Maritime Cyber Security: What the IMO Expects and How a Dubai Office Proves It
The IMO put cyber risk inside the safety management system. Here is what that means for a shore office, and the evidence you need ready.
Maritime cyber security means addressing cyber risk inside your safety management system rather than treating it as an IT matter. For a shore office that translates into identity control, email defence, patching, segregation of operational systems and a backup you have restored. The hard part is not the controls; it is producing evidence when a charterer, insurer or auditor asks.
Key takeaways
- The IMO requirement is about risk management in the safety system, not a product you buy.
- Most maritime incidents start ashore, through email and credentials, not on the bridge.
- Evidence matters as much as the control: undocumented good practice fails an audit.
- Separate operational technology from the office network, and keep the separation documented.
- Vendor and crew access is the most common gap in a shipping company's access list.
- A restore that has been tested and dated is the single most persuasive artefact you can hold.
What the IMO actually requires
The shift that matters happened when cyber risk was brought inside the safety management system rather than left as an IT concern. The International Maritime Organization sets the expectation that cyber risk is identified, assessed and managed as part of how a company manages safety generally, which means it is subject to the same audit and verification as any other element of that system.
This is worth reading carefully because it is not a technical standard. It does not tell you which firewall to buy or how long a password should be. It requires that you have thought about what could go wrong, decided what to do about it, implemented that, and can show the working. A company with modest but documented controls passes more comfortably than one with excellent undocumented practice.
The industry filled the practical gap with guidance maintained through bodies including BIMCO, which is where most owners and managers take their working definition of what good looks like. Class societies publish their own interpretations, and charterers increasingly ask their own questions, so the practical bar is set by whoever audits you rather than by a single document.
Where maritime incidents actually start
The mental image of maritime cyber risk is a vessel losing navigation. That is the dramatic scenario, and it is not the common one. The overwhelming majority of incidents affecting shipping companies begin in the shore office, through the same two routes as every other business: a credential that was reused or phished, and an email that was believed.
The shipping variant of email fraud is particularly expensive because of how payments work. Bunker invoices, port disbursement accounts, agency fees and crew wages all move by transfer against emailed instructions, often to counterparties in another country and another time zone, and often under time pressure because a vessel is waiting. An attacker who reads a mailbox for a fortnight learns the pattern, then changes bank details on a genuine invoice at exactly the moment nobody has time to question it.
- Mailbox compromise leading to altered payment instructions is the most common expensive incident.
- Reused credentials on a shore account, not a bridge system, are the usual entry point.
- Ransomware ashore stops chartering and operations even when no vessel is touched.
- A supplier or agent compromise reaches you through a trusted email thread.
Maritime cyber security: the shore controls that carry the most weight
Five controls do most of the work, and none of them is exotic. Multi-factor authentication on every account, with no exception for directors who travel, because the travelling director is the account most worth taking. Administrator separation, so day-to-day work does not happen in an account that can change everything. Email authentication configured for your domain, so an attacker cannot easily send mail that appears to come from you.
Then patching you can demonstrate rather than assume, and a backup that has been restored from and dated. The CIS Critical Security Controls publish an implementation group aimed at small organisations that covers this ground without the enterprise weight, and it is a defensible thing to point at when an auditor asks what framework you followed.
Alongside the technical controls sits one procedural rule that stops the most expensive attack outright: any change to a counterparty's bank details is confirmed by telephone to a number you already hold, never to a number in the email requesting the change. That control costs nothing and defeats the entire invoice-fraud pattern.
None of this is maritime-specific technology. It is the same baseline any office needs, applied to a business where a single altered payment instruction can run to the cost of a voyage. Our cybersecurity service implements these controls and documents them as it goes, which is the part that turns good practice into something you can show an auditor rather than describe to one.
Keeping operational systems apart from the office
A shipping company ashore usually has more than an office network. There may be a yard or workshop, a vessel-tracking or fleet-monitoring system, planned maintenance software that talks to vessels, sometimes CCTV and access control across a compound. These are operational systems, and they share a characteristic that makes them dangerous: they are rarely updated, because updating them requires a vendor visit and a window when nothing is running.
The answer is segmentation rather than patching them into safety. Operational systems sit on their own network segment, reachable only on the specific ports they need, and cannot reach the office network or the internet except where genuinely required. An unpatchable monitoring server is then contained rather than being the way in. Our network security for small business page covers how those segments are built in practice.
Document the separation as you build it. When an auditor asks how operational systems are protected, a network diagram showing the segments and a rule list showing what crosses between them is a complete answer. Reconstructing that diagram a year later, under audit pressure, is not a pleasant exercise.
The access problem nobody audits until forced
Shipping has an unusually wide cast of people who need some access and are not employees. Seafarers rotate on and off. Port agents need a voyage folder for one call. Superintendents, technical managers and class surveyors come and go. Software vendors hold remote access to systems they installed years ago, often with an account nobody has reviewed since.
Vendor remote access deserves particular attention, because it is the category most often forgotten and most dangerous. An always-on remote connection for a maintenance supplier, created during commissioning and never revisited, is a permanent door into your network held by a third party whose own security you have never assessed. At minimum these should be disabled by default and enabled on request for a specific piece of work.
For everyone else, access by group and by vessel makes the list manageable and auditable. Somebody joining a vessel inherits that vessel's access, an agent gets one voyage folder with sharing set to expire, and a departure removes everything in a single action. Our employee offboarding checklist covers the process side.
Review the list on a schedule rather than after an incident. A quarterly pass that lists every account, what it can reach and when it was last used takes an hour and catches the two things audits reliably find: dormant accounts belonging to people who left, and shared logins that make it impossible to say who did what.
What the vessel link changes, and what it does not
Satellite connectivity has improved sharply, and services such as Starlink's maritime offering have changed what is practical at sea. That is largely good, but it alters the risk picture in one specific way: a vessel that was effectively offline for long stretches is now continuously connected, which means it is continuously reachable.
The practical consequences are modest if handled deliberately. Crew welfare internet should be separated from any network carrying operational or navigational systems, in exactly the way guest Wi-Fi is separated in a hotel. Software updates to onboard systems remain the vendor's domain under class rules, and should not be pulled ad hoc because the connection now allows it. And the assumption that the vessel is unreachable during an incident is no longer safe, which is an argument for the shore office having a documented way to contact the master out of band.
Producing the evidence when somebody asks
The question arrives in one of three forms: a charterer's vetting questionnaire, an insurer's proposal form, or an audit of the safety management system. All three want the same underlying thing, which is proof that cyber risk is managed rather than assumed.
A folder that answers all three contains a handful of documents. An asset register listing what you run and who owns it. An access list showing who can reach what, with the date of the last review. A statement of the security baseline and which framework it follows. Evidence of patching. The backup configuration with the date and result of the last tested restore. A short incident response plan naming who is called and in what order. And the record of when staff were last given security awareness training.
None of that is difficult to assemble if it is maintained as you go. All of it is painful to produce in the fortnight before a vetting deadline, which is when most firms first attempt it. Our cyber security audit produces that folder as a deliverable, ranked by risk, and the IT audit covers the wider estate for firms that have never documented it.
Where Dubai firms sit
For a marine business operating from Dubai the regulatory picture has a federal layer through the Ministry of Energy and Infrastructure and local oversight via the Dubai Maritime Authority, alongside whichever flag state and class society your vessels answer to. The practical effect is that you may face several questioners with overlapping but not identical expectations.
That argues for building the evidence folder once, to the strictest of the standards you face, rather than assembling a different answer for each. A firm that can hand over an asset register, an access review and a dated restore test is answering ninety per cent of every questionnaire it will receive, whoever sent it.
The remaining ten per cent is usually specific to the asker, and is far easier to write when the foundation exists. Our IT support for shipping companies page covers how we set this up alongside the rest of a shore office.
Frequently asked questions
It applies to the company's safety management system, which is a shore responsibility even though vessels are what the system governs. In practice auditors look at how the company manages cyber risk across its operation, and since most incidents begin ashore, the shore office receives real scrutiny rather than being treated as out of scope.
The requirement is risk-based rather than size-based, so a small manager is expected to do less than a major owner, but to have thought about it and written it down. A handful of documented controls, reviewed periodically, satisfies the expectation. Having excellent practice with nothing written down is what fails.
A compromised mailbox used to alter payment instructions on a genuine invoice, most often for bunkers, port disbursements or agency fees. It works because payments are large, counterparties are remote and a vessel is usually waiting. Multi-factor authentication stops the compromise, and telephoning a known number to confirm changed bank details stops the payment.
It should sit on its own segment rather than on the office network. These systems are rarely patched because updating them needs a vendor and a maintenance window, so the realistic protection is containment: reachable only on the ports it needs, unable to reach the office network or the open internet except where genuinely required.
Treat standing remote access as an open door held by somebody whose security you have not assessed. Disable it by default and enable it for a specific piece of work on request, with the session logged. This is the access category most often created during commissioning and never reviewed again, and it is a common finding in audits.
An asset register, an access list with the date of its last review, a written security baseline naming the framework it follows, evidence of patching, the backup configuration with a dated restore result, a short incident response plan, and a record of staff security training. That set answers most of what any charterer, insurer or auditor will ask.
It changes the risk rather than increasing it, provided the separation is right. A continuously connected vessel is continuously reachable, so crew welfare internet must be isolated from any network carrying operational systems, in the same way guest Wi-Fi is isolated ashore. Onboard system updates stay with the class-approved vendor rather than being pulled because the link now allows it.
Written by Srinivasan Ramachandran, Founder, Listonics · Published Sep 28, 2026 · Last reviewed October 11, 2026 · 2,070 words
