistake | Consequence | How to avoid it |
|---|---|---|
| Cyber risk managed as a separate IT matter, not integrated into the SMS's general risk assessment | Lack of integrated documentary evidence in the event of an audit, despite the existence of technical IT measures | Explicitly integrate cyber risk into the SMS's risk assessment and procedures, not only into the company's IT policy |
| No distinction between IT and OT systems in the cyber risk assessment | Countermeasures designed for management systems improperly applied to critical automation/navigation systems | Map IT and OT systems separately, with specific countermeasures for each category |
| Cyber incidents not logged in the existing NC/CAPA cycle | Loss of the root cause analysis and continuous improvement opportunity already provided for other non-conformities under the ISM Code | Treat every relevant cyber incident as a full NC, with a corresponding CAPA and effectiveness check |
PSC Observations
Operational Tips
- Don't treat cyber risk as a stand-alone document: integrate it into the SMS's general risk assessment, with the same verification and continuous improvement mechanisms.
- Apply the five functions of the MSC-FAL.1/Circ.3 Guidelines (identify, protect, detect, respond, recover) as a reference structure, not just as a list of technical controls.
- Periodically review the MSC-FAL.1/Circ.3 Guidelines, now at Rev.3 (MSC 108, May 2024): the topic remains under active development even years after the original requirement.
Checklist
- Cyber risk integrated into the SMS's general risk assessment
- Critical IT and OT systems mapped separately, with specific countermeasures
- Identification, protection, detection, response and recovery procedures documented
- Cyber incidents logged in the existing NC/CAPA cycle
- Crew and shore-based personnel trained on the most common cyber risks