MEMBER ALERT Shipowners Claims Bureau, Inc., Manager One Battery Park Plaza 31 st Fl., New York, NY 10004 USA Tel: +1 212 847 4500 Fax: +1 212 847 4599 www.american-club.com American Club Member Alert – J uly 5, 201 7 1 JULY 5, 2017 GUIDELINES ON CYBER SECURITY ONBOARD SHIPS Members may already have seen this document, but your Managers thought it would be helpful to draw attention to it as an independent initiative. This is the second edition of these Guidelines. They are the result of the work of a joint industry group comprising BIMCO, the Cruise Lines International Association (CLIA), the International Chamber of Shipping (ICS), INTERCARGO, the International Association of Independent Tanker Owners (INTERTANKO), the International Union of Marine Insurance (IUMI) and the Oil Companies International Marine Forum (OCIMF). The Guidelines have also been aligned with the recommendations contained in the International Maritime Organization’s (IMO) guidelines on cyber risk management adopted in June, 2017. The issue of cyber security as it affects shipping has become a matter of growing concern for the maritime community in recent years. It is hoped this document will be useful to Members in providing further background and assistance on the subject. THE GUIDELINES ON CYBER SECURITY ONBOARD SHIPS Produced and supported by BIMCO, CLIA, ICS, INTERCARGO, INTERTANKO, OCIMF and IUMI v2 The Guidelines on Cyber Security Onboard Ships Version 2.0 1 Terms of use The advice and information given in The Guidelines on Cyber Security Onboard Ships (the guidelines) is intended purely as guidance to be used at the user’s own risk. No warranties or representations are given, nor is any duty of care or responsibility accepted by the Authors, their membership or employees of any person, firm, corporation or organisation (who or which has been in any way concerned with the furnishing of information or data, or the compilation or any translation, publishing, or supply of the guidelines) for the accuracy of any information or advice given in the guidelines; or any omission from the guidelines or for any consequence whatsoever resulting directly or indirectly from compliance with, adoption of or reliance on guidance contained in the guidelines, even if caused by a failure to exercise reasonable care on the part of any of the aforementioned parties. Table of contents Introduction 1 1. Cyber security and safety management 2 1.1 Plans and procedures 2 1.2 Defence in depth and in breadth 4 2. Identify threats 6 3. Identify vulnerabilities 10 3.1 Ship to shore interface 11 4. Assess risk exposure 13 4.1 Risk assessment made by the company 18 4.2 Third-party risk assessments 18 4.3 Risk assessment process 19 5. Develop protection and detection measures 21 5.1 Technical protection measures 21 5.2 Procedural protection measures 25 6. Establish contingency plans 31 7. Respond to and recover from cyber security incidents 33 7.1 Effective response 33 7.2 Recovery plan 34 7.3 Investigating cyber incidents 34 7.4 Losses arising from a cyber incident 35 Annex 1. Target systems, equipment and technologies 37 Annex 2. Onboard networks 40 Annex 3. Glossary 44 Annex 4. Organisations and companies behind the guidelines 47 1 Introduction Ships are increasingly using systems that rely on digitisation, integration, and automation, which calls for cyber risk management on board. As technology continues to develop, information technology (IT) and operational technology (OT) onboard shi