Compliance has catalysed change and today ship owners are beginning to understand and accept that they will fall behind regulation if they fail to act quickly. However, compliance is not static. It requires ongoing attention and management; it is not a one-off event. Misunderstanding around this is a major issue for cyber security today.
Reinforcing this point, Annex 2 of “The Guidelines on Cyber Security Onboard Ships” sets out the minimum measures that all shipping companies should consider implementing so as to address cyber risk management in an approved Safety Management System. The document sets out 11 areas of measures and actions. 9 out of the 11 recommended areas require continuous actions and proactive vigilance so that the measure is kept up to date.
These include continuous actions that require some investment to implement, such as maintaining up-to-date hardware inventory, software inventory, map of data flows, security audit logs and continuous detection and reporting of non-conformities relating to cyber incidents.
The latest draft of the IACS rules URE26 (Cyber Resilience of Ships), at the time of print, has many similarities. Even more explicitly, E26 sets out how the one-off actions taken during the design, construction and commissioning phases of a new build vessel should be augmented by continuous measures during the operation phase of the vessel. It envisages implementation, annual and special surveys that ensure the measures are up to date throughout the life of the vessel.
Moreover, cyber compliance in shipping has a particular vessel-by-vessel approach to mirror safety and marine engineering regulations. This means that owners can choose compliance on some vessels but not others. A good illustration of this is the UR E26 regulation and the UR E27 regulation, mentioned earlier in this report. As these requirements only apply to new builds from 1 Jan 2024, some shipowners have actively decided to only aim for compliance on some of their vessels.
Choosing to comply for specific vessels, but neglecting others will create several problems, including:
- Inconsistencies In Policy Management:
This will give rise to a range of exceptions that need to be considered, remembered and managed, making maintenance expensive, prone to error and leading to a higher total cost of cyber risk management.
- Misaligned Attitudes To Risk:
Cyber risk is by definition, not geography-specific, and attacks can affect multiple vessels at once. It makes little sense to secure some vessels but not others within a fleet. Research for this report found that there are misaligned attitudes towards risk and compliance.
One tonnage provider told Thetius that, in his view, a misaligned attitude to risk is confusing the role and purpose of regulatory compliance. He said, “Many ship owners are used to tolerating high risks, and this is happening with cyber risk too. For some, the default approach is to meet new rules and standards at the minimum baseline.”
Pursuing compliance with regulations does encourage good behaviour of course, and even a minimum compliance approach can take a great deal of effort. However, threat actors are also aware of the emerging standards and regulations. A minimised approach cannot address cyber risks properly because regulations are very much a starting point and not the final destination. As the tonnage provider concludes, “This seems to be overlooked by some in our industry.”
For a deeper dive into the areas highlighted in this article, take a look at our thought leadership report, produced in collaboration with CyberOwl and HFW, titled “Shifting Tides, Rising Ransoms and Critical Decisions”. This comprehensive report offers insights into the evolving landscape of cyber threats in the maritime industry and explains that there is a new approach towards managing cyber risk. You can download your copy of the report below:
