System Criticality Mapping
This guide explains how to classify each onboard system as Category I, II or III based on its safety impact, and how to justify those classifications to a Class Surveyor.
Method A: IACS UR E22 Impact Levels
Systems whose failure leads to loss of life, ship, or severe environmental damage.
Systems whose failure could eventually to loss of life, ship, or severe environmental damage.
Systems with no safety impact (e.g., Crew Wi-Fi, Entertainment).
The classification table answers the question Class surveyors ask first: how did you decide which category each system belongs to, and can you justify it?
The most common mistake in CBS categorisation is assigning categories based on the existence of backups rather than the inherent consequence of failure. A fire detection system with a hardwired backup panel is still a Category III system — the backup is the mandatory regulatory response to a high-consequence function, not evidence that the function is less critical. The rule of precedence box in the diagram states this directly because it is the single most frequent categorisation error found during survey preparation.
Category drives everything downstream — the security controls required, the safe state obligations, the backup requirements, and the evidence package needed for Class submission.
<< Click the diagram to expand at full resolution
Method B: DNV Default System under Consideration (SuC)
DNV identifies scope based on Mandatory Functions required for vessel operation.
Efficiency Gain: Minimizes administrative burden by utilizing pre-defined Class benchmarks, bypassing the need for exhaustive manual scoping.
A comprehensive list of all computer-based systems in the default SuC can be found in DNV-CG-0325 (Appendix A).
DNV Negligible Risk Exclusions
To exclude a system from security requirements, a risk assessment must prove negligible cyber risk by meeting these specific criteria.
- Isolation: No IP-network communication or remote access solutions.
- Physical Security: Located in restricted and controlled areas.
- Port Lockdown: No accessible physical interface ports; unused ports logically disabled.
- No External Media: Hardened against USB/External media mounting.
- Criticality Check: Not an integrated control system or required for propulsion/steering.
Surveyor Tip: DNV requires risk assessments (Document F011/F021) to be submitted if you intend to exclude systems or components based on negligible risk.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
