ClassNK updates ship cyber security management guidelines
Japanese classification society ClassNK has released the second edition of its Guidelines for Cyber Security Management System for Ships, introducing more detailed audit criteria and a framework designed to help shipowners and ship management companies address multiple industry cyber security assessment requirements.
The updated guidelines establish requirements for a Cyber Security Management System (CSMS), covering the management of cyber risks associated with vessel operations. They address both shore-based and onboard responsibilities, including corporate governance, risk assessments, technical safeguards and preparations for cyber security incidents.
ClassNK has revised the document with reference to ISO/IEC 27001 and ISO/IEC 27002, two international standards covering information security management systems and associated security controls. The new edition also clarifies the criteria used by the classification society when conducting CSMS certification audits.
The guidelines are divided into two parts. The first defines the CSMS requirements, while the second specifies the audit criteria and objective evidence needed to demonstrate compliance with each requirement.
This structure is intended to give shipping companies greater visibility into the certification process and help them assess the effectiveness of their existing cyber security arrangements before undergoing an audit.
Alignment with maritime industry assessment schemes
A central change in the second edition is the mapping of ClassNK’s audit criteria to cyber security requirements and benchmarks used by major maritime vetting and management assessment schemes.
These include RightShip’s RISQ inspection questionnaire, the Oil Companies International Marine Forum’s SIRE 2.0 inspection programme, the Dry Bulk Management Standard (DryBMS) and the Tanker Management and Self Assessment (TMSA) framework.
By bringing these requirements into a common CSMS structure, ClassNK aims to help shipping companies address overlapping assessment expectations without having to interpret each scheme independently.
The classification society stated that the revised approach could reduce the administrative effort associated with demonstrating cyber security management practices to different external stakeholders.
Cyber security throughout a vessel’s operating life
ClassNK first published its ship cyber security management guidelines in 2019, drawing on the International Safety Management (ISM) Code framework and the International Maritime Organization’s recommendations for managing maritime cyber risks within ship safety management systems.
Since then, the International Association of Classification Societies (IACS) has introduced unified requirements UR E26 and UR E27, addressing the cyber resilience of ships and onboard systems from the newbuilding stage.
However, ClassNK emphasised that cyber security management must continue throughout a vessel’s service life as software, onboard equipment, operational arrangements and organisational responsibilities change.
The updated guidelines therefore address ongoing practices such as access control, system updates, personnel training and incident response, alongside the technical measures applied to onboard systems.
ClassNK said the second edition draws on experience gained through its CSMS certification audits since 2019, with the objective of making assessment requirements more transparent and supporting consistent implementation across shipping companies.
The new guidelines are available to registered users through the Guidelines section of ClassNK’s My Page online platform.
