ClassNK Revises Ship Cyber Security Guidelines to Match Vetting Schemes

ClassNK has published the second edition of its Guidelines for Cyber Security Management System for Ships. The new edition maps its audit criteria to four major maritime vetting and assessment schemes. The Japanese classification society says it has also clarified its certification requirements, so shipowners and ship managers can use one framework to prepare for several industry assessments.

The revision matters to tanker and dry bulk operators, who face cyber security questions from more than one vetting regime. That includes the large ship management community serving Indian and international fleets.

What has changed in the second edition

The guidelines now keep management requirements separate from the evidence needed to show they have been implemented. They are split into two parts:

• Part 1 sets out the requirements for a Cyber Security Management System (CSMS).
• Part 2 sets out the audit criteria and the supporting evidence auditors will expect.

The framework covers management commitment, responsibilities ashore and onboard, risk assessment, operational controls and incident preparedness. ClassNK has restructured it with reference to the international information security standards ISO/IEC 27001 and ISO/IEC 27002.

The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) develop both standards. ISO/IEC 27001 sets the requirements for an information security management system and lets organisations adapt risk management processes to their size and needs. ISO/IEC 27002 gives guidance on security controls, including access management, personnel security and incident response. Used together, the two link organisational oversight with practical measures to protect information and systems.

Mapped to RISQ, SIRE 2.0, DryBMS and TMSA

ClassNK has mapped its audit criteria against four schemes:

• RISQ: the RightShip Inspection Ship Questionnaire
• SIRE 2.0: the Ship Inspection Report Programme, operated by the Oil Companies International Marine Forum (OCIMF)
• DryBMS: the Dry Bulk Management Standard
• TMSA: Tanker Management and Self Assessment, developed by OCIMF

ClassNK says the mapping should cut the work of interpreting each scheme’s cyber security requirements separately. The guidelines are available on its My Page portal once users register.

Cyber risk as part of ship safety management

The wider regulatory framework treats cyber risk as an operational safety issue. The International Maritime Organization (IMO) says the possible consequences range from compromised information to failures that affect shipping operations, safety and security.

In June 2017, IMO’s Maritime Safety Committee adopted Resolution MSC.428(98). The resolution affirmed that an approved safety management system should address cyber risk in line with the International Safety Management (ISM) Code. It encouraged flag administrations to make sure companies dealt with these risks no later than the first annual verification of their Document of Compliance after 1 January 2021. It also recognised the need to protect confidential information linked to cyber risk management.

IMO’s broader guidance helps companies identify, assess and manage cyber risks within their existing processes, alongside established safety and security practice. This makes cyber security part of routine operational management rather than only an information technology function.

How CSMS certification relates to newbuild rules

Separate technical requirements cover the cyber resilience of ships and onboard equipment. ClassNK has built the International Association of Classification Societies’ (IACS) Unified Requirements E26 and E27 into its rules for computer-based systems and equipment approval.

ClassNK says these provisions apply to ships contracted for construction on or after 1 July 2024. It also publishes interpretation guidance that explains the approval processes and requirements for shipyards, equipment suppliers and shipowners.

CSMS certification looks at how a company’s management system works both ashore and onboard, with safe ship operation as its priority. ClassNK issues separate certification application documents for companies and for ships, because it assesses the organisation’s arrangements and how they are carried out on each vessel.

---

Frequently Asked Questions

1. What has ClassNK changed in its ship cyber security guidelines?
The second edition, announced on 30 October 2026, separates CSMS management requirements (Part 1) from audit criteria and evidence (Part 2). It is restructured with reference to ISO/IEC 27001 and ISO/IEC 27002 and maps its criteria to four major maritime vetting schemes.

2. Which vetting schemes are the guidelines mapped to?
RightShip’s RISQ, OCIMF’s SIRE 2.0, the Dry Bulk Management Standard (DryBMS) and Tanker Management and Self Assessment (TMSA).

3. Is cyber security a mandatory part of ship safety management?
Under IMO Resolution MSC.428(98), approved safety management systems should address cyber risk in line with the ISM Code. Flag administrations were encouraged to make sure companies did so by the first annual Document of Compliance verification after 1 January 2021.

4. What are IACS UR E26 and E27?
They are IACS Unified Requirements covering the cyber resilience of ships (E26) and of onboard systems and equipment (E27). ClassNK has built them into its rules, and it says they apply to ships contracted for construction on or after 1 July 2024.

5. How can shipowners get ClassNK’s revised guidelines?
They are available through ClassNK’s My Page portal after registration.