Incident Severity Matrix
This guide provides a classification framework for cyber incidents based on their impact on essential services, enabling rapid triage and ensuring the correct response procedures are activated at the right urgency level. Under IACS UR E26 §4.4.1, the vessel’s incident response plan must define severity levels and the escalation triggers for each.
Not every anomaly is a cyber attack. A failing sensor or a loose Ethernet cable can trigger a “Device Down” alert. The ETO’s first job is triage — determining if the event is a technical failure, a suspicious event, or a confirmed attack — and assigning the correct severity level before activating the Respond Phase.
The 3-tier severity scale
In alignment with IACS UR E26 §4.4.1 and IMO MSC.428(98), incidents are categorised based on their impact on essential services — propulsion, steering, navigation, and power management.
- Single non-critical workstation failure
- Suspected virus isolated to crew Wi-Fi
- Single application crash with no spread
- Anomalous log entry with no follow-on activity
- Hardware failure with no cyber indicators
- No impact on propulsion, steering, or navigation
- No impact on PMS or safety systems
- Administrative inconvenience only
- No crew safety risk
- ETO investigates and documents
- Master notification at ETO discretion
- Log entry in Incident Register
- Monitor for 24 hours for escalation
- DPA notification not required at this level
- Unauthorised rogue device in ECR or bridge network
- Partial loss of monitoring or alarm data
- Unusual outbound traffic from OT zone
- Admin login in audit log at unexpected time
- Repeated failed authentication on CBS
- Multiple systems with minor anomalies simultaneously
- Degraded monitoring visibility
- Vessel operationally safe at present
- Risk of escalation to Level 3 is elevated
- No immediate maneuverability impact
- ETO notifies Master immediately
- DPA notified within 30 minutes
- Increased monitoring frequency
- Preserve all logs — do not overwrite
- Prepare isolation procedures for activation
- Reassess every 30 minutes
- Ransomware screen or active encryption detected
- Loss of ECDIS, propulsion control, or PMS
- Confirmed lateral movement across VLANs
- Active command-and-control traffic from OT zone
- Configuration files modified without MoC authorisation
- Golden Image or backup drives targeted or encrypted
- Immediate safety risk to vessel
- Potential loss of maneuverability
- Risk of blackout or navigation loss
- Manual fallback activation likely required
- Master immediately informed
- DPA notified immediately via out-of-band channel
- Master authorises network isolation
- Manual fallback activated for all Cat III systems
- Class notification per SCSRP §6.1.4
- Shore-side incident response team engaged
Decision tree — is it a cyber attack?
If you observe an anomaly, work through these five questions in order. If any answer is yes, escalate to at least Level 2 immediately.
Multiple simultaneous failures?
Did multiple unrelated systems fail at the same time? Simultaneous failures across zones are the strongest indicator of lateral movement. A single failure is probably technical. Multiple simultaneous failures almost certainly are not. → Level 2 minimum
Unexplained login activity in audit logs?
Are there log entries for administrator login, configuration changes, or remote access sessions when no authorised personnel were working on the system? Check the last 24 hours of syslog. → Level 2 minimum
Configuration files changed without a MoC entry?
Are any CBS configuration files dated more recently than the last authorised change in the MoC log? Unexplained configuration changes are a direct indicator of unauthorised access or malware activity. → Level 2 or Level 3
Ransom demand, encrypted files, or locked screens?
Any screen displaying a payment demand, any files that cannot be opened and were not recently modified by authorised personnel, or any system locked with an unfamiliar password. → Level 3 immediately
Essential services affected?
Is ECDIS, propulsion control, PMS, steering, or fire detection behaving unexpectedly and the cause cannot be confirmed as purely technical within 15 minutes? → Level 3 immediately — notify Master now
Reporting rule — “When in doubt, shout”
If you cannot definitively rule out a cyber attack within 15 minutes, declare a Level 2 incident to the Master. It is safer to stand down a false alarm than to delay the isolation of a real threat. A missed Level 3 that was held at Level 1 for an hour is a Class finding — and potentially a safety incident.
Escalation and notification matrix
The following table summarises who must be notified at each severity level and within what timeframe. All notifications must be logged with the exact time and channel used.
Audit evidence preparation
Class surveyors will ask to see your Incident Log. Even with zero confirmed attacks, you must demonstrate active recording of near-misses and technical anomalies assessed under this framework. The absence of any log entries is itself a finding — it suggests the framework is not being used.
- Level 1 evidence example: A log entry showing “Faulty switch port replaced on bridge VLAN — assessed as hardware fault, no cyber indicators, closed at Level 1 — ETO sign-off with date and time.”
- Level 2 evidence example: A log entry showing “Rogue device detected on ECR switch port 14 — assessed Level 2, Master notified at [time], device removed, syslog exported, no escalation — closed after 2-hour monitoring period.”
- Contact details current: The ETO must have current emergency contact details for the CSO, DPA, and shore-side SOC or IT support — accessible via a non-digital backup method if the network is compromised.
- Severity matrix familiarity: Class may ask the ETO or Officer of the Watch to describe what constitutes a Level 2 vs Level 3 incident. This is a knowledge check — not just a paper check. Crew awareness training should include a scenario walk-through using this matrix.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
