The revision matters to tanker and dry bulk operators, who face cyber security questions from more than one vetting regime. That includes the large ship management community serving Indian and international fleets.     The guidelines now keep management requirements separate from the evidence needed to show they have been implemented. They are split into two parts:     Part 1 sets out the requirements for a Cyber Security Management System (CSMS).    Part 2 sets out the audit criteria and the supporting evidence auditors will expect.     The framework covers management commitment, responsibilities ashore and onboard, risk assessment, operational controls and incident preparedness. ClassNK has restructured it with reference to the international information security standards ISO/IEC 27001 and ISO/IEC 27002.    The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) develop both standards. ISO/IEC 27001 sets the requirements for an information security management system and lets organisations adapt risk management.     processes to their size and needs. ISO/IEC 27002 gives guidance on security controls, including access management, personnel security and incident response. Used together, the two link organisational oversight with practical measures to protect information and systems.     ClassNK has mapped its audit criteria against four schemes:    RISQ: the RightShip Inspection Ship Questionnaire    SIRE 2.0: the Ship Inspection Report Programme, operated by the Oil Companies International Marine Forum (OCIMF)     DryBMS: the Dry Bulk Management Standard     TMSA: Tanker Management and Self Assessment, developed by OCIMF     ClassNK says the mapping should cut the work of interpreting each scheme’s cyber security requirements separately. The guidelines are available on its My Page portal once users register.     The wider regulatory framework treats cyber risk as an operational safety issue. The International Maritime Organization (IMO) says the possible consequences range from compromised information to failures that affect shipping operations, safety and security.     In June 2017, IMO’s Maritime Safety Committee adopted Resolution MSC.428(98). The resolution affirmed that an approved safety management system should address cyber risk in line with the International Safety Management (ISM) Code. It encouraged flag administrations to make sure companies dealt with these risks no later than the first annual verification of their Document of Compliance after 1 January 2021. It also recognised the need to protect confidential information linked to cyber risk management.     IMO’s broader guidance helps companies identify, assess and manage cyber risks within their existing processes, alongside established safety and security practice. This makes cyber security part of routine operational management rather than only an information technology function.     Separate technical requirements cover the cyber resilience of ships and onboard equipment. ClassNK has built the International Association of Classification Societies’ (IACS) Unified Requirements E26 and E27 into its rules for computer-based systems and equipment approval.     ClassNK says these provisions apply to ships contracted for construction on or after 1 July 2024. It also publishes interpretation guidance that explains the approval processes and requirements for shipyards, equipment suppliers and shipowners.   

 CSMS certification looks at how a company’s management system works both ashore and onboard, with safe ship operation as its priority. ClassNK issues separate certification application documents for companies and for ships, because it assesses the organisation’s arrangements and how they are carried out on each vessel.