No. 15 of 2020 - MARITIME CYBER RISK MANAGEMENT

No. 15 of 2020 - MARITIME CYBER RISK MANAGEMENT

Published 13 Aug 2020

MARITIME AND PORT AUTHORITY OF SINGAPORE

SHIPPING CIRCULAR

NO. 15 OF 2020

MPA Shipping Division

460 Alexandra Road

21st Storey PSA Building

Singapore 119963

Fax: 6375 6231

http://www.mpa.gov.sg

13 Aug 2020

Applicable to: Shipowners, ship managers, operators, and masters of Singapore-

registered ships subjected to the ISM Code, and MPA’s Recognised Organisations

(ROs).

MARITIME CYBER RISK MANAGEMENT

1. This circular provides information on the requirement to incorporate maritime

cyber risk management in the safety management systems (SMS) of companies

operating Singapore-registered ships.

1. Cyber risk management refers to the process of identifying, analysing,

assessing, and communicating a cyber-related risk and accepting, avoiding,

transferring, or mitigating it to an acceptable level, considering costs and benefits of

actions taken to stakeholders.

1. Maritime cyber risk refers to a measure of the extent to which a technology

asset is threatened by a potential circumstance or event, which may result in shipping-

related operational, safety or security failures as a consequence of information or

systems being corrupted, lost or compromised. The goal of maritime cyber risk

management is to support safe and secure shipping, which is operationally resilient to

cyber risks.

1. As affirmed in Resolution MSC.428(98)1 (see Annex A), an approved SMS

should take into account cyber risk management in accordance with the objectives

and functional requirements of the ISM Code2, MPA will require cyber risks to be

appropriately addressed in the company’s SMS no later than the first annual

verification of the ISM company's Document of Compliance after 1 January 2021.

1. In line with the guidance presented in MSC-FAL.1/Circ.3 (see Annex B), to

consider cyber risks as being appropriately addressed in SMS, the ISM company is

required to demonstrate that they have appropriately incorporated the five functional

elements to address maritime cyber risks, namely:

1 The adoption of Resolution MSC.428(98) by the IMO was informed in Shipping Circular No. 14 of

2018, Para 5(h).

2 The International Management Code for the Safe Operation of Ships and for Pollution Prevention.

Page 1 of 2

a. Identify: Define personnel roles and responsibilities for cyber risk

management and identify the systems, assets, data and capabilities that, when

disrupted, pose risks to ship operations;

b. Protect: Implement risk control processes and measures, and

contingency planning to protect against a cyber-event and ensure continuity of

shipping operations;

c. Detect: Develop and implement activities necessary to detect a cyber-

event in a timely manner;

d. Respond: Develop and implement activities and plans to provide

resilience and to restore systems necessary for shipping operations or services

impaired due to a cyber-event; and

e. Recover: Identify measures to back-up and restore cyber systems

necessary for shipping operations impacted by a cyber-event.

1. ISM companies of Singapore-registered ships are reminded to review the

identified risks to its ships, personnel and the environment and to establish appropriate

safeguards to ensure that maritime cyber risks are appropriately addressed in the

SMS, and that the five functional elements stated in para 5 have been incorporated

into their risk management framework.

1. MPA has co-funded several maritime cyber security courses under Maritime

Cluster Fund and Training@MaritimeSingapore. MPA is also aware that Recognised

Organisations (ROs) have developed maritime cyber security training courses and

relevant consultancy services to assist ISM Companies in developing and preparing

their cyber risk management strategy and procedures. Companies may visit

www.mpa.gov.sg or approach the ROs for more information on such training and

services.

1. Any queries relating to this shipping circular should be directed to Mr Damien

Ng (email: damien_ng@mpa.gov.sg, tel: (65) 6375 1756) and Mr Zahir Abutalib

(email: zahir_abutalib@mpa.gov.sg, tel: (65) 6375 1826).

GOH CHUNG HUN

DIRECTOR OF MARINE

MARITIME AND PORT AUTHORITY OF SINGAPORE

Annex A – Resolution MSC.428(98): Maritime cyber risk management in safety

management systems

Annex B – MSC-FAL.1/Circ.3: Guidelines on maritime cyber risk management

Page 2 of 2

MSC 98/23/Add.1

Annex 10, page 1

ANNEX 10

RESOLUTION MSC.428(98)

(adopted on 16 June 2017)

MARITIME CYBER RISK MANAGEMENT IN SAFETY MANAGEMENT SYSTEMS

THE MARITIME SAFETY COMMITTEE,

RECOGNIZING the urgent need to raise awareness on cyber risk threats and vulnerabilities

to support safe and secure shipping, which is operationally resilient to cyber risks,

RECOGNIZING ALSO that Administrations, classification societies, shipowners and ship

operators, ship agents, equipment manufacturers, service providers, ports and port facilities,

and all other maritime industry stakeholders should expedite work towards safeguarding

shipping from current and emerging cyber threats and vulnerabilities,

BEARING IN MIND MSC-FAL.1/Circ.3 on Guidelines on maritime cyber risk management

approved by the Facilitation Committee, at its forty-first session (4 to 7 April 2017), and by the

Maritime Safety Committee, at its ninety-eighth session (7 to 16 June 2017), which provides

high-level recommendations for maritime cyber risk management that can be incorporated into

existing risk management processes and are complementary to the safety and security

management practices established by this Organization,

RECALLING resolution A.741(18) by which the Assembly adopted the International

Management Code for the Safe Operation of Ships and for Pollution Prevention (International

Safety Management (ISM) Code) and recognized, inter alia, the need for appropriate

organization of management to enable it to respond to the need of those on board ships to

achieve and maintain high standards of safety and environmental protection,

NOTING the objectives of the ISM Code which include, inter alia, the provision of safe practices

in ship operation and a safe working environment, the assessment of all identified risks to

ships, personnel and the environment, the establishment of appropriate safeguards, and the

continuous improvement of safety management skills of personnel ashore and aboard ships,

1 AFFIRMS that an approved safety management system should take into account

cyber risk management in accordance with the objectives and functional requirements of

the ISM Code;

2 ENCOURAGES Administrations to ensure that cyber risks are appropriately

addressed in safety management systems no later than the first annual verification of the

company's Document of Compliance after 1 January 2021;

3 ACKNOWLEDGES the necessary precautions that could be needed to preserve the

confidentiality of certain aspects of cyber risk management;

4 REQUESTS Member States to bring this resolution to the attention of all stakeholders.

***

I:\MSC\98\MSC 98-23-Add-1.docx

E

4 ALBERT EMBANKMENT

LONDON SE1 7SR

Telephone: +44 (0)20 7735 7611 Fax: +44 (0)20 7587 3210

MSC-FAL.1/Circ.3

5 July 2017

GUIDELINES ON MARITIME CYBER RISK MANAGEMENT

1 The Facilitation Committee, at its forty-first session (4 to 7 April 2017), and the

Maritime Safety Committee, at its ninety-eighth session (7 to 16 June 2017), having considered

the urgent need to raise awareness on cyber risk threats and vulnerabilities, approved the

Guidelines on maritime cyber risk management, as set out in the annex.

2 The Guidelines provide high-level recommendations on maritime cyber risk

management to safeguard shipping from current and emerging cyberthreats and

vulnerabilities. The Guidelines also include functional elements that support effective cyber

risk management.

3 Member Governments are invited to bring the contents of this circular to the attention

of all stakeholders concerned.

4 This circular supersedes the interim guidelines contained in MSC.1/Circ.1526.

***

I:\CIRC\MSC-FAL\1\MSC-FAL 1-Circ 3.docx

MSC-FAL.1/Circ.3

Annex, page 1

ANNEX

GUIDELINES ON MARITIME CYBER RISK MANAGEMENT

1 INTRODUCTION

1.1 These Guidelines provide high-level recommendations for maritime cyber risk

management. For the purpose of these Guidelines, maritime cyber risk refers to a measure of

the extent to which a technology asset is threatened by a potential circumstance or event,

which may result in shipping-related operational, safety or security failures as a consequence

of information or systems being corrupted, lost or compromised.

1.2 Stakeholders should take the necessary steps to safeguard shipping from current and

emerging threats and vulnerabilities related to digitization, integration and automation of

processes and systems in shipping.

1.3 For details and guidance related to the development and implementation of specific

risk management processes, users of these Guidelines should refer to specific Member

Governments' and Flag Administrations' requirements, as well as relevant international and

industry standards and best practices.

1.4 Risk management is fundamental to safe and secure shipping operations. Risk

management has traditionally been focused on operations in the physical domain, but greater

reliance on digitization, integration, automation and network-based systems has created an

increasing need for cyber risk management in the shipping industry.

1.5 Predicated on the goal of supporting safe and secure shipping, which is operationally

resilient to cyber risks, these Guidelines provide recommendations that can be incorporated

into existing risk management processes. In this regard, the Guidelines are complementary to

the safety and security management practices established by this Organization.

2 GENERAL

2.1 Background

2.1.1 Cybertechnologies have become essential to the operation and management of

numerous systems critical to the safety and security of shipping and protection of the marine

environment. In some cases, these systems are to comply with international standards and

Flag Administration requirements. However, the vulnerabilities created by accessing,

interconnecting or networking these systems can lead to cyber risks which should be

addressed. Vulnerable systems could include, but are not limited to:

.1 Bridge systems;

.2 Cargo handling and management systems;

.3 Propulsion and machinery management and power control systems;

.4 Access control systems;

.5 Passenger servicing and management systems;

.6 Passenger facing public networks;

.7 Administrative and crew welfare systems; and

.8 Communication systems.

I:\CIRC\MSC-FAL\1\MSC-FAL 1-Circ 3.docx

MSC-FAL.1/Circ.3

Annex, page 2

2.1.2 The distinction between information technology and operational technology systems

should be considered. Information technology systems may be thought of as focusing on the

use of data as information. Operational technology systems may be thought of as focusing on

the use of data to control or monitor physical processes. Furthermore, the protection of

information and data exchange within these systems should also be considered.

2.1.3 While these technologies and systems provide significant efficiency gains for the

maritime industry, they also present risks to critical systems and processes linked to the

operation of systems integral to shipping. These risks may result from vulnerabilities arising

from inadequate operation, integration, maintenance and design of cyber-related systems, and

from intentional and unintentional cyberthreats.

2.1.4 Threats are presented by malicious actions (e.g. hacking or introduction of malware)

or the unintended consequences of benign actions (e.g. software maintenance or user

permissions). In general, these actions expose vulnerabilities (e.g. outdated software or

ineffective firewalls) or exploit a vulnerability in operational or information technology. Effective

cyber risk management should consider both kinds of threat.

2.1.5 Vulnerabilities can result from inadequacies in design, integration and/or maintenance

of systems, as well as lapses in cyberdiscipline. In general, where vulnerabilities in operational

and/or information technology are exposed or exploited, either directly (e.g. weak passwords

leading to unauthorized access) or indirectly (e.g. the absence of network segregation), there

can be implications for security and the confidentiality, integrity and availability of information.

Additionally, when operational and/or information technology vulnerabilities are exposed or

exploited, there can be implications for safety, particularly where critical systems (e.g. bridge

navigation or main propulsion systems) are compromised.

2.1.6 Effective cyber risk management should also consider safety and security impacts

resulting from the exposure or exploitation of vulnerabilities in information technology systems.

This could result from inappropriate connection to operational technology systems or from

procedural lapses by operational personnel or third parties, which may compromise these

systems (e.g. inappropriate use of removable media such as a memory stick).

2.1.7 Further information regarding vulnerabilities and threats can be found in the additional

guidance and standards referenced in section 4.

2.1.8 These rapidly changing technologies and threats make it difficult to address these

risks only through technical standards. As such, these Guidelines recommend a risk

management approach to cyber risks that is resilient and evolves as a natural extension of

existing safety and security management practices.

2.1.9 In considering potential sources of threats and vulnerabilities and associated risk

mitigation strategies, a number of potential control options for cyber risk management should

also be taken into consideration, including amongst others, management, operational or

procedural, and technical controls.

2.2 Application

2.2.1 These Guidelines are primarily intended for all organizations in the shipping industry,

and are designed to encourage safety and security management practices in the cyberdomain.

I:\CIRC\MSC-FAL\1\MSC-FAL 1-Circ 3.docx

MSC-FAL.1/Circ.3

Annex, page 3

2.2.2 Recognizing that no two organizations in the shipping industry are the same, these

Guidelines are expressed in broad terms in order to have a widespread application. Ships with

limited cyber-related systems may find a simple application of these Guidelines to be sufficient;

however, ships with complex cyber-related systems may require a greater level of care and

should seek additional resources through reputable industry and Government partners.

2.2.3 These Guidelines are recommendatory.

3 ELEMENTS OF CYBER RISK MANAGEMENT

3.1 For the purpose of these Guidelines, cyber risk management means the process of

identifying, analysing, assessing, and communicating a cyber-related risk and accepting,

avoiding, transferring, or mitigating it to an acceptable level, considering costs and benefits of

actions taken to stakeholders.

3.2 The goal of maritime cyber risk management is to support safe and secure shipping,

which is operationally resilient to cyber risks.

3.3 Effective cyber risk management should start at the senior management level. Senior

management should embed a culture of cyber risk awareness into all levels of an organization

and ensure a holistic and flexible cyber risk management regime that is in continuous operation

and constantly evaluated through effective feedback mechanisms.

3.4 One accepted approach to achieve the above is to comprehensively assess and

compare an organization's current, and desired, cyber risk management postures. Such a

comparison may reveal gaps that can be addressed to achieve risk management objectives

through a prioritized cyber risk management plan. This risk-based approach will enable an

organization to best apply its resources in the most effective manner.

3.5 These Guidelines present the functional elements that support effective cyber risk

management. These functional elements are not sequential – all should be concurrent and

continuous in practice and should be incorporated appropriately in a risk management

framework:

.1 Identify: Define personnel roles and responsibilities for cyber risk

management and identify the systems, assets, data and capabilities that,

when disrupted, pose risks to ship operations.

.2 Protect: Implement risk control processes and measures, and contingency

planning to protect against a cyber-event and ensure continuity of shipping

operations.

.3 Detect: Develop and implement activities necessary to detect a cyber-event

in a timely manner.

.4 Respond: Develop and implement activities and plans to provide resilience

and to restore systems necessary for shipping operations or services

impaired due to a cyber-event.

.5 Recover: Identify measures to back-up and restore cyber systems necessary

for shipping operations impacted by a cyber-event.

I:\CIRC\MSC-FAL\1\MSC-FAL 1-Circ 3.docx

MSC-FAL.1/Circ.3

Annex, page 4

3.6 These functional elements encompass the activities and desired outcomes of

effective cyber risk management across critical systems affecting maritime operations and

information exchange, and constitute an ongoing process with effective feedback mechanisms.

3.7 Effective cyber risk management should ensure an appropriate level of awareness of

cyber risks at all levels of an organization. The level of awareness and preparedness should

be appropriate to roles and responsibilities in the cyber risk management system.

4 BEST PRACTICES FOR IMPLEMENTATION OF CYBER RISK MANAGEMENT

4.1 The approach to cyber risk management described herein provides a foundation for

better understanding and managing cyber risks, thus enabling a risk management approach

to address cyberthreats and vulnerabilities. For detailed guidance on cyber risk management,

users of these Guidelines should also refer to Member Governments' and Flag Administrations'

requirements, as well as relevant international and industry standards and best practices.

4.2 Additional guidance and standards may include, but are not limited to:1

.1 The Guidelines on Cyber Security Onboard Ships produced and supported

by BIMCO, CLIA, ICS, INTERCARGO, INTERTANKO, OCIMF and IUMI.

.2 ISO/IEC 27001 standard on Information technology – Security techniques –

Information security management systems – Requirements. Published jointly

by the International Organization for Standardization (ISO) and the

International Electrotechnical Commission (IEC).

.3 United States National Institute of Standards and Technology's Framework

for Improving Critical Infrastructure Cybersecurity (the NIST Framework).

4.3 Reference should be made to the most current version of any guidance or standards

utilized.

___________

1 The additional guidance and standards are listed as a non-exhaustive reference to further detailed

information for users of these Guidelines. The referenced guidance and standards have not been issued by

the Organization and their use remains at the discretion of individual users of these Guidelines.

I:\CIRC\MSC-FAL\1\MSC-FAL 1-Circ 3.docx