A merican Club Circular No. 07/19 1 MARCH 4, 2019 CIRCULAR NO. 07/19 TO MEMBERS OF THE ASSOCIATION Dear Member: 2018 THIRD EDITION OF BIMCO GUIDELINES ON CYBER SECURITY ONBOARD SHIPS Members may already be aware of this new edition of the above-captioned maritime industry guide on cyber security. Importantly, this third edition of the BIMCO Guidelines now addresses the requirement to incorporate cyber protection as part of a ship’s safety management system (SMS). The Guidelines are attached, and are downloadable without charge at: https://www.bimco.org/news/priority-news/20181207-industry-publishes-improved-cyber-guidelines It is hoped that this document will assist Members in their appraisal of cyber risk onboard their ships, including ship-to-shore interfaces, and in establishing a culture of cyber risk awareness within their organizations both ashore and afloat. Yours faithfully, Joseph E.M. Hughes, Chairman & CEO Shipowners Claims Bureau, Inc., Managers for THE AMERICAN CLUB THE GUIDELINES ON CYBER SECURITY ONBOARD SHIPS Produced and supported by BIMCO, CLIA, ICS, INTERCARGO, INTERMANAGER, INTERTANKO, IUMI, OCIMF and WORLD SHIPPING COUNCIL v3 The Guidelines on Cyber Security Onboard Ships Version 3 Terms of use The advice and information given in the Guidelines on Cyber Security Onboard Ships (the guidelines) is intended purely as guidance to be used at the user’s own risk. No warranties or representations are given, nor is any duty of care or responsibility accepted by the Authors, their membership or employees of any person, firm, corporation or organisation (who or which has been in any way concerned with the furnishing of information or data, or the compilation or any translation, publishing, or supply of the guidelines) for the accuracy of any information or advice given in the guidelines; or any omission from the guidelines or for any consequence whatsoever resulting directly or indirectly from compliance with, adoption of or reliance on guidance contained in the guidelines, even if caused by a failure to exercise reasonable care on the part of any of the aforementioned parties. THE GUIDELINES ON CYBER SECURITY ONBOARD SHIPS V3CONTeNTS Introduction .....................................................................................................................................1 1 Cyber security and safety management ..........................................................................................3 1.1 Differences between IT and OT systems ..........................................................................................5 1.2 Plans and procedures ......................................................................................................................6 1.3 Relationship between ship manager and shipowner ......................................................................7 1.4 The relationship between the shipowner and the agent ................................................................7 1.5 Relationship with vendors ...............................................................................................................8 2 Identify threats ................................................................................................................................9 3 Identify vulnerabilities ...................................................................................................................13 3.1 Ship to shore interface ..............................................