IMO cyber security requirements
for every ship — explained.
MSC-FAL.1/Circ.3 is not a voluntary guideline for new ships. It is the implementation framework behind Resolution MSC.428(98) — a mandatory requirement under the ISM Code that has applied to every SOLAS vessel since 1 January 2021. Here is exactly what it requires and how to satisfy it.
ISM ships since Jan 1
4 April 2025
required in your SMS
enforceable — can detain
Resolution MSC.428(98) requires that all companies with ships under the ISM Code incorporate cyber risk management into their Safety Management System (SMS) by the first annual Document of Compliance (DOC) verification after 1 January 2021. If your SMS does not address cyber risk, your vessel is non-compliant right now. IACS UR E26 applies only to newbuilds — this resolution applies to every ship under SOLAS.
Why the regulatory timeline matters
Maritime cyber compliance did not arrive as a single regulation — it evolved over seven years across multiple IMO resolutions and IACS unified requirements, each building on the last.
The timeline shows how MSC-FAL.1/Circ.3 (voluntary guidance, 2017) became the foundation for MSC.428(98) (mandatory SMS integration, enforced from January 2021), which then informed the IACS UR E26 and E27 technical standards that became mandatory for newbuilds contracted from 1 July 2024.
The most important practical point: MSC.428(98) applies to every SOLAS vessel today regardless of build year. IACS UR E26 applies only to newbuilds contracted on or after 1 July 2024. These are two separate compliance obligations with different scopes, different enforcement mechanisms, and different timelines — and confusing one for the other is one of the most common mistakes in maritime cyber compliance planning.
<< Click the diagram to expand at full resolution.
Two documents you need to know
Most shipping professionals confuse the resolution and the circular. They are two separate documents that work together — the resolution creates the obligation, the circular provides the implementation guidelines.
Resolution MSC.428(98)
Adopted by the Maritime Safety Committee in June 2017. This resolution creates the legal obligation — it requires all ISM-certified companies to address cyber risks within their existing SMS. It is enforced via the ISM Code audit process and Port State Control. This is the document that makes compliance mandatory.
Mandatory — ISM CodeMSC-FAL.1/Circ.3/Rev.3 (4 April 2025)
The companion circular that provides the implementation guidelines — the “how.” It defines six functional elements (Govern, Identify, Protect, Detect, Respond, Recover) that must be addressed in your SMS. Rev.3 was approved by MSC 108 (May 2024) and FAL 49 (March 2025), with the final circular dated 4 April 2025.
High-level guidelinesWhich vessels does this apply to?
The resolution applies broadly to all vessels that fall under the ISM Code. If your company holds a Document of Compliance (DOC) and your vessels have Safety Management Certificates (SMC), this applies to you — regardless of flag state, vessel age, or Class society.
The six functional elements — and how to satisfy them
MSC-FAL.1/Circ.3/Rev.3 §3.5 defines six functional elements that must be addressed within your SMS cyber risk programme. These are high-level principles — the circular explicitly states they are not sequential and should be concurrent and continuous. For each element, we list what the circular actually says and link to the TAGSIA playbooks that implement it.
Establish and monitor risk management strategy, expectations and policies. Define personnel roles and responsibilities. Ensure business continuity including backup management, disaster recovery, and crisis management.
- §3.5.1.1 — Designate a person or entity accountable for planning, resourcing and execution of cybersecurity activities
- §3.5.1.2 — Ensure the designated person has the necessary authority, support, knowledge and expertise in cyber risk management
Determine the current cyber risk to ships and ship/port interfaces by identifying systems, assets, interdependencies and carrying out a risk assessment.
- §3.5.2.1 — Identify systems, assets, services, data and capabilities whose disruption poses risks to ship operations, human safety, or the environment — including software and hardware supply chains
- §3.5.2.2 — Establish and maintain an inventory of digital systems on board. Identify internal and external system dependencies and network connections
- §3.5.2.3 — Carry out a risk assessment of critical systems. Identify cyber-related threats and vulnerabilities. Assess likelihood and impact of a cyber incident on safety, availability, integrity and confidentiality
Implement risk control processes and measures to protect CBSs and ensure business continuity of shipping operations, human safety, and safety of the vessel.
- §3.5.3.1 — Unique credentials for all users. Separate user and privileged accounts. Deactivate accounts for departing users
- §3.5.3.2 — Change all default passwords. Enforce a strong password policy. Consider MFA or continuous authentication. Secure communications systems
- §3.5.3.3 — Limit exploitable internet services. Hardware and software approval process. Securely store logs for intrusion detection. Segment OT networks from IT networks
- §3.5.3.4 — Security measures (firewall, antivirus) for systems with internet or intranet access. Cryptography policies and procedures
- §3.5.3.5 — Controls to protect systems from unauthorised removable media
- §3.5.3.6 — Mandatory annual basic cybersecurity training for all employees. OT-specific training for OT users. Cybersecurity familiarisation for all crew on engagement. Knowledge testing through drills and exercises
- §3.5.3.7 — Regular system backups, software updates, and incident response plan development and maintenance
- §3.5.3.8 — Software and hardware supply chain security policies for critical systems
- §3.5.3.9 — Policies to assess effectiveness of cyber risk measures through audits and periodic review
Develop, implement and practise activities necessary to detect a cyber incident in a timely manner. Implement measures to detect unintended activity on CBS.
- §3.5.4.1 — Maintain a list of relevant threats, threat actor tactics, techniques and procedures. Actively monitor systems for those threats
- §3.5.4.2 — Annual basic cybersecurity training for all employees should include training on recognising and detecting an ongoing cyber incident
Develop, implement and practise activities and plans to provide resilience and restore systems necessary for shipping operations impaired by a cyber incident.
- §3.5.5.1 — Report incidents to necessary parties within required time frames as defined by the Administration
- §3.5.5.2 — Records of cyber incidents should be kept
- §3.5.5.3 — Annual basic cybersecurity training for all employees should include training on responding to a cyber incident
Identify and implement measures to restore onboard CBS and networks necessary for shipping operations impacted by a cyber incident.
- §3.5.6.1 — Develop, maintain and implement strategies for recovery and reinstatement of essential or mission-critical assets and systems impacted by a cyber incident
- §3.5.6.2 — Annual basic cybersecurity training for all employees should include training on recovering from a cyber incident
- §3.5.6.3 — Carry out root cause analysis of cyber incidents to resolve underlying issues and prevent similar recurrence
The cyber annex your SMS needs
The circular does not require a separate Cyber Security Management System — it requires cyber risk management incorporated into your existing SMS. The table below shows the practical SMS elements that satisfy the circular’s functional elements, with the correct section references from Rev.3.
| SMS element required | Circular reference | TAGSIA resource |
|---|---|---|
| Designated cyber responsible person with authority and expertise | §3.5.1.1 / §3.5.1.2 | Roles & MoC → |
| CBS asset inventory with system interdependencies | §3.5.2.1 / §3.5.2.2 | Asset Inventory Guide → |
| Cyber risk assessment of critical systems | §3.5.2.3 | Risk Assessment Guide → |
| Unique credentials and account management procedure | §3.5.3.1 / §3.5.3.2 | Password Policy & RBAC → |
| OT/IT network segmentation | §3.5.3.3 | Network Segmentation → |
| Removable media control procedure | §3.5.3.5 | USB Protection → |
| Annual crew cybersecurity training programme with drills | §3.5.3.6 | Crew Cyber Awareness → |
| System backup and incident response plan | §3.5.3.7 | Configuration Backups → |
| Supply chain security policy for critical systems | §3.5.3.8 | Supply Chain Security → |
| Threat monitoring and detection activities | §3.5.4.1 | Traffic Baselining → |
| Incident reporting procedure (to Administration within required timeframes) | §3.5.5.1 | Shore Reporting → |
| Cyber incident log / records | §3.5.5.2 | Incident Severity Matrix → |
| Recovery strategy for critical systems | §3.5.6.1 | Golden Image Management → |
| Root cause analysis procedure for cyber incidents | §3.5.6.3 | Post-Incident Debriefing → |
What Port State Control inspectors look for
PSC officers increasingly include cyber security checks as part of ISM Code inspections. The following are the most commonly cited deficiencies.
No cyber risk section in the SMS
The single most common finding. Many vessels have updated their SMS for other requirements but have never added a cyber risk element. An inspector asks to see the cyber section — if there isn’t one, it is an immediate ISM non-conformity.
No CBS inventory or it is outdated
Inspectors ask to see the digital systems inventory required by §3.5.2.2. If it cannot be produced, or was last updated years ago, this is a deficiency. The inventory must be current and include system interdependencies.
No designated responsible person
§3.5.1.1 requires a designated person accountable for cybersecurity activities. If the company cannot identify who is responsible, and demonstrate their authority and competence, this is a governance deficiency.
No crew training records
§3.5.3.6 requires annual basic cybersecurity training for all employees and familiarisation for all crew on engagement. Inspectors ask to see training records. A policy that exists but has never been executed is a deficiency.
Default or shared credentials on OT systems
§3.5.3.1 and §3.5.3.2 require unique credentials and elimination of default passwords. During onboard checks, inspectors have begun checking for shared “admin” accounts on bridge and ECR workstations.
No incident response procedure
§3.5.5.1 requires procedures for reporting incidents within required timeframes. The procedure must be accessible to the Master and ETO at sea without internet access, and crew must be able to demonstrate familiarity with it.
Frequently asked questions
Start implementing MSC-FAL.1/Circ.3 today
64 free playbooks — all tagged with the functional elements they satisfy. No consultant required.
