A cyber security manual for ships is not a document to show auditors; it is what the crew and shore staff open and follow when something actually goes wrong. With cyber risk now part of the Safety Management System (SMS), here are the items every manual and incident response procedure should contain. For the overall picture, start with our maritime cyber security guide for ships.
1. Define scope and responsibilities first
- Scope: state clearly which of the business network, crew welfare network and navigation / engine (OT) zones the manual covers.
- Responsibilities: list the person in charge on board (for example the master or a designated officer), the shore contact and outside vendors, with roles and contact details in a table.
- Related documents: note where the asset inventory, network diagram and firewall policy documents are kept.
2. Day-to-day rules
- Accounts and passwords: limits on shared accounts, changing default passwords, and how credentials are handed over at crew change
- Removable media: when USB devices are allowed and how they are scanned
- Updates and backups: update cycles for operating systems and antivirus, what is backed up and where, and how often recovery is tested
- Remote access: approval and termination of vendor remote sessions, and how they are recorded
3. The core steps of incident response
- 1. Detect and report: who reports warning signs (screen alerts, encrypted files, unusual traffic) to whom, and how
- 2. Isolate: first actions to stop the spread, such as unplugging the network cable of a suspect PC. Navigation and engine equipment is not switched off ad hoc but handled by procedure
- 3. Assess: which equipment and which work are affected, and the impact on safe navigation
- 4. Recover: the order of restoring from backup, how to verify it, and checks for reinfection afterwards
- 5. Record and report: a timeline, reporting criteria for the company and authorities, and measures to prevent recurrence
4. Writing it for life at sea
- Short and specific: write each step in a line or two so the crew can follow it alone, even when the satellite link is down.
- Offline copies: keep printed copies of the manual and contact list on the bridge and in the ship's office in case PCs stop working.
- Equipment checklists: make one-page checklists for the equipment that causes most trouble, such as the firewall, office PCs and e-mail. For firewall policy management, see vessel firewall (UTM).
5. Drills and revisions
- A manual only works once it has been tested in drills. Example scenarios are in our ship cyber security drill scenarios.
- Revise it regularly with lessons from drills and real incidents, and keep a revision history.
- If you also need to meet class rules, preparing it together with our IACS UR E26 & E27 checklist lets you build the evidence in one go.
Ocean Connect supports ship cyber security from manual preparation to network segmentation and firewall configuration, endpoint security and drill support. See our vessel cyber security solutions, and contact us via the online inquiry form or our emergency 24-hour helpdesk (+82-70-7588-0611~0612).