Cyber Security Plan

This plan provides guidance for the master and other crew members on board the ship regarding procedures for cyber security.

1. Definitions

2. Purpose

Yachts are increasingly using systems that rely on digitisation, integration, and automation, which call for cyber risk management on board. As technology continues to develop, information technology (IT) and operational technology (OT) onboard ships are being networked together – and more frequently connected to the internet.

This document identifies information sources that may aid in establishing policies and procedures for mitigating maritime cyber risks.

This risk assessment has been developed by Yachting Concept Monaco to establish safeguards against cyber risks for their Republic of the Marshall Islands (RMI) - flagged vessels.

2.1. Background

IMO Resolution MSC. 428(98) encourages Administrations to ensure that cyber risks are appropriately addressed in safety management systems (SMS) no later than the first annual verification of the Company’s Document of Compliance after 1 January 2021.

Marshall Islands Registry has implemented this Resolution through RMI Marine Notice 2-011-13, International Safety Management (ISM) Code.

The ship’s operations plans must ensure that cyber risks are addressed in the SMS no later than the first annual verification of the Company's Document of Compliance after 01 January 2021. See IMO Resolution MSC.428(98), Maritime Cyber Risk Management in Safety Management Systems.

3. Cybersecurity and safety management

The IMO guidelines set out the following principles in support of an effective cyber risk management strategy:

1. Identify: Define the roles responsible for cyber risk management and identify the systems, assets, data and capabilities that, if disrupted, pose risks to ship operations.
2. Protect: Implement risk control processes and measures, together with contingency planning to protect against a cyber incident and to ensure continuity of shipping operations.
3. Detect: Develop and implement processes and defences necessary to detect a cyber incident on time.
4. Respond: Develop and implement activities and plans to provide resilience and to restore the systems necessary for operations or services which have been halted due to a cyber incident.
5. Recover: Identify how to back-up and restore the cyber systems necessary for shipping operations which have been affected by a cyber incident.

Both cybersecurity and cyber safety are important because of their potential effect on the guests, the personnel, the ship or environment. Cybersecurity is concerned with the protection of IT, OT, information and data from unauthorised access, manipulation and disruption. Cybersafety covers the risks from the loss of availability or integrity of safety-critical data and OT.

Some aspects of cyber risk management may include commercially sensitive or confidential information. Companies should, therefore, consider protecting this information appropriately, and as far as possible, not include sensitive information in their Safety Management System (SMS). Sensitive information should be included in the protected and confidential version of the Ship's Security Plan.

Cyber risk management should:

• Identify the roles and responsibilities of users, key personnel, and management both ashore and onboard
• Identify the systems, assets, data and capabilities, which if disrupted, could pose risks to the ship’s operations and safety
• Implement technical and procedural measures to protect against a cyber incident and ensure continuity of operations
• Implement activities to prepare for and respond to cyber incidents.

3.1. Differences between IT and OT systems

Operational Technology Systems (OT) control the physical world and Information Technology systems (IT) manage data. OT systems differ from traditional IT systems. OT is hardware and software that directly monitors/controls physical devices and processes. IT covers the spectrum of technologies for information processing, including software, hardware and communication technologies. Traditionally OT and IT have been separated, but with the internet, OT and IT are coming closer as historically stand-alone systems are becoming integrated.

Disruption of the operation of OT systems may impose a significant risk to the safety of onboard guests and crew, damage to the marine environment, and impede the yacht's operation.

4. Identify

4.1. Identify threats

The cyber risk is specific to companies, ships, operations and/or trade. When assessing the risk, companies should consider any specific aspects of their operations that might increase their vulnerability to cyber incidents. Unlike other areas of safety and security, where historic evidence is available, cyber risk management is made more challenging by the absence of any definitive information about incidents and their impact. Until this evidence is obtained, the scale and frequency of attacks will continue to be unknown. The yachting industry is dealing with high-end guests and often public figures, therefore, the risk analysis should take into account this specific motivation driven attacks.

Besides, there is the possibility that the personnel, onboard and ashore, could compromise cyber systems and data. In general, the company should realise that this may be unintentional and caused by human error when operating and managing IT and OT systems or failure to respect technical and procedural protection measures. There is, however, the possibility that actions may be malicious and are a deliberate attempt by a disgruntled employee to damage the company and the ship.

4.2. Types of cyber attack

Untargeted attacks, where a company or a ship’s systems and data are one of many other potential targets

• Malware: Malicious software which is designed to access or damage a computer without the knowledge of the owner. There are various types of malware including trojans, ransomware, spyware, viruses, and worms. Ransomware encrypts data on systems until a ransom has been paid. Malware may also exploit known deficiencies and problems in outdated/unpatched business software. The term “exploit” usually refers to the use of software or code, which is designed to take advantage of and manipulate a problem in another computer software or hardware. This problem can, for example, be a code bug, system vulnerability, improper design, hardware malfunction and/or error in protocol implementation. These vulnerabilities may be exploited remotely or triggered locally. Locally, a piece of malicious code may often be executed by the user, sometimes via links distributed in email attachments or through malicious websites.
• Phishing: Sending emails to a large number of potential targets asking for particular pieces of sensitive or confidential information. Such an email may also request that a person visits a fake website using a hyperlink included in the email.
• Water holing: Establishing a fake website or compromising a genuine website to exploit visitors.
• Scanning: Attacking large portions of the internet at random.

Targeted attacks may be more sophisticated and use tools and techniques specifically created for targeting a company or ship. Examples of tools and techniques, which may be used in these circumstances, include:

• Social engineering: A non-technical technique used by potential cyber attackers to manipulate insider individuals into breaking security procedures, normally, but not exclusively, through interaction via social media.
• Brute force: An attack trying many passwords with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords until the correct one is found.
• Denial of service (DoS): Prevents legitimate and authorised users from accessing information, usually by flooding a network with data. A distributed denial of service (DDoS) attack takes control of multiple computers and/or servers to implement a DoS attack.
• Spear-phishing: Like phishing but the individuals are targeted with personal emails, often containing malicious software or links that automatically download malicious software.
• Subverting the supply chain: Attacking a company or ship by compromising equipment, software or support services being delivered to the company or ship.

The above examples are not exhaustive. Other methods are evolving such as impersonating a legitimate shore-based employee in a shipping company to obtain valuable information, which can be used for a further attack.

4.3. Identify vulnerabilities

It is recommended that the yacht assesses the potential threats that may realistically be faced. This should be followed by an assessment of the systems and onboard procedures to map their robustness to handle the current level of threat. The result should be a strategy centred around the key risks.

Stand-alone systems will be less vulnerable to external cyber-attacks compared to those attached to uncontrolled networks or directly to the internet. Network design and network segregation will be explained in more detail in annexe 3. Care should be taken to understand how critical shipboard systems might be connected to uncontrolled networks. When doing so, the human element should be taken into consideration, as many incidents are initiated by personnel’s actions.

Onboard systems include:

• Bridge systems – The increasing use of digital, network navigation systems, with interfaces to shoreside networks for update and provision of services, make such systems vulnerable to cyber-attacks. Bridge systems that are not connected to other networks may be equally vulnerable, as removable media are often used to update such systems from other controlled or uncontrolled networks. A cyber incident can extend to service denial or manipulation and, therefore, may affect all systems associated with navigation, including ECDIS, GNSS, AIS, VDR and Radar/ARPA.
• Propulsion and machinery management and power control systems – The use of digital systems to monitor and control onboard machinery, propulsion and steering makes such systems vulnerable to cyber-attacks. The vulnerability of these systems can increase when used in conjunction with remote condition-based monitoring and/or are integrated with navigation and communications equipment on ships using integrated bridge systems.
• Guests, crew and management systems – Digital systems used for property management, boarding and access control may hold valuable passenger related data. Intelligent devices (tablets, handheld scanners etc.) are themselves an attack vector as ultimately the collected data is passed on to other systems.
• Guests and crew wifi networks – Fixed or wireless networks connected to the internet, installed on board for the benefit of passengers, for example, guest entertainment systems, should be considered uncontrolled and should not be connected to any safety-critical system on board.
• Administrative systems – Onboard computer networks used for administration of the ship are particularly vulnerable when providing internet access and email. This can be exploited by cyber attackers to gain access to onboard systems and data. These systems should be considered uncontrolled and should not be connected to any safety-critical system on board. Software provided by ship management companies or owners is also included in this category.
• Communication systems – Availability of internet connectivity via satellite and/or other wireless communication can increase the vulnerability of ships. The cyber defence mechanisms implemented by the service provider should be carefully considered but should not be solely relied upon to secure every shipboard system and data. Included in these systems are communication links to public authorities for transmission of required ship reporting information. Applicable authentication and access control management requirements by these authorities should be strictly complied with.

4.4. Systems onboard

5. Protect

Cyber risk assessment should start at the senior management level of a company, instead of being immediately delegated to the ship security officer or the head of the IT department. There are several reasons for this.

1. Initiatives to heighten cybersecurity and safety may at the same time affect standard business procedures and operations, rendering them more time consuming and/or costly. It is, therefore, a senior management level decision to evaluate and decide on risk mitigation.
2. Many initiatives, which would improve cyber risk management, are related to business processes, training, the safety of the ship and the environment and not to IT systems, and therefore need to be anchored organisationally outside the IT department.
3. Initiatives which heighten cyber awareness may change how the company interacts with customers, suppliers and authorities, and impose new requirements on the co-operation between the parties. It is a senior management level decision whether and how to drive these changes in relationships.

5.1. Impact assessment

Potential impacts could be safety-related, operational, environmental-related, financial, reputational and compliance-related. Several assessment methodologies offer criteria and techniques that can help define the magnitude of the impact of a cyber-attack.

5.2. ECDIS

The ECDIS operating system is based on Unix and is not connected to the main network. Therefor less subject to cyber attack, nor viruses. Furthermore, the system is fully redundant to be restarted independently without compromising the safety of navigation. Chart updates are done using a dedicated USB stick used from the bridge charts and publications Windows OS laptop computer.

5.3. GMDSS

The GMDSS system is completely independent of the network and uses a proprietary operating system. Therefore, the system should be considered to be at moderate risk.

5.4. B&B Monitoring

The monitoring (2 servers / 7 clients) is Windows 7 pro based system used to monitor all vital operations of the vessel, including engines, bilge, fire pumps, alarms, ventilation, CCTV camera. Whilst most of the controls done with the monitoring can be done manually, a sudden crash of the system during a critical operation of the vessel can lead to an uncontrolled situation. Rebooting can be an option but at high risk depending on the situation. Both servers (ECR & Wheelhouse) are capable of same operation and are redundant for safety. The servers can also be accessed remotely for maintenance purposes using VNC & TeamViewer, the engine team should be trained to close the remote access when the contractor has finished the maintenance session. The windows 7 pro sp1 system is not equipped with anti-virus, nor firewall, but should not store data except running logs.

5.5. Chart & Bridge Publications

Even if this MS Windows computer is used close to the ECDIS system and directly connected to the internet, only communication with a dedicated USB stick is allowed. This USB stick is regularly re-formatted for the same reasons.

5.6. VSat Controller & Modem

These devices can be accessed externally (i.e., from the SAT provider), which allow a potential external attack. The board only rely on the good will and the professionalism of the Internet provider and Sat operator. The reputation of the provider is critical element in the choice of the SAT provider.

5.7. Deepblue© Management System

Deepblue© management system consists of 2 servers:

• One server in the cloud using the state-of-the-art cloud facilities, Unix based system and audited open-source software. It is the responsibility of Deepblue to do their own due diligence.
• A local server which replicates the cloud server. It is the responsibility of Deepblue© to maintain the layers of technologies used to the latest version and patch against known breaches of security.

In case of failure of the local server, a simple synchronisation should be sufficient and no critical vessel operation should be compromised, except ship-to-shore exchange can be reduced due to lack of local data.

This server is used to store critical data:

• Crew personal data, including passport scans, bank details, ...
• Guest sensible data, including passport scans, charter program, ...
• ISM procedures and reports
• Accounts, banking and financial data

5.8. Wifi and Firewall

The WIFI network uses CISCO Wifi/Lan controller and Kerio «RedBox» firewall, state-of-the-art hardware, but passwords are used by numerous people, crew, guests and external contractors.

The firewall must be continuously updated to its latest version and protected again virus and threads. The licence is to be annually renewed.

The internal network is segregated into leakproof sub-networks. Separating management level crew, owner, guests, AV and technical devices. The passwords shall not be shared by anyone with another.

Wifi passwords are to be changed:

• Every charter for Guests network
• Every year for Owner, Management and Crew networks
• Every 5 years for technical devices

5.9. Crew Computers

Although it is very difficult to control each and individual crew computers, the network security rules should be never relaxed. An up-to-date banned websites list is to be automatically maintained using continuous firewall updates.

5.10. CCTV

The CCTV camera system is a critical part of the SSP. Therefor the ability of accessing this service on the internal network is a potential risk of breach of security. It is critical that the board management team is aware of not sharing the management Wifi password to lower rank of users.

5.11. Domotic

The iPads are controlling the domotic using a Krestron controller. It is part of operational technologies (OT) but limited to basic domotic operations (lights, curtains, AC, AV, few CCTV, …). No critical life-threatening risk has been found related to these devices.

5.12. Password Management System

The yacht is using a centralised and secured encrypted passwords pool. Passwords are not saved on personal or work computer. The password db are accessible only for the management team:

• Master
• Chief Officer
• Chief Engineer (and by delegation ETO)

When a member of this team is replaced, his credential is to be removed and this as to be part of the handover procedure. Details of the password management tool are available at the discretion of the master to flag/port authorities only and are not written in the present document.

6. Detect

The outcome of the company’s risk assessment and subsequent cybersecurity strategy should be a reduction in risk to be as low as reasonably practicable. At a technical level, this would include the necessary actions to be implemented to establish and maintain an agreed level of cybersecurity.

It is important to identify how to manage cybersecurity on board and to delegate responsibilities to the master, responsible officers and when appropriate the company security officer.

6.1. Defence in-depth and in breadth

It is important to protect critical systems and data with multiple layers of protection measures, which take into account the role of personnel, procedures and technology to:

• Increase the probability that a cyber incident is detected
• Increase the effort and resources required to protect information, data or the availability of IT and OT systems.

Connected OT systems onboard should require more than one technical and/or procedural protection measure. Perimeter defences such as firewalls are important for preventing unwelcome entry into the systems, but this may not be sufficient to cope with insider threats.

B&B monitoring systems onboard should require more than one technical and/or procedural protection measure. Perimeter defences such as firewalls are important for preventing unwelcomed entry into the system, but this may not be sufficient to cope with insider threats.

This defence-in-depth approach encourages a combination of:

1. Physical security of the ECR following the ship security plan (SSP).
2. Protection of the network, including effective segmentation.
3. No external contractor should be left alone in the ECR.
4. Periodic vulnerability scanning and testing.
5. Software whitelisting.
6. Access and user controls: Only the chief engineer, ETO and B&B employees are allowed to access the ECR servers.
7. Systematic anti-virus scan of removable media and password policies and personnel’s awareness of the risk and familiarity with appropriate procedures.

6.2. Configuration of network devices: firewalls, routers and switches

It should be determined which systems should be attached to controlled or uncontrolled networks. Controlled networks are designed to prevent any security risks from connected devices by use of firewalls, routers and switches. Uncontrolled networks may pose risks due to lack of data traffic control and should be isolated from controlled networks, as direct internet connection makes them highly prone to infiltration by malware.

• Networks that are critical to the operation of a ship itself, is controlled. These systems must have a high level of security and no device are allowed to be connected to this section of the network without extra security measures and scans.
• Networks that provide suppliers with remote access to navigation and other OT systems’ software on board, should also be controlled. These networks may be necessary to allow suppliers to upload system upgrades or perform remote servicing. Shoreside external access points of such connections should be secured to prevent unauthorised access, opened from the inside before the maintenance and immediately closed after.
• Other networks, such as guest access networks, crew networks, maybe uncontrolled, for instance, those related to recreational activities or private internet access for crew. Normally, any wireless network should be considered uncontrolled and potentially a source of a breach.

6.3. Wireless access control

Wireless access to networks on the ship should be limited to appropriate authorised devices and secured using a strong encryption key, which is changed regularly.

The following is considered for controlling wireless access:

• The use of enterprise authentication systems using asymmetric encryption and isolating networks with appropriate wireless dedicated access points (e.g. guest networks isolated from the crew or management networks).
• Modification of Wifi passwords:
  • after each charter for the Guest network
  • after each season for the Crew and Management
  • after the departure of the IT manager, Master and Chief Officer for all network
• The protection of the physical servers and network routers

6.4. Malware detection

Scanning software that can automatically detect and address the presence of malware in systems onboard should be regularly updated and security software licence to be renewed annually.

As a general guideline, onboard computers should be protected to the same level as office computers ashore. Anti-virus and anti-malware software should be installed, maintained and updated on all personal work-related computers onboard. This will reduce the risk of these computers acting as attack vectors towards servers and other computers on the ship’s network.

6.5. Secure configuration for hardware and software

Only senior officers should be given access to the management network so that they can control the setup and disabling of normal user profiles. User profiles should be restricted to only allow the computers, workstations or servers to be used for the purposes, for which they are required.

6.6. Email and web browser protection

Email communication between ship and shore is a vital part of a yacht's operation. Appropriate email and web browser protection serves to:

• Protect shoreside and onboard personnel from potential social engineering
• Prevent email from being used as a method of obtaining sensitive information
• Avoid the exchange of sensitive information via email and prefer voice for example to credit card number authorisation.
• Prevent web browsers and email clients from executing malicious scripts.
• Usage of Peer Peer sharing software is strictly forbidden and locked by firewall rules.

Some best practices for safe email transfer are: email as zip or encrypted file when necessary, disable hyperlinks on the email system, avoid using generic email addresses and ensure the system has configured user accounts.

6.7. Data recovery capability

Data recovery capability is the ability to restore a system and/or data from a secure copy or image, thereby allowing the restoration of a clean system. Essential information and software-adequate backup facilities should be available to help ensure recovery following a cyber incident.

Retention periods and restore scenarios should be established to prioritise which critical systems need quick restore capabilities to reduce the impact. Systems that have high data availability requirements should be made resilient. OT systems, which are vital to the safe navigation and operation of the ship, should have backup systems to enable the ship to quickly and safely regain navigational and operational capabilities after a cyber incident.

• A spare fully configured B&B monitoring server is available at all time for immediate replacement.
• All personal work computers to be automatically backed-up at regular interval on the NAS file server.
• No work-related data or document is to be kept on the personal work computer, instead, users should work directly on the NAS (which is automatically backup on redundant RAID disks) or work locally and upload on the NAS file server and immediately deleted, or upload on Deepblue© information system (which is secured and backed up online).

6.8. Application software security (patch management)

Safety and security updates are provided to onboard systems. Ordinary security patches should be included in the periodic maintenance cycle. Critical patches should be evaluated in terms of operational impact on the OT systems. These updates or patches should be applied correctly and promptly to ensure that any flaws in a system are addressed before they are exploited by a cyber attack. If a critical patch cannot be installed, alternative measures should be evaluated to help implement virtual patching techniques.

6.9. Remote access

The policy is established for control over remote access to onboard IT and OT systems. Clear guidelines should be given to who has permission to access, when they can access, and what they can access. Any procedures for remote access should include close coordination with the ship’s master or other key senior ship personnel.

The remote access should be closed immediately at the end of the work.

All remote access occurrences should be recorded into the Deepblue Maintenance System for review in case of a disruption to an IT or OT system. Systems, which require remote access, should be clearly defined, monitored and reviewed periodically.

6.10. Use of administrator privileges

Access to information is only allowed to relevant authorised personnel:

• Master
• Chief Officer
• Chief Engineer (and by delegation to the ETO)

User privileges must be removed when the people concerned are no longer on board. User accounts should not be passed on from one user to the next using generic usernames. Similar rules should be applied to any onshore personnel, who have remote access to systems on ships when they change the role and no longer need access.

During the handover, this listed personnel must give their passwords bag, and it is the responsibility of the new member to modify the password and/or delete former accesses.

6.11. Physical and removable media controls

When transferring data from uncontrolled systems to controlled systems, there is a risk of introducing malware. Removable media can be used to bypass layers of defences and attack systems that are otherwise not connected to the internet. A clear policy for the use of such media devices is important; it must help ensure that media devices are not normally used to transfer information between uncontrolled and controlled systems.

The following systems should have dedicated USB removable media that should be reformatted before each use:

• B&B ER monitoring server
• Bridge ECDIS

The device should only be loaded on computers that have continuous monitoring of Virus and Malware or using a different operating system.

6.12. Equipment disposal, including data destruction

Obsolete equipment can contain data which is commercially sensitive or confidential. Before disposal of the equipment, the company should have a procedure in place to ensure that the data held in obsolete equipment is properly destroyed and cannot be retrieved.

6.13. Obtaining support from ashore and contingency plans

Ships should have access to technical support in the event of a cyber attack. Details of this support and associated procedures should be available onboard. The yacht had identified the following company to be used in case of cyber attack:

Name of the Company:

email and telephone number:

country:

6.14. Additional protection measures

Training and awareness of the personal onboard including the master, officers and crew on the cybersecurity plan, including but not limited to:

• risks related to emails;
• risks related to internet usage, including social media;
• risks related to the use of own devices which may be missing security patches;
• safeguarding user information, passwords and pin codes
• cyber risks concerning the physical presence of external contractor personnel, where technicians are left to work on equipment without supervision;
• detecting suspicious activity or devices and how to report a possible cyber incident. Examples of this are strange connections that are not normally seen or someone plugging in an unknown device on the ship network;
• procedures for protection against risks from service providers’ removable media before connecting to the ship’s systems;
• awareness that the presence of anti-malware software does not remove the requirement for robust security procedures.

7. Respond and recover

7.1. Effective response

A team, which may include a combination of onboard and shore-based personnel and/or external experts, should be established to take the appropriate action to restore the IT and/or OT systems so that the ship can resume normal operations. The team should be capable of performing all aspects of the response.

An effective response should at least consist of the following steps:

1. If OT is affected, the DPA should be immediately informed, using Deepblue© Incident report
2. Initial assessment:
   • how the incident occurred?
   • which IT and/or OT systems were affected and how?
   • the extent to which the commercial and/or operational data is affected?
   • to what extent any threat to IT and OT remains?
3. Recover systems and data. Following an initial assessment of the cyber incident, IT and OT systems and data should be cleaned, recovered and restored.
4. Investigate the incident. To understand the causes and consequences of a cyber incident, an investigation should be undertaken by the company, with support from an external expert, if appropriate.
5. Prevent a re-occurrence. Considering the results of the investigation, actions to address any inadequacies in technical and/or procedural protection should be taken, including:
   • adaptation of the current plan;
   • investment in software, hardware, shore support consultancy.

7.2. Recovery plan

For every critical OT, recovery procedure should be available in hard copy on board and part of the dematerialised ISM on Deepblue©. The purpose of the procedures is to support the recovery of systems and data necessary to restore IT and OT to an operational state. To help ensure the safety of onboard personnel, the operation and navigation of the ship should be prioritised in these procedures.

Recovery of OT may be more complex especially and may require assistance from ashore. Details of where this assistance is available and by whom, should be part of the recovery procedures, for example by proceeding to a port to obtain assistance from a service engineer and direct contact information.

7.3. Investigating cyber incidents

Investigating a cyber incident can provide valuable information about how a vulnerability was exploited. Companies should, wherever possible, investigate cyber incidents affecting IT and OT on board. A detailed investigation may require external expert support.

The current plan should be amended based on:

• the finding of the incident
• the external support advises

Training onboard should include experience learned from previous cyber incidents.

7.4. Cover for liability

For insurers, the term “cyber” includes many different aspects and it is important to distinguish between them and their effects on insurance cover. Some insurers believe that there is no systemic risk to ships arising from a cyber incident and the impact of an incident will most likely be confined to a single ship.

Companies should be able to demonstrate that they are acting with reasonable care in their approach to managing cyber risk and to protecting the ship from any damage that may arise from a cyber incident.

7.5. Cover for property damage

Generally, in many markets offering marine property insurance, the policy may cover loss or damage to the ship and its equipment caused by a shipping incident such as grounding, collision, fire or flood, even when the underlying cause of the incident is a cyber incident. It may be noted that currently in some markets, exclusion clauses for cyber attacks exist. If the marine policy contains an exclusion clause for cyber attacks, the loss or damage may not be covered.

Companies are recommended to check with their insurers/brokers in advance whether their policy covers claims caused by cyber incidents and/or cyber-attacks.

7.6. Cover for liability

It is recommended to contact the P&I Club for detailed information about the cover provided to shipowners and charterers in respect of a liability to third parties (and related expenses) arising from the operation of ships.

An incident caused, for example by malfunction of a ship’s navigation or mechanical systems because of a criminal act or accidental cyber attack, does not in itself give rise to any exclusion of normal P&I cover. In the event of a claim involving a cyber incident, claimants may well seek to argue that the claim arose as a result of an inadequate level of cyber preparedness. This, therefore, further stresses the importance of companies being able to demonstrate that they are acting with reasonable care in their approach to managing cyber risk and protecting the ship.

8. Simplified Network Diagram

9. Revision History