Cyber Risk Management of Automation Systems
A digital anomaly can become a problem with machinery control. Managing cyber risk in the engine room means understanding dependencies and access, controlling changes, and preparing response and recovery that keep essential services safe.
Operational Explanation
In OT (Operational Technology) systems, data monitor or control physical processes: engine automation, power management, alarms, pumps and safeguards. Losing data, altering a configuration or interrupting communications can therefore affect machinery operation. The risk includes maintenance or authorisation errors as well as intentional actions.
The first question is which ship function depends on the system: who reads that signal, who can change the command, which networks or devices connect it to other equipment, and what control options remain if part of it is unavailable. A supplier connection or maintenance computer forms part of this assessment even when used temporarily.
| Situation to understand | Possible operational effect | Familiarisation question |
|---|---|---|
| Supervisory workstation or network unavailable | Information or commands do not reach those who need them | Which functions remain available and which procedure addresses the loss? |
| Remote access or maintenance device | A person or software can reach the OT system | Who authorises, supervises and closes the access? |
| Software or configuration change | Behaviour, compatibility or availability may change | Which version is approved and how is the outcome verified? |
Regulatory Reference
IACS UR E26 Rev.1 (November 2023) and UR E27 Rev.1 (September 2023); MSC.428(98); MSC-FAL.1/Circ.3/Rev.4, approved by FAL 50 and MSC 111 and dated 28 May 2026.
Rev.4 dated 28 May 2026 is the reference verified for this review. The guidelines provide recommendations for integration into risk management; they do not replace applicable flag and class requirements. IMO MSC-FAL.1/Circ.3/Rev.4.
For automation, identify OT systems, connections and essential-service dependencies; define authorised access, incident response and recovery. Connect cyber measures to operational safety and SMS responsibilities. IACS: cyber resilience objectives.
UR E26 Rev.1, §1.3.1, covers passenger ships (including HSC) on international voyages, cargo ships and HSC of 500 GT and above on international voyages, MODUs of 500 GT and above, and self-propelled mobile offshore units engaged in construction. Check exclusions and the specific E27 scope for systems and equipment. Application is tied to the construction contract signed on or after 1 July 2024, not simply delivery of the ship. IACS UR E26 Rev.1 — notes and §1.3.1. MSC.428(98), paragraph 2, encourages Administrations to ensure that cyber risks are addressed in the SMS no later than the first annual verification of the company Document of Compliance after 1 January 2021; this is not a universal entry-into-force date. IMO MSC.428(98).
E26 addresses the ship’s cyber resilience as a whole; E27 the capabilities of systems and equipment within its scope. For ships subject to it, E26 §5.3 distinguishes the programme and evidence for the first annual survey, subsequent verification and special survey. These class provisions do not extend to every existing ship through renewal alone.
For OT-specific issues, NIST SP 800-82 Rev.3, Guide to OT Security provides technical guidance on availability, physical safety and controls. It is separate from maritime obligations; the NIST site identifies Rev.3 as the final publication and the Rev.4 update as a draft at the date checked.
Scope of Application
Familiarisation covers the automation systems and their connections on the ship, not only office computers. Operational measures follow risk, the Company SMS, the arrangement and applicable manuals. Read MSC.428(98) within the ISM Code scope; verify the IACS scope separately for the ship and its systems.
For E26/E27 Rev.1, ship type and size, construction contract and applicable Rules matter. A renewal survey alone does not turn an existing ship into a new ship subject to the URs; they may be used as non-mandatory guidance for other ships. Specific flag, class, contract or modification requirements may nevertheless require measures and evidence. Being outside that IACS branch does not justify leaving cyber risk unmanaged.
Procedure / How to Complete It
The following approach helps prepare and explain risk management; actions on equipment follow the procedures and responsibilities of the particular ship.
- Know the system. With engineering personnel, Company and suppliers, maintain an up-to-date inventory, function, versions, dependencies and connections. Identify essential services and the consequences of losing monitoring or control.
- Control access. Check authorised roles, personal credentials, privileges and local/remote connections; segment OT networks from IT networks under the approved design. Agree the purpose, onboard authorisation, supervision and closure of supplier work; use approved devices and media.
- Prepare changes. Before updates or configuration changes, assess compatibility, effects on services and execution conditions with the maker and Company. Define approvals, checks and the ability to return to a safe state; record version, activity and outcome, linking PMS and configuration documentation.
- Prepare recovery. Identify the programs, configurations and data needed, where protected copies are held and who may use them. Check that versions, tools, instructions and assistance support restoration; a backup file alone does not demonstrate recovery.
- Manage the anomaly. Recognise and report lost communications, inconsistent data, unexpected access or unexplained changes. Inform the Chief Engineer, command and Company contacts under the plan; assess the safety effect first. Containment, any alternative control and recovery must be coordinated and specific to the system.
- Verify and learn. Preserve observations and available records without compromising safety; document authorisations, return-to-service checks and corrective actions. Practise roles and communications through approved means and update the plan from the outcome.
Practical Example
Teaching scenario. A supplier proposes a remote update to the workstation supervising power management. Before the session, ship and Company clarify the functions affected, who authorises and supervises access, declared compatibility, usable copies and planned checks. The supplier’s availability does not replace authorisation of the work.
During verification, intermittent communication loss appears. The officer reports symptoms, timing and the activity in progress; the alarm alone does not establish that there is an attack. Responsible personnel apply the plan considering the electrical arrangement and available control options. The work closes only after the planned checks, with an updated configuration and a record of the defect, intervention and necessary follow-up.
What Typically Goes Wrong
Common Mistakes Mistake Library
| Mistake | Consequence | How to Avoid It |
|---|---|---|
| Assuming OT is secure because it does not directly use the Internet | Access through connected networks, media or maintenance is left outside the assessment | Map all connections and dependencies, including temporary ones |
| Leaving supplier access open beyond the authorised work | Privileges and the ability to modify remain available without operational control | Define authorisation, supervision, recording and session closure |
| Updating or restarting without assessing effects on the integrated system | Loss of function or unexpected equipment behaviour | Apply change management and checks agreed with the maker and Company |
| Confusing an available backup with verified recovery | Copies, versions or tools may not support a safe return to service | Check content, compatibility and restoration capability under the plan |
| Wrong cyber version or scope | Controls and evidence demanded from the wrong ship | Check official IMO/IACS indexes and contract date |
What the PSCO Checks
Prepare evidence relevant to the case: responsibilities, familiarisation, authorised work, reported anomalies and recovery checks. Distinguish this from the design, commissioning, programme and survey evidence required by class for ships within E26 scope. Protect credentials and sensitive information and arrange consultation through authorised channels. IMO A.1206(34), Appendix 8.
Operational Tips
- At handover, identify supplier work, access still active, pending changes and open anomalies; link technical work to SMS/PMS documentation.
- For updates that cannot be implemented immediately, agree temporary measures and documented follow-up with the Company and maker, assessing both vulnerability risk and the operational risk of the change.
- Connect cyber preparedness with breakdown/blackout management: a backup provides no electrical power and does not ensure that alternative control is independent.
- Use approved exercises, including discussion of a case, to verify who decides, who communicates and how recovery is demonstrated. IMO guidance describes Govern, Identify, Protect, Detect, Respond and Recover as continuing activities, not a universal sequence of commands.
- Separate current requirements, class/maker, SMS and voluntary guidance; do not improvise tests, thresholds or intervals, and record deviations and corrective action.
Preparation checklist
- I know the OT functions and essential services affected, with current dependencies and connections.
- I know authorised roles, credential management and approved supplier-access arrangements.
- I know where to find the approved configuration, update status and change documentation.
- I know the protected copies, instructions, tools and assistance needed for recovery and the planned checks.
- I can recognise and report anomalies and follow the plan without improvised system restarts or isolation.
- I can distinguish the ship/system IACS scope from SMS responsibilities, with editions and contract date checked.
FAQ
Related Topics
Certified substantive revision: 12 October 2026 · page fingerprint c8f473f496dd