30 October 2026 – ClassNK has released the second edition of its ‘Guidelines for Cyber Security Management System for Ships’. Intended for shipowners and ship management companies, the guidelines set out the requirements for a Cyber Security Management System (CSMS), through which a Company addresses the cyber risks associated with ship operations as part of its day-to-day work, from governance and responsibilities ashore and onboard to the technical controls applied to shipboard systems. Just as importantly, the Guidelines make ClassNK’s certification audits transparent by showing the assessment criteria applied in them. In audits, ClassNK looks at the governance behind a company’s cyber security: policy and management commitment, defined roles and responsibilities, risk assessment, implementation and operation of controls, and preparedness for incidents.
The second edition has been restructured with reference to ISO/IEC 27001*1 and ISO/IEC 27002*2, and the assessment criteria for each CSMS requirement have been clarified. The requirements have also been mapped to the cyber security requirements of major vetting schemes. Cyber security is increasingly covered in the external assessments conducted by maritime stakeholders, and many of those requirements focus on how cyber risk is managed. A CSMS certified against these guidelines gives companies an objective means of demonstrating that governance to external stakeholders, and a single foundation for responding to multiple vetting requirements.
Background
The IMO recommends that cyber risks be managed within the Safety Management Systems under the ISM Code. In response, ClassNK published the first edition of the Guidelines in 2019, setting out CSMS requirements built on the framework of the ISM Code, and has since been providing CSMS certification based on the guidelines.
As a collective effort of the International Association of Classification Societies (IACS), the application of IACS UR E26 and E27 has defined the cyber resilience capabilities that ships and their onboard systems must have from the newbuild phase. At the same time, a vessel’s operating environment keeps changing throughout its service life, as the systems are updated and operations and organizations change. Addressing cyber risks is therefore not a matter of technical measures alone; continuous management is essential to select, implement, maintain and review those measures appropriately. In recent years, cyber risk management covering practices such as access control, software updates, education and training, and incident response have also become a part of the assessment criteria as part of the subject to the schemes established by DryBMS, OCIMF, RightShip and others, each with their own criteria.
The first edition offered the elements for establishing a CSMS as a high-level objective, leaving each Company to interpret how to achieve them within its own organization. Putting those elements into practice requires wide efforts across the whole Company, from shore-based organizations to shipboard operations, and time to achieve. Through its audits since 2019, ClassNK has built up practical knowledge of what effective implementation looks like. Drawing on that experience, the second edition makes clear what is verified in audits and has been designed with other external assessments in mind, so that a CSMS built on the guidelines also prepares a company to meet them.
Main revisions
- Clarification of audit criteria, structured with reference to international standardsThe guidelines now consist of two parts: Part 1 sets out the CSMS requirements, and Part 2 specifies the audit criteria and the objective evidence required for each requirement.This allows companies to understand in advance what will be verified in audits and prepare accordingly, and makes it easier to identify where there is room for improvement in their own practices.
- Mapping to external assessment criteria set by major industry bodiesThe assessment criteria in Part 2 have also been mapped against the cyber security requirements or benchmarks of major vetting bodies (covering RISQ, SIRE 2.0, DryBMS and TMSA*3). Rather than interpreting each scheme separately, Companies can use the CSMS as a common framework for meeting them and can expect the reduction of the time and burden needed for compliance.
ClassNK will continue to support cyber security efforts in the maritime industry through the provision of guidelines as well as audits and certification.
How to access guidelines
The guidelines are available to download via “Guidelines” of My Page on ClassNK’s website after registration.
*1 ISO/IEC 27001: Information security management systems
*2 ISO/IEC 27002: Code of practice for information security management
*3 RISQ (RightShip Inspection Ship Questionnaire): A questionnaire used by RightShip in inspections of dry bulk carriers and other vessels
SIRE 2.0 (Ship Inspection Report Programme): A tanker inspection programme operated by OCIMF (Oil Companies International Marine Forum)
DryBMS (Dry Bulk Management Standard): A standard developed by the dry bulk industry to assess the management systems of ship management companies
TMSA (Tanker Management and Self Assessment): A guide developed by OCIMF for tanker operators and managers to self-assess their management systems
Related press release:
ClassNK Releases Cyber Security Management System for Ships
https://www.classnk.or.jp/hp/en/hp_news.aspx?id=3805&type=press_release
