ClassNK Cybersecurity Guide Sets Shipboard Controls and Audit Evidence

ClassNK’s second edition of its Cyber Security Management System Guidelines for Ships gives owners and operators a shared framework for managing digital risks onboard and preparing evidence for cybersecurity audits. Its practical focus is the connection between company procedures, shipboard safeguards and the records that assessors may ask to review.

The Japanese classification society released the revised guide in Tokyo on October 30, 2026. It applies to ship owners, operators and management companies, and addresses threats that can arise during vessel operations. The guidance also spells out how cybersecurity responsibilities are divided between company headquarters and individual vessels, where digital systems support day-to-day work.

A framework built around audit evidence

ClassNK restructured the guide around ISO/IEC 27001 and ISO/IEC 27002, international information security standards. It has two sections: one sets out requirements for a Cyber Security Management System, or CSMS, while the other describes audit criteria and the evidence companies may be asked to provide.

That division gives operators a way to connect written procedures with records of how those procedures are carried out. A company can review its arrangements against the stated criteria before an audit, identify missing documentation and clarify who is responsible for each control. The guide’s value for an operating team will depend on whether responsibilities and evidence are clear across both shore and shipboard functions.

The assessment areas include company cybersecurity policies, personnel duties and responsibilities, risk assessments, technical protections and readiness for potential attacks. The revised guide also highlights access control, software updates, staff training, incident response and regular reviews of security practices.

These subjects touch different parts of vessel management. Access control concerns who can use systems and what they are permitted to do. Update procedures address how software changes are handled, while training and incident response concern how personnel prepare for and act on security events. Regular reviews give companies a means to revisit safeguards as systems, crews and operating processes change.

One system for several maritime assessments

ClassNK has aligned the guide’s criteria with RightShip’s RISQ, OCIMF’s SIRE 2.0 and TMSA, and the DryBMS assessment systems used in the bulk sector. Those links are intended to let operators address overlapping cybersecurity expectations through a common management system, instead of treating each assessment as an entirely separate exercise.

For companies working across different vessel types or customer assessment programs, that common structure could make preparation more orderly. Teams can maintain a single set of procedures and supporting records, then map them to the relevant assessment criteria. ClassNK says the approach is intended to reduce audit preparation time and the workload associated with compliance efforts. The guide does not remove the need to understand each assessment system’s particular requirements; it provides a common basis for addressing the cybersecurity elements they share.

The named systems span tanker, bulk and broader maritime assessments. Their inclusion makes the guide relevant to operators who need to demonstrate how cybersecurity controls fit within existing vessel and company management practices. In practice, the usefulness of that alignment will rest on keeping records current and ensuring that ship and shore personnel can explain how the documented process works.

Cybersecurity continues after construction

ClassNK’s guidance treats cyber resilience as an operational responsibility across a ship’s service life. Technical requirements developed by the International Association of Classification Societies, including UR E26 and E27, set criteria for newly built ships and ship systems. But the guide points to risks that can emerge later, including software updates, personnel changes and shifts in operational processes.

That distinction matters to fleet managers: controls established during construction may need ongoing attention as equipment and working arrangements change. A software update can alter the systems a vessel depends on; a crew or responsibility change can affect who manages access or responds to an incident. The guide’s emphasis on recurring reviews, training and response preparation puts these tasks within continuing ship management rather than treating cybersecurity as a one-time technical check.

The International Maritime Organization recommends including ship cyber risks in Safety Management Systems under the ISM Code. Together, that recommendation and the technical criteria for new ships frame cybersecurity across management processes and vessel systems. ClassNK’s revised guide adds a CSMS structure for operators to use in organizing those responsibilities and preparing for audits.

Experience reflected in the revised edition

ClassNK published its first Cyber Security Management System Guidelines for Ships in 2019. The society says it incorporated experience from audits conducted since then into the second edition. That history gives the revision a practical basis in the assessment work carried out under the earlier guidance, while the new structure makes audit criteria and expected evidence more explicit.

ClassNK also says it will continue supporting maritime cybersecurity through audit and certification activities. For operators, the immediate task is to compare existing procedures with the revised requirements, confirm that shore and vessel responsibilities are assigned, and keep evidence current as systems and personnel change. A common framework can simplify preparation across several assessment programs; its day-to-day value will come from consistent use throughout each vessel’s operating life.

Source: SeaNews Türkiye