Maritime Regulatory Compliance

Why Every Vessel Needs NCoDE

Four frameworks. Every requirement mapped. One platform.

Maritime compliance now spans operational safety, cyber security, and classification rules simultaneously. NCoDE Command maps every sensor, every widget, and every module directly to the regulation it helps you satisfy - giving owners, operators, and inspectors a single source of auditable truth.

9 Regulatory Frameworks
15 USCG Requirements
100+ Sensors Monitored
25+ Dashboard Widgets
3 Reporting Panels

Enforcement Deadlines Are Here

USCG 33 CFR 101 Subpart F Enforcement began July 2025 - US-calling vessels must demonstrate cyber security compliance
EU NIS2 Directive Transposed October 2024 - Maritime classified as essential entity under EU cyber law
IMO MSC-FAL.1/Circ.3/Rev.3 In effect since January 2021 - Cyber risk management addressed in Safety Management Systems
Classification Societies Increasing cyber notation requirements across Lloyd's, Bureau Veritas, and RINA
The Compliance Challenge

What changes when you deploy NCoDE?

Most vessels manage compliance through disconnected spreadsheets, paper checklists, and manual processes. NCoDE replaces this with an integrated digital platform that generates auditable evidence automatically.

Challenge Without NCoDE With NCoDE
Cyber compliance Spreadsheets, paper checklists, no framework tracking Multi-framework compliance tracker with control-level evidence
Vulnerability management Manual PC audits, no centralised view Automated Wazuh vulnerability scanning across all shipboard PCs
Access control evidence Manual logs, shared passwords LDAP authentication with role/group permissions and audit trail
Incident response Paper-based plans, no workflow Guided decision tree with auto-generated descriptions and multi-framework reporting (NRC, NIS2 Article 23, IMO SMS chain) with automated deadline tracking
Patch management No visibility into patch status across shipboard systems Full lifecycle tracking: open → scheduled → applied → verified with auto-created change requests and risk entries
Backup verification Untested backup assumption — no verification until disaster Schedule tracking, RPO/RTO targets, restore testing records, overdue alerts at 1.5× and 2× frequency thresholds
Training compliance Spreadsheet with manual expiry checks LDAP-integrated crew × certification matrix with 30/60/90-day warnings and per-role compliance percentage
Regulatory reporting Manual forms, missed deadlines, no tracking Dedicated panels for USCG NRC, NIS2 Article 23 (three-stage), and IMO SMS chain with automated deadline countdown
Vendor security Email assessments, no tracking Vendor database with remote access logging and DPA tracking
Document control File shares, no version control Document Vault with versioning, expiry alerts, access logs
Risk assessment Static spreadsheet risk register Dynamic 5×5 risk matrix with mitigation tracking
Change management Informal approval process Change Control Board: request → review → approve → implement
Sensor monitoring Bridge instruments only, manual log-keeping Near real-time telemetry from command workstation
Navigation compliance Bridge gauges, no digital record Digital instrument display with historical data
Tank monitoring Manual sounding or local gauges Real-time tank levels with visual gauges
Audit evidence Paper logs, manual record keeping Complete digital audit trail for USCG/flag state inspection
Compliance Functions

Ten dedicated compliance functions. Built for auditors.

NCoDE includes ten purpose-built compliance functions that map directly to USCG 33 CFR 101, IMO cyber risk guidance, and EU NIS2 requirements. Each module generates the evidence an inspector expects to see.

Maritime Cyber Compliance

Multi-framework compliance tracking with controls mapping, incident response workflow, penetration test scheduling, and NRC reporting. Covers USCG, IMO, and NIS2 simultaneously.

USCG 33 CFR 101 IMO MSC-FAL.1 EU NIS2

Risk Register

5×5 likelihood-impact risk matrix with mitigation tracking, risk ownership, and review scheduling. Generates the formal risk assessment required by ISM Code and USCG cyber rules.

ISM Code 1.2.2 USCG §101.650(e) EU NIS2 Art. 21

Document Vault

Controlled document storage with version history, expiry tracking, access logging, and role-based permissions. The ISM-compliant document management system your classification society expects.

ISM Code 11 Classification Rules

Change Management

Full change control board workflow: request, review, approve, implement, and rollback. Every modification to safety-critical systems is documented and authorised before execution.

ISM Code 10 USCG §101.650(b)

Vendor Tracker

Third-party vendor assessment with security scoring, remote access logging, Data Processing Agreement tracking, and access control. Supply chain security for every system that touches your vessel.

USCG §101.650(f) EU NIS2 Art. 21(2)(d) Classification

PC Security & SIEM

Wazuh-powered vulnerability scanning, patch compliance monitoring, and security alerting across every networked device aboard. Continuous monitoring that satisfies the "Detect" function.

USCG §101.650(e) IMO Detect EU NIS2 Art. 21(2)(e)

Patch Lifecycle Management

Full state machine: open → scheduled → applied → verified. Deferred patches auto-create risk entries. Wazuh SCA integration for automated findings import across all monitored agents.

USCG §101.650(e) NIS2 Art. 21(2)(e) ISM 10.1

Backup & Recovery

Schedule tracking with RPO/RTO targets per system. Verification records with mandatory restore testing. Overdue detection alerts before compliance gaps emerge.

USCG §101.650(g) NIS2 Art. 21(2)(c) IMO §3.5.6

Training Matrix

Crew-by-certification grid with automatic 30/60/90-day expiry warnings. LDAP-integrated with role filtering and bulk assignment after drills. Per-role compliance percentage.

USCG §101.650(d) ISM Code 6 STCW

Software Allowlist

Per-agent software baseline management with global allowlist. Automated violation detection when unapproved software is found on any monitored endpoint.

USCG §101.650(b) NIS2 Art. 21(2)(e)
Automated Reporting

Three Frameworks. One Incident. Zero Missed Deadlines.

When a cyber incident is created, NCoDE automatically calculates every regulatory deadline across all applicable frameworks. No manual date tracking. No spreadsheet reminders. The system tells you what is due and when.

USCG NRC Reporting

National Response Center incident reporting with pre-populated vessel details, incident classification, and impact assessment.

  • → NRC notification form — reportable incidents, without delay
  • → Vessel info auto-populated from configuration
  • → Incident classification and impact assessment captured
  • → Submission recorded in the audit trail as §101.640 evidence
§101.650(g)

NIS2 Article 23 Reporting

Three-stage incident notification matching EU NIS2 Directive requirements with countdown timers for each stage.

  • → Early Warning (24h) — severity, cross-border impact
  • → Detailed Notification (72h) — root cause, IoCs, mitigation
  • → Final Report (1 month) — full analysis, root cause, lessons learned
  • → Each stage pre-populated, read-only after submission
Art. 23(4)

IMO SMS Chain Reporting

Safety Management System reporting chain with visual progress tracking from vessel to flag state authority.

  • → Captain — immediate notification with safety impact
  • → DPA — designated person ashore notification
  • → Company — company security officer notification
  • → Flag State — formal notification with corrective plan
MSC-FAL.1/Circ.3/Rev.3 §3.5.5
Framework Coverage

Four frameworks. Every requirement mapped.

NCoDE doesn't just claim compliance - it maps every feature to the specific regulation section it helps you satisfy. Here's how each framework is addressed.

01 USCG 33 CFR 101 Subpart F

The US Coast Guard's maritime cyber security rule, in force since 16 July 2025. Every requirement area in Subpart F mapped to NCoDE features, covering cybersecurity plans, risk assessment, access control, vulnerability management, incident response, and training.

Requirement Section NCoDE Feature Module
Cybersecurity Plan §101.630 Plan sections with completion tracking Cyber Compliance
CySO designation & qualifications §101.620, §101.625 Key personnel management with certificate expiry Cyber Compliance LDAP Admin
Cybersecurity Assessment §101.630 5×5 risk matrix with mitigation tracking Risk Register
Drills and exercises §101.635 Drill records with findings and corrective actions Cyber Compliance
Records and documentation §101.640 Audit trail across training, drills, incidents and audits Audit Logs
Account security §101.650(a) LDAP authentication, RBAC, password policy, MFA tracking LDAP Admin
Device security §101.650(b) Approved software list, endpoint inventory, change approval Software Allowlist Change Mgmt
Data security §101.650(c) Protected audit logs retained for two years per 33 CFR 104.235 Audit Logs
Cybersecurity training §101.650(d) Crew training matrix with 30/60/90-day expiry warnings Training Matrix
Risk management & vulnerabilities §101.650(e) Wazuh scanning, KEV tracking, patch lifecycle, pen test records PC Security
Supply chain management §101.650(f) Vendor assessment, DPA tracking, remote access logs Vendor Tracker
Resilience & incident reporting §101.650(g) Incident workflow, NRC reporting, backup schedules with RPO/RTO Cyber Compliance Backup
Network segmentation §101.650(h) Peplink topology visibility, IT/OT zone tracking per system Peplink
Physical security §101.650(i) Attestation workflow for IT and OT equipment access Compliance Tracker

02 IMO MSC-FAL.1/Circ.3/Rev.3 - Cyber Risk Management

The IMO's functional framework for maritime cyber risk management. Revision 3, approved 4 April 2025, adds Govern alongside Identify, Protect, Detect, Respond and Recover — six elements, set out at §3.5 of the Guidelines.

Function NCoDE Feature Module
Govern §3.5.1 Accountable person designation, risk policy, business continuity and crisis management Cyber Compliance Risk Register
Identify §3.5.2 Systems inventory with network topology and dependency mapping Cyber Compliance
Protect §3.5.3 LDAP access control, certification tracking, removable media controls LDAP Admin
Detect §3.5.4 Wazuh monitoring, vulnerability scanning, threat tracking PC Security
Respond §3.5.5 Incident workflow, SMS reporting chain, incident records Cyber Compliance
Recover §3.5.6 Backup schedules with RPO/RTO, restore testing, root cause analysis Cyber Compliance Backup

03 EU NIS2 Directive

The EU's network and information security directive. Maritime is classified as an essential entity. All ten Article 21(2) risk-management measures, plus Article 20 governance and Article 23 reporting.

Requirement Article NCoDE Feature Module
Management body accountabilityArt. 20Governance approval and management training recordsCyber Compliance
Risk analysis & IS policiesArt. 21(2)(a)5×5 risk matrix with ownership and review schedulingRisk Register
Incident handlingArt. 21(2)(b)Incident response workflow with decision treeCyber Compliance
Business continuity & crisis managementArt. 21(2)(c)Backup schedules with RPO/RTO targets and restore testingBackup
Supply chain securityArt. 21(2)(d)Vendor assessment, DPA tracking, remote access logsVendor Tracker
Acquisition, development & vulnerability handlingArt. 21(2)(e)Wazuh scanning, patch lifecycle, disclosure procedurePC Security
Effectiveness assessmentArt. 21(2)(f)Control implementation status, audit and penetration test recordsCyber Compliance
Cyber hygiene & trainingArt. 21(2)(g)Crew training matrix with 30/60/90-day expiry warningsTraining Matrix
Cryptography & encryptionArt. 21(2)(h)Cryptography policies held in the Document Vault with review cycles; encryption controls tracked with attached evidenceCyber Compliance
HR security, access control & asset managementArt. 21(2)(i)RBAC with group permissions, full systems inventoryLDAP Admin
MFA & secured communicationsArt. 21(2)(j)MFA tracking on privileged and remote accessLDAP Admin
Incident reportingArt. 2324h early warning, 72h notification, final report within one monthCyber Compliance

04 SOLAS - Safety of Life at Sea

The foundational maritime safety convention. NCoDE monitors 12 specific SOLAS regulations through its sensor telemetry, navigation, video, network, and power systems.

Regulation Requirement NCoDE Feature Widget
Ch. II-1, Reg. 25-26 Electrical power for safety Battery voltage monitoring Battery Monitor
Ch. II-2, Reg. 7 Fire detection — visual monitoring of machinery spaces & cargo holds CCTV with recording for early fire/smoke detection Video
Ch. IV, Reg. 6-7 Radiocommunications equipment availability (GMDSS) Network & equipment health monitoring Network
Ch. V, Reg. 19 Navigation equipment GPS, SOG, heading, depth, ROT Data Grid Map View
Ch. V, Reg. 19.2.1 Magnetic compass Compass heading gauge Data Grid
Ch. V, Reg. 19.2.3 Echo sounder Water depth Data Grid
Ch. V, Reg. 19.2.7 Radar Radar display with AIS Radar
Ch. V, Reg. 19.2.9 Rate of turn indicator ROT in degrees/second Data Grid
Ch. V, Reg. 19.2.12 Electronic inclinometer (mandatory for containerships & bulk carriers from Jan 2026) Heel, pitch & roll angle monitoring Data Grid
Ch. V, Reg. 20 Voyage data recording Continuous telemetry archive with audit trail Data Grid Audit Logs
Ch. V, Reg. 34 Voyage planning Wind, pressure, temp, fuel Data Grid Tanks
Ch. XI-2 / ISPS Code Ship security — surveillance of restricted areas, deck & access points CCTV & IP camera integration with recording Video

05 ISM Code - International Safety Management

8 ISM Code sections addressed through risk assessment, maintenance monitoring, documentation, certification tracking, and audit logs.

Section Requirement NCoDE Feature Module
1.2.2Risk assessment5×5 matrix with mitigationRisk Register
6Resources & personnelCertification trackingLDAP Admin
7Shipboard operationsPre-departure checklistsChecklist
10.1MaintenanceEngine condition monitoringData Grid
10.3Critical equipmentBattery, network monitoringBattery Network
11DocumentationControlled versioning & expiryDocument Vault
12Verification & auditComplete event trailAudit Logs

06 MARPOL - Pollution Prevention

Tank monitoring and engine condition data to support oil pollution prevention, sewage management, and air emission compliance.

Annex Requirement NCoDE Feature Widget
Annex IOil pollution preventionOil pressure & temperatureData Grid
Annex IV, Reg. 11Sewage holdingBlack water tank levelTanks
Annex IVGrey water managementGrey water tank levelTanks
Annex VIAir pollution / engine efficiencyExhaust temp, RPM monitoringData Grid

07 COLREGS - Collision Regulations

Proper lookout, safe speed assessment, collision risk evaluation, and avoidance action - all supported by sensor, AIS, radar, and video data.

Rule Requirement NCoDE Feature Widgets
Rule 5Proper lookoutInstruments, video, radarData Grid Video Radar
Rule 6Safe speedSOG, depth, weather dataData Grid
Rule 7Risk of collisionAIS tracking, GPS, heading, radarMap View Radar
Rule 8Avoidance actionROT, heading, speed displayData Grid

08 MLC 2006 & 09 Classification Society Rules

Crew welfare monitoring (temperature, humidity), structural health (heel, pitch, G-force), engine condition, personnel certification, and vendor management.

Framework Requirement NCoDE Feature Module
MLC Reg. 3.1Accommodation conditionsAir temp, humidityData Grid
MLC Reg. 4.3Hazard identificationG-force, weather dataData Grid
ClassificationEngine conditionRPM, oil, coolant, exhaustData Grid
ClassificationStability monitoringHeel, pitch, G-forceData Grid
ClassificationPersonnel certificationCert tracking, expiry alertsLDAP Admin
ClassificationVendor managementSecurity assessment, access logsVendor Tracker
Operational Compliance

Every widget serves a regulation.

NCoDE's dashboard widgets aren't just convenient - each one maps directly to a regulatory requirement. Here's why every widget exists.

Data Grid

Real-time sensor telemetry - navigation, engine, environmental, and tank data from NMEA 2000. Continuous monitoring replaces manual log-keeping.

SOLAS V/19 ISM 10.1 MARPOL I/IV/VI

Video Feed

CCTV and camera monitoring for bridge visibility and security surveillance. Proper lookout extends to electronic means.

COLREGS Rule 5 ISPS Code

Map View & AIS

AIS vessel tracking, chart display, and position plotting. Electronic chart display with AIS overlay for collision risk assessment.

SOLAS V/19 COLREGS Rule 7

Radar

Canvas-rendered radar with AIS contacts. Primary tool for collision risk assessment, especially in restricted visibility.

COLREGS Rule 7 SOLAS V/19.2.7

Battery Monitor

Battery bank voltage, state of charge, and health status. Emergency power availability is a SOLAS requirement.

SOLAS II-1/25-26

Water Tanks

Fuel, fresh water, grey water, and black water levels with visual gauges. Sewage discharge monitoring is mandatory.

MARPOL IV (Reg. 11) SOLAS V/34

Digital Twin

3D vessel model with AIS overlay and bridge communications. Comprehensive situational awareness combining vessel geometry with live traffic.

COLREGS Rules 5-8 SOLAS V/19

Checklist

Pre-departure and operational checklists with crew certification tracking. Documented operational procedures required by ISM Code.

ISM Code 6/7 STCW

LDAP Administration

User access control with roles, permissions, groups, and certification tracking. Access control to safety-critical systems is an ISM and ISPS requirement.

ISM Code 12 ISPS Code USCG 33 CFR 101
Sensor Telemetry

100+ data types. Every one regulation-mapped.

Most of what NCoDE monitors does double duty: the same reading that tells the crew how the vessel is running also evidences an obligation. From GPS position to exhaust temperature, the operational record and the compliance record are the same record.

GPS Position
lat/lon
SOLAS V/19, COLREGS 7
Speed (SOG)
knots
SOLAS V/19.2.5, COLREGS 6
Heading
degrees
SOLAS V/19.2.1, COLREGS 7
COG
degrees
SOLAS V/19, COLREGS 7
Rate of Turn
°/s
SOLAS V/19.2.9, COLREGS 8
Water Depth
metres
SOLAS V/19.2.3, COLREGS 6
Heel Angle
degrees
SOLAS II-1, Classification
Pitch Angle
degrees
SOLAS II-1, Classification
G-Force
g
Classification, MLC 4.3
True Wind Speed
knots
SOLAS V/34, COLREGS 6
Wind Direction
degrees
SOLAS V/34
Barometer
hPa
SOLAS V/34
Air Temperature
°C
SOLAS V/34, MLC 3.1
Humidity
%
MLC 3.1
Engine RPM
rpm
ISM 10.1, Classification
Oil Pressure
PSI
ISM 10.1, MARPOL I
Coolant Temp
°C
ISM 10.1
Exhaust Temp
°C
ISM 10.1, MARPOL VI
Fuel Rate
L/h
SOLAS V/34, MARPOL VI
Fuel Level
litres
SOLAS V/34
Fresh Water
litres
MLC 3.1
Black Water
litres
MARPOL IV (Reg. 11)
Grey Water
litres
MARPOL IV
Battery Voltage
V
SOLAS II-1/25-26
System Integration

Nine systems. One command interface.

NCoDE connects to the vessel's existing systems and aggregates their data into a single auditable platform. No rip-and-replace - it works with what you have.

NMEA 2000

WebSocket

Navigation, engine, environmental, and tank sensor telemetry for operational safety compliance

NMEA 0183

Serial, via adapter

Legacy navigation instruments bridged into the same unified data model as NMEA 2000

Modbus

TCP / RTU

Engine, tank, and electrical telemetry from PLCs and industrial controllers

J1939

CAN bus

Engine and transmission data from commercial diesel machinery

RS485

Serial

Vibration, stress, and motion sensors for structural and machinery condition monitoring

LDAP Directory

LDAP / LDAPS

Crew identity, roles, permissions, and certification tracking for access control compliance

Wazuh SIEM

REST API

Vulnerability scanning, security alerts, and agent monitoring for cyber security compliance

CCTV / RTSP

RTSP / WebRTC

Video surveillance streams for lookout requirements and ISPS security monitoring

NCoDE Database

Embedded Storage

Persistent compliance records, audit logs, and configurations for inspection readiness

Evidence Ready Before the Inspection

NCoDE Command generates the evidence that USCG examiners, flag state inspectors, port state control officers, and classification society surveyors expect to see. Every action is logged. Every control is traceable. Every document is versioned. When the inspector arrives, your compliance evidence is already waiting.

Who Needs This

Compliance is every stakeholder's problem.

NCoDE serves every role in the maritime compliance chain - from the master on the bridge to the DPA in the shore office.

Vessel Operators

Single platform for operational safety, cyber compliance, and crew management

Cyber Security Officers

Complete cyber risk management with vulnerability scanning and incident response

Designated Person Ashore

ISM compliance evidence, audit logs, and document control from one system

Inspectors & Surveyors

Audit-ready evidence for every regulatory framework in a structured, exportable format

Compliance Management From Ashore

Compliance work does not have to fall to the crew. NCoDE Command gives the designated person and the compliance team the tools to submit regulatory reports, approve patches and changes, review vendor access logs, manage crew training certificates, and prepare for audits, with the record held on the vessel where an inspector will ask for it — all from the shore office. The crew focuses on safe vessel operations while compliance is managed remotely.

Ready to be audit-ready?

NCoDE Command maps every sensor, every widget, and every module to the regulation it helps you satisfy. One platform. Four frameworks. Complete compliance evidence.

Request a Demo See Product Overview

Background reading

The regulation, the context and the practical detail behind this product.

Background
USCG 33 CFR 101 Cyber Compliance →
Background
NIS2 Maritime Compliance →
Background
IACS UR E26 and E27 Cyber Resilience →
Background
Maritime Cyber Risk Assessment →
Full range
The NCoDE product suite →