Two organisations describe the same resolution differently. Bureau Veritas tells shipowners that as of 1 January 2021 they “must comply with IMO Resolution MSC.428(98) to continue sailing worldwide.” The IMO’s own page is softer: the resolution “encourages administrations to ensure” that cyber risks are addressed in safety management systems no later than the first annual verification of the company’s Document of Compliance after 1 January 2021.
Which date binds you
The difference matters to a fleet manager’s budget. Under the IMO route, maritime cybersecurity belongs inside the safety management system. The resolution asks administrations to see that cyber risks are addressed there, with the first annual verification of the Document of Compliance after 1 January 2021 as the reference point. The yardstick is the IMO’s Guidelines on maritime cyber risk management, first approved in April and June 2017. The current text is circular MSC-FAL.1/Circ.3/Rev.4 of 28 May 2026, and it calls itself “high-level recommendations.”
The US took a different route and wrote the requirements into regulation. Subpart F of 33 CFR part 101 covers US-flagged vessels, facilities and OCS facilities. Training had to be completed by 12 January 2026 and repeats every year. Cybersecurity Plans go to the Coast Guard by 16 July 2027, and the first Cybersecurity Assessment is due the same day.
Six functions, in the order the IMO lists them
The annex says these functional elements are not sequential and should run concurrently. Govern still comes first on the page: the annex wants one person or entity accountable for cybersecurity, with the authority and support to act, and it files backup management, disaster recovery and crisis management under the same heading.
Identify is an inventory job. A company lists the digital systems on board, maps their network connections along with software and hardware supply chains, and marks the systems whose sudden operational failure may result in hazardous situations.
Protect carries the most items, and the annex frames them as minimum controls that should be implemented. Users should have unique credentials, privileged accounts should stay separate, and default passwords should change. Multi-factor or continuous authentication is on the list where appropriate, and OT networks should be segmented from IT. Training is annual for all employees, and crew get familiarization on joining the ship.
Detect is short: keep a list of relevant threats and watch for them. Respond means reporting incidents “within required time frames as defined by the Administration” and keeping records of every one. The guidelines name no number of hours, so how fast you must report is answered by your flag state’s instructions. The annual training covers responding too.
Recover asks for strategies for the recovery and reinstatement of essential systems, followed by a root cause analysis after each incident.
For US-flagged ships and facilities, maritime cybersecurity comes with fixed obligations on several of these steps. The rule separates IT from OT networks. It demands multi-factor authentication on password-protected IT and remotely accessible OT systems, and where that is not feasible, compensating controls that are documented. It also requires cyber drills at least twice a year and a named Cybersecurity Officer reachable around the clock.
Two incidents and the functions they test
Two public cases put different functions under strain.
Clarkson PLC announced on 29 November 2017 that unauthorised access had been gained “via a single and isolated user account.” A later statement, reported by gCaptain in July 2018, put the intrusion window at 31 May to 4 November 2017. Five months of access, give or take. Shortening that is the job of the Detect step. Neither statement says how the account was compromised. The Protect step starts at that layer: unique credentials, separated privileged accounts, a second factor.
Maersk’s case tests Recover. In its Q2 2017 report the company said it was hit by a cyber-attack in the last week of the quarter, and its 2017 annual report names the June 2017 attack as NotPetya malware. It mainly hit Maersk Line, APM Terminals and Damco. Business volumes were negatively affected for a couple of weeks in July. In August 2017 the company expected the impact to be USD 200-300m, and the annual report puts losses in the order of USD 250-300m, covering loss of revenue, IT restoration costs and extraordinary costs related to operations. The report calls the recovery fast.
What a shipper can do about someone else’s incident
When a carrier’s IT goes down, anyone whose only view of a box is that carrier’s portal loses it. A second place to check a container number is worth having, and Navo’s tracking page covers 240+ carriers. Ask your carriers which of the six functions they would show you evidence for.
Frequently asked questions
Who has to name a cybersecurity officer under the US Coast Guard rule?
Per 33 CFR 101.620, the owner or operator of each US-flagged vessel, facility or OCS facility. The rule requires designating a Cybersecurity Officer in writing, by name and title, who the Coast Guard can reach 24 hours a day, 7 days a week, and the owner or operator has to identify how that person can be contacted at any time.
How often must cyber drills run under the US rule?
At least twice each calendar year. The Cybersecurity Officer must make sure the drills test individual elements of the Cybersecurity Plan, including responses to threats and incidents, and they may be held together with other security or non-security drills.
Do backups need testing, or only copying?
Both documents want backups, but the US rule goes further. It requires backups of critical IT and OT systems that are sufficiently protected and tested frequently. The IMO guidelines list regular system backups and incident response plans under the Protect function.