The International Maritime Organization (IMO)– is the United Nations specialized agency with responsibility for the safety and security of shipping and the prevention of marine and atmospheric pollution by ships.

As a specialized agency of the United Nations, IMO is the global standard-setting authority for the safety, security and environmental performance of international shipping. Its main role is to create a regulatory framework for the shipping industry that is fair and effective, universally adopted and universally implemented.

Shipping is a truly international industry, and it can only operate effectively if the regulations and standards are themselves agreed, adopted and implemented on an international basis. And IMO is the forum at which this process takes place.

This chapter will outline the role of the IMO, and the current state of cyber regulation within the industry and some challenges such regulation faces considering the makeup of the IT systems used within the industry.

The IMO is, as we have seen, responsible for forming consensus and from that regulation to keep seafarers, infrastructure and the planet safe. This includes the risks that are faced in relation to cybersecurity. The IMO defines cyber risk as:

Maritime cyber risk refers to a measure of the extent to which a technology asset could be threatened by a potential circumstance or event, which may result in shipping-related operational, safety or security failures as a consequence of information or systems being corrupted, lost or compromised.

Their current guidance (discussed in the next video) is directing operators to managing their cyber risk. To manage the risk, you need to first understand it, which means undergoing a process of identifying, analysing and assessing the risk to then enable mitigation measures to be taken. We will discuss this mitigation in the future cyber security module, but they can be broadly described in terms of technical solutions (hardware and software), user education, and a level of risk which is accepted and monitored.

The overall goal is to support safe and secure shipping, which is operationally resilient to cyber risks.

IMO 2021

Applicable to commercial ships with over 500 gross tonnage, the IMO resolution (MSC 428, 98) confirmed all shipping companies need to have cyber security in their safety management system. Flag states are encouraged to check this in the first annual audit after January 2021.

Non-compliance may lead to vessel detainment. This means maritime companies need to be identifying and safeguarding against maritime cyber risks now to be ready for the first annual verification of the Company’s Document of Compliance.

Maritime companies must be able to prove they achieve the following:

Effective cyber risk management starting at the senior management level and embedding a culture of cyber risk awareness into all levels of the organisation.
A risk based approach adopted with a comprehensive assessment to compare current, and desired, cyber risk management postures. Such a comparison may reveal gaps that can be addressed to achieve risk management objectives through a prioritised cyber risk management plan.
The 5 NIST Cyber Security Framework domains should be considered as part of the response to the risk management review (Identify, Protect, Detect, Respond and Recover).
All operational systems should be included and the process and effectiveness reviewed regularly.
A plan to communicate awareness throughout the organisation should be implemented.

The Guidelines also identify particular systems that should be considered

1. Bridge systems
2. Cargo handling and management systems
3. Propulsion and machinery management and power control systems
4. Access control systems
5. Passenger servicing and management systems
6. Passenger facing public networks
7. Administrative and crew welfare systems
8. Communication systems

Challenges

Cyber regulation faces within the maritime industry due to a broad range of factors. This next video will explore these challenges.

The Future

The maritime regulation discussed within this section aims to enable the maritime industry to adapt to the challenges it currently faces. Our final video aims to peer into the future at what it may hold for cyber regulation.

Conclusion

This section has aimed to make us aware broadly of the IMO and its regulatory instruments that can assist us in protecting maritime systems. There was specific attention given to IMO resolution (MSC 428, 98) and its detailed need for cyber security management systems within vessels.

This discussion, in the light of the rest of the module, with its focus on IT problems that are possible at sea has hopefully broadened your understanding of the need to understand the context, and not only how IT can help, but if not designed well or monitored closely, can create problems.