Regulatory & Shore-Side Reporting
This guide covers the external reporting obligations triggered by a cyber incident — who to notify, by when, using what channel, and what information to include. A delayed or incomplete report can result in Port State Control detention, Class findings, or insurance complications. The DPA coordinates external reporting — the ETO provides the technical content.
When the vessel is under cyber attack, the shore-side office acts as your extended technical team. However, they can only help if the information you provide is structured and timely. The Master is responsible for external notifications — the ETO’s role is to provide accurate technical input for each report and to support the DPA in assembling the evidence package.
What constitutes a reportable incident
Not every cyber anomaly requires external notification. The reporting obligation is triggered by specific criteria — primarily whether essential services were affected or whether there is a safety, environmental, or statutory compliance consequence.
- Any incident affecting propulsion, steering, ECDIS, or PMS
- Any confirmed ransomware or malware on Cat II or III CBS
- Any incident requiring MRC declaration or manual fallback activation
- Any incident resulting in loss of GMDSS communications
- Any incident where vessel safety or crew safety was at risk
- Any confirmed data breach involving personal crew data
- Suspected virus isolated to crew Wi-Fi with no OT spread
- Single non-critical workstation failure with no safety impact
- Rogue device detected and removed before network access
- Failed authentication attempts with no successful breach
- Level 1 technical faults assessed and closed within 24 hours
Reporting obligations by authority
The following table defines who must be notified, within what timeframe, and the regulatory basis for each obligation. All notifications are coordinated by the DPA — the Master authorises, the ETO provides technical input.
The incident data package
Prepare the evidence package for the DPA and shore-side SOC. Transmit via a clean connection — Master’s Iridium phone, personal 4G hotspot, or any channel confirmed not affected by the incident. Never transmit evidence packages via a network you suspect is compromised.
Initial notification template — DPA to Class Society
This template gives the DPA a starting point for the formal Class notification. The ETO provides the technical fields — the DPA completes the regulatory and company sections.
To: [Class Society Surveyor / Fleet Department]
This notification is submitted in accordance with IACS UR E26 §4.4.1 and [Class Society] rules for cyber incident reporting.
Vessel: [Name] | IMO Number: [Number] | Flag: [Flag State]
Incident detected: [Date] [Time] UTC | Position at time of detection: [Lat/Long or port name]
Incident severity level: Level [1/2/3] — [Low/Medium/Critical]
Systems affected: [List affected CBS with criticality category]
Essential services status: [Propulsion / Steering / Navigation — normal / on manual fallback / impaired]
Actions taken: [Summary of isolation and containment steps]
Current vessel status: [Proceeding to destination / at anchor / diverting to port of refuge]
Evidence package: [Attached / to follow within 24 hours]
A detailed written report will follow within [24/48] hours. We request guidance on survey attendance requirements and any Class-specific reporting obligations.
Legal protection note
Under UR E26 §4.5.1, the ETO must not attempt to wipe or rebuild a system until shore-side teams confirm they have sufficient forensic data. Prematurely wiping a system may constitute a failure in regulatory compliance and could affect insurance and legal outcomes. Always obtain explicit DPA sign-off before any irreversible recovery action.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
