Cyber risk management in the SMS and the SSP
1The lesson in plain words
Cyber risk is managed in the safety management system. The SSO makes sure security systems and networks are in the assessment and drills.
Cyber risk in the SMS
Resolution MSC.428(98) affirms that an approved safety management system (SMS) should take cyber risk into account under the International Safety Management (ISM) Code. It encouraged flag Administrations to ensure this by the first annual verification of the company's Document of Compliance (DOC) after 1 January 2021. Manage cyber risk through the SMS; the resolution supports implementation of the ISM Code rather than creating a separate mandatory cyber code.
The guidelines
The IMO Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.3 of 4 April 2025, replace earlier versions. They are guidance, not mandatory. They ask companies to set policy and responsibilities and to work through functional elements such as identify, protect, detect, respond and recover. Industry guidance gives the practical detail.
New ships: IACS UR E26 and E27
IACS is the International Association of Classification Societies. Its unified requirements are technical rules applied by member societies. E26 covers the ship's cyber resilience: its ability to keep working or recover after a cyber incident. E27 covers onboard systems and equipment. For ships within their scope, the revised rules apply to construction contracts dated on or after 1 July 2024. Check your ship's class rules for applicability.
Cyber and the SSO
Access control, CCTV, alarms and the SSAS can depend on networks. ISPS Part B lists computer systems and networks among the things the SSA should consider. Make sure your plan says what to do if card access or CCTV fails. Use a cyber incident as a drill scenario, record it, and agree with the company's IT lead how incidents are reported.
Work at the IMO
In June 2025 MSC 110 agreed to develop a non-mandatory, goal-based Maritime Cybersecurity Code, with proposals invited to MSC 111. Development of the new code does not postpone cyber risk management through the SMS. Crew cyber habits are in Security awareness.
2Key data
- Cyber in the SMS
- Flag target: first annual DOC verification after 1 Jan 2021
- IMO guidelines
- MSC-FAL.1/Circ.3/Rev.3, 4 April 2025 (non-mandatory)
- IACS UR E26 / E27
- Covered new ships: construction contracts from 1 July 2024
- IMO work
- MSC 110 (2025): non-mandatory cybersecurity code in development
3Key points
- 1
MSC.428(98) affirms that cyber risk belongs in the SMS under the ISM Code.
- 2
The current IMO guidelines are MSC-FAL.1/Circ.3/Rev.3 (2025).
- 3
For ships within their scope, UR E26/E27 apply to new construction contracts on or after 1 July 2024.
- 4
Include security systems and networks in the SSA, the SSP and drills.
- 5
The proposed IMO cyber code is non-mandatory; existing SMS cyber-risk duties still apply.
4Frequent mistakes
Wrong: Cyber security is an IT matter and has nothing to do with the SMS.
Right: Cyber risk belongs in the SMS under the ISM Code; MSC.428(98) affirms this. The SSO includes security-system failures in the SSA, SSP and drills.
Wrong: IACS UR E26 and E27 apply to every ship in class since 2024.
Right: For ships within their scope, E26/E27 apply to new construction contracts on or after 1 July 2024. Check your ship’s class rules for applicability.
5Practice case & exam keys
At anchor at security level 1, the card-access system for the accommodation fails and all doors unlock. The IT log shows a strange login from the crew Wi-Fi an hour earlier. What do you do as SSO?
Show the answer
Tell the master and CSO. Apply the SSP's fallback access controls while preserving emergency escape. Follow the SMS cyber-incident procedure with the company's IT lead; isolate affected systems only as authorised and safe. Preserve logs and record the incident. Review the SSA, amend the SSP through the approval process if needed, and test the revised arrangements in a drill.
Exam keys
- MSC.428(98) affirms cyber risk in the SMS; flags encouraged to ensure this by the first annual DOC verification after 1 January 2021.
- MSC-FAL.1/Circ.3/Rev.3 (2025): current, non-mandatory IMO guidelines.
- IACS UR E26/E27: ships within their scope; new construction contracts on or after 1 July 2024.
- SSO: networks in the SSA and SSP; cyber scenarios in drills.
Finish this unit
When you've read it, answer three questions. Get all three right to finish the unit; opening the page alone doesn't count.
My notes for this unit
No notes