IMO MSC-FAL.1/Circ.3/Rev.3

IMO Cyber Risk Management for Maritime — From Guidelines to Action

Applies to all ISM-audited vessels. Cyber risk has been an SMS requirement since 1 January 2021; the Guidelines were revised on 4 April 2025.

IMO Resolution MSC.428(98) requires cyber risk management to be incorporated into the Safety Management System (SMS) no later than the first annual verification of the Document of Compliance after 1 January 2021. MSC-FAL.1/Circ.3/Rev.3 provides the guidelines — based on the NIST Cybersecurity Framework — for how to do it. NCoDE Command turns those guidelines into operational controls, auditable evidence, and automated SMS chain reporting.

6 Functional Elements

SMS Chain Tracking

ISM Integration

Safety Classification

Six Functional Elements — Mapped to Shipboard Operations

MSC-FAL.1/Circ.3/Rev.3, approved on 4 April 2025, sets out the functional elements of maritime cyber risk management at §3.5. Revision 3 added Govern ahead of Identify, following the same change NIST made in Cybersecurity Framework 2.0. The Guidelines are explicit that the elements are not sequential — all should be concurrent and continuous. Each has specific outcomes that must be addressed within the vessel’s Safety Management System. NCoDE implements all six with maritime-specific controls.

1 — GOVERN §3.5.1

Accountability, Policy, and Business Continuity

Govern is new in Revision 3, and it sits ahead of everything else. It requires the company to establish and monitor a cyber risk management strategy with expectations and policies, define personnel roles and responsibilities for cyber risk management, and ensure business continuity — backup management, disaster recovery and crisis management. Two sub-requirements are explicit: designate a person or entity accountable for the planning, resourcing and execution of cybersecurity activities, and ensure that person is given the authority, support and expertise to fulfil the duty. NCoDE records the designation itself with appointment dates and qualification expiry, holds the risk management strategy in the Risk Register with named owners and review cycles, and evidences continuity through backup schedules carrying RPO and RTO targets with restore-test records. If your SMS names a cyber lead but cannot show what authority they hold, this is the element an auditor will press on.

KEY PERSONNEL RISK REGISTER BACKUP & RECOVERY ISM CODE 3

2 — IDENTIFY §3.5.2

Define Roles, Assets, and ISM Integration

The Identify function requires understanding the cyber risks to systems, people, assets, data, and capabilities. NCoDE’s Asset Management module maintains an inventory of all shipboard IT and OT systems — from bridge navigation computers to engine room PLCs. Each asset is classified by criticality and linked to the personnel responsible for it. The LDAP integration maps crew roles to system access, ensuring that the organisation understands who has access to what. Risk entries in the Risk Register tie each identified threat to the specific systems it affects, creating the foundation for all subsequent risk management activities. This feeds directly into the ISM Code’s requirement for hazard identification under the SMS.

ASSET MANAGEMENT RISK REGISTER LDAP ROLES ISM CODE 1.2

3 — PROTECT §3.5.3

Risk Controls, Contingency, and Access Management

The Protect function develops and implements safeguards to limit the impact of a potential cybersecurity event. NCoDE addresses this through multiple layers: role-based access control (RBAC) via LDAP ensures crew members only access systems appropriate to their role. The Software Allowlist prevents unauthorised applications from running on shipboard workstations. The Vendor Management module controls third-party access with session logging and DPA tracking. Backup Verification monitors backup schedules with RPO/RTO targets and restore testing records, ensuring that contingency plans are not just documented but verified. The Change Control Board manages all system modifications through a structured workflow, preventing unauthorised changes that could introduce vulnerabilities.

ACCESS CONTROL SOFTWARE ALLOWLIST VENDOR MANAGEMENT BACKUP VERIFICATION CHANGE CONTROL

4 — DETECT §3.5.4

Monitoring, Wazuh Integration, and Logging

The Detect function implements activities to identify cybersecurity events in a timely manner. NCoDE integrates with Wazuh, an open-source SIEM platform, to provide continuous monitoring of all managed shipboard endpoints. The PC Security Overview dashboard displays the real-time security status of every workstation — patch level, vulnerability count, last check-in time, and active alerts. Automated vulnerability scanning identifies new CVEs across the fleet of shipboard PCs, creating actionable patch lifecycle entries. The Audit Log captures every significant event across the platform, providing the detection evidence that auditors and flag state inspectors require. This continuous monitoring capability is what separates genuine IMO compliance from a paper exercise.

WAZUH SIEM VULNERABILITY SCANNING PC SECURITY OVERVIEW AUDIT LOG

5 — RESPOND §3.5.5

SMS Chain: Captain → DPA → Company → Flag State

The Respond function develops and implements activities to take action regarding a detected cybersecurity event. For maritime operations, this means activating the SMS reporting chain. NCoDE’s Incident Response module provides a guided decision tree that classifies the incident and determines the appropriate reporting obligations. When a cyber incident is created, the system automatically generates SMS chain notifications with deadline tracking: the Captain reports immediately per standing orders, the DPA is notified per SMS procedures, the Company Security Officer is informed, and flag state notification deadlines are created. Each step in the chain is tracked with timestamps, status, and evidence — proving to auditors that the SMS was followed. The incident timeline captures every action, communication, and decision made during response.

INCIDENT RESPONSE SMS CHAIN DECISION TREE DEADLINE TRACKING

6 — RECOVER §3.5.6

Backup, Restoration, and Lessons Learned

The Recover function develops and implements activities to maintain resilience and restore capabilities after a cybersecurity incident. NCoDE supports this through Backup Verification — tracking backup status, restore testing, and recovery time objectives for all critical systems. When an incident is resolved, the system captures lessons learned, root cause analysis, and corrective actions. These feed back into the Risk Register as updated risk entries, closing the loop between incident response and ongoing risk management. The Change Control Board tracks any system modifications made during recovery, ensuring that emergency changes are properly documented and reviewed. Recovery evidence is linked to the incident record, creating a complete audit trail from detection through resolution.

BACKUP VERIFICATION RISK REGISTER CHANGE CONTROL LESSONS LEARNED

SMS Chain Reporting — Automated and Tracked

The ISM Code requires a clear chain of reporting for all safety-related events, including cyber incidents that could affect vessel safety. NCoDE automates the entire SMS notification chain, creating deadlines at each stage and tracking completion.

Captain

Immediate notification per standing orders. NCoDE creates the incident record and timestamps the Captain’s initial report.

→

DPA

Designated Person Ashore notified per SMS procedures. NCoDE tracks notification time and acknowledgement.

→

Company Security Officer

CSO informed for ISPS and cyber assessment. NCoDE logs the notification and tracks response actions.

→

Flag State

Notification to flag state administration as required. NCoDE creates deadline and tracks submission status.

Multi-Framework Parallel Reporting

A single cyber incident on a vessel can trigger three reporting obligations simultaneously: the IMO SMS chain (Captain → DPA → Company → Flag State), NIS2 Article 23 three-stage reporting (24h early warning → 72h detailed notification → one-month final report), and USCG NRC notification for vessels operating in US waters. NCoDE manages all three in parallel from a single incident record. Each framework has its own deadline tracker, notification status, and evidence chain — but all draw from the same underlying incident data, eliminating the duplication and inconsistency that plagues manual reporting processes.

This parallel reporting capability is particularly critical for vessels that call at both EU and US ports. Without it, compliance teams must maintain separate tracking systems for each jurisdiction, often resulting in missed deadlines or contradictory reports. NCoDE ensures that a single source of truth drives all regulatory notifications.

Safety Impact Classification

IMO guidelines specifically address cyber risks to safety-critical shipboard systems. NCoDE classifies incidents by their impact on vessel safety functions, not just IT severity. This maritime-specific approach ensures that flag state inspectors see the safety context, not just a generic IT incident report.

Navigation Systems

ECDIS compromise, GPS spoofing, chart display manipulation, radar interference, AIS tampering. NCoDE tracks impact on safe navigation capabilities and COLREGS compliance.

Propulsion & Machinery

Engine control system compromise, propulsion management interference, auxiliary system manipulation. Tracks impact on vessel manoeuvrability and SOLAS Chapter II-1 compliance.

Communications

GMDSS disruption, VSAT compromise, crew communication interference, DSC system tampering. Assesses impact on distress alerting and SOLAS Chapter IV requirements.

Cargo Management

Cargo monitoring system compromise, ballast control interference, tank gauging manipulation. Evaluates impact on vessel stability and MARPOL compliance.

Access Control Systems

ISPS access control compromise, CCTV system interference, alarm system tampering. Tracks impact on vessel security plan and ISPS Code compliance.

Safety Systems

Fire detection/suppression interface, life-saving appliance monitoring, emergency shutdown systems. Evaluates impact on SOLAS life safety and LSA code requirements.

Maritime-Specific Incident Types

NCoDE’s incident classification includes maritime-specific cyber threat types that generic IT incident management tools miss entirely: GPS spoofing attacks that affect position reporting, AIS tampering that creates phantom vessels or hides the ship from traffic monitoring, ECDIS compromise that could display incorrect chart data, and engine control system ransomware that could disable propulsion. Each incident type is pre-mapped to the affected safety functions, the relevant IMO regulations, and the appropriate SMS reporting chain — so the response team does not need to determine reporting obligations from scratch during a crisis.

IMO Cyber Risk Management — FAQ

Common questions about IMO maritime cyber risk management guidelines and ISM Code integration.

What is IMO MSC-FAL.1/Circ.3?

IMO guidelines on maritime cyber risk management. The current text is Revision 3, approved 4 April 2025, setting out six functional elements (Govern, Identify, Protect, Detect, Respond, Recover) adapted for maritime operations. Applies to all vessels subject to ISM Code audits.

What is the SMS reporting chain for cyber incidents?

Under ISM Code, cyber incidents must be reported through the Safety Management System chain: Captain reports immediately, DPA (Designated Person Ashore) is notified, Company Security Officer informed, then Flag State notification as required. NCoDE tracks each stage with deadlines.

How does IMO cyber risk management integrate with ISM Code?

Cyber risks must be incorporated into the vessel’s existing Safety Management System. This means cyber risk assessment alongside operational risks, cyber incident procedures alongside emergency procedures, and cyber training alongside safety training. NCoDE links cyber incidents directly to ISM procedures.

What safety systems does IMO consider critical for cyber protection?

Navigation systems (GPS, ECDIS, AIS), propulsion control systems, communications (GMDSS, VSAT), cargo management systems, and safety systems (fire detection, ballast water). NCoDE classifies incidents by their impact on each critical system category.

Is IMO cyber risk management mandatory?

Yes, for all vessels subject to ISM Code audits. Flag states and classification societies verify compliance during ISM audits and port state control inspections. Failure to demonstrate cyber risk management can result in ISM non-conformities.