What is a maritime OT playbook?

A playbook is a structured, step-by-step procedure written for the people who actually work on the systems — the ETO, Chief Engineer, and bridge officers — not a policy document produced for management review. Each playbook explains the reasoning behind a control, how to implement it in a maritime OT environment, and what evidence it produces. Whether you are working toward IACS UR E26 compliance on a newbuild, implementing IMO MSC-FAL.1 requirements on an existing vessel, or simply trying to understand what good cyber security practice looks like on a ship, the playbooks give you the operational detail that generic frameworks leave out.

The five phases follow the NIST Cybersecurity Framework (CSF v2.0), which underpins IACS UR E26, the Industry Guidelines on Cyber Security Onboard Ships (v5, 2024), and IMO MSC-FAL.1/Circ.3 Rev.3. This means the same work satisfies multiple frameworks simultaneously — an asset inventory produced for E26 §4.1 also satisfies the TMSA 3 Element 13 risk assessment requirement and the BIMCO guidelines’ Identify function. The phases are sequential but not isolated — evidence produced in IDENTIFY feeds directly into PROTECT, and lessons from RECOVER feed back into IDENTIFY at the next review cycle.