(+30) 2118501121



GDPR TMSA Cyber Security


Tanker owners should be prepared for new EU and IMO cyber security regulations as they must already comply with maritime security requirements under OCIMF’s TMSA 3, writes Martyn Wingrove

There are increasing amounts of cyber security-related regulations that shipping companies will have to comply with, but tanker owners are already ahead of the game. Ship operators will need to include cyber in ship safety and security management under the ISM Code from 1 January 2021.

Before that, they need to be aware of cyber and data security regulations, including the EU general data protection regulation (GDPR) and the EU directive on the security of networks and information systems (NIS).

Much of the requirements under these forthcoming or new regulations are already within Oil Companies International Marine Forum (OCIMF)’s third edition of the Tanker Management and Self Assessment (TMSA) best practice guidelines. This came into force on 1 January this year, with a new element on maritime security and additional requirements of key performance indicators and risk assessments.

Regulation changes were outlined at Riviera Maritime Media’s European Maritime Cyber Risk Management Summit, which was held in London on 15 June. The event was held in association with Norton Rose Fulbright, whose head of operations and cyber security Steven Hadwin explained that “data protection and cyber security needs to be taken seriously from a legal point of view.”

Data, such as information on cargo and charterers, could “become a considerable liability”. If data is lost “then GDPR could be in play” said Mr Hadwin. Regulators “could impose a fine of up to 4% of that organisation’s global annual turnover.”

PwC UK cyber security director Niko Kalfigkopoulos explained the legislation and reasoning behind the NIS Directive, which went into full effect in May this year.  “These regulations have teeth” he said because of the potential size of fines and damage to a company’s reputation from being a victim of a cyber attack. This is one of the reasons why boardroom executives should be aware and understand what is required for compliance.

Class support

During the summit, class societies provided cyber security guidance as they collectively attempted to define cyber secure ship notations. Lloyd’s Register cyber security product manager Elisa Cassi said shipping companies should have a third party monitor their IT network and the operational technology (OT) and employ staff to “stop people sharing data or compromising procedures”.

Tanker owners “need to identify any compromise before an attacker tries to penetrate”, Ms Cassi explained, noting that shipping companies need to “investigate the vulnerabilities through analytics and machine learning”, understand the behaviour of potential threats and use predictive analysis.

ABS advanced solutions business development manager Pantelis Skinitis said shipowners need to change passwords on operational technology, such as ECDIS and radar, as some remain unchanged since they were originally commissioned on the ship. He also advised owners to verify vendors and service engineers and that their USB sticks are clean of malware.

ABS has created cyber safety guidance for ship OT, particularly for ships coming into US ports and terminals. In its development, ABS identified the risks, vulnerabilities and threats to OT. “Managing connection points and human resource deals with the biggest threat to OT systems on board,” said Mr Skinitis.

DNV GL has developed new class notations covering cyber security of newbuildings. It has also produced an online video for instructing shipping companies to become more aware of cyber threats. During the summit, DNV GL maritime cyber security service manager Patrick Rossi said ship operators should set up multiple barriers to prevent hackers.

These should include firewalls, updated antivirus, patch management, threat intelligence, intrusion detection, emergency recovery and awareness testing. OT should be segregated from open networks, only official ENC-provider USBs and update disks should be used and cleaned of malware before being inserted into ECDIS and these systems should be segregated from the internet.

Cyber regulations and guidance for shipping

EU General Data Protection regulation (GDPR) came into effect from 25 May 2018

IMO – Resolution MSC.428(98) – from January 2021 cyber security will be included in the ISM Code

TMSA 3 – cyber security was added to tanker management and assessment in January 2018; EU directive on the security of networks and information systems (NIS Directive) from May 2018

EU privacy rule (PECR) of individuals traffic and location data

Rightship added cyber security to inspection checklist

BIMCO – guidelines based on International Association of Classification Societies




AMSA Pre PSC Audit



While in an Australian port, your ship may be subject to inspection. If your ship is found to have deficiencies, it may be detained until the issue is resolved.

The AMSA is looking for pre-existing deficiencies that are not reported prior to a vessels arrival or at the time of initial port State boarding.  The increased scrutiny is resulting in a significant increase in AMSA detentions.  The AMSA inspector will ask if there are any deficiencies and if the inspector finds pre-existing deficiencies, and appropriate corrective action has not been initiated, they will assume the owner/Master intends to sail with the deficiencies un-addressed and will issue a detention.

To prevent a vessel detentions and avoid costly delays owners, operators, DPA’s should require Master’s and crew to report any inoperable equipment, system, etc., and ensure corrective action has been initiated, in accordance with the company’s Safety Management System.

The following are examples of pre-existing deficiencies that resulted in detentions and could have been avoided had they been reported in advance and corrective action initiated:

  • Failure to report Sewage treatment plant as defective
  • Failure to report cargo holds ventilators cover and gooseneck ventilators unable to close watertight.
  • Failure to report fire dampers, fore peak vent heads, fire detection repeater, defective.
  • Failure to report lifeboats, rescue boats and  on load release arrangement defective.
  • Failure to report problems related to Emergency generator.
  • Failure to report Radio and communication equipment defective.
  • Bridge officers are using unapproved ECDIS for navigation

For your information AMSA has and will detain a vessel if:

  1.  It does not have up to date charts, and navigational publications, repeated use of scanned charts from previous voyages and
  2. The crew cannot successfully demonstrate the operation of the:
    1. OWS,
    2. ECDIS, and
    3. Emergency fire pump.

SHIP IP LTD – can prepare your vessel(s) for such an inspection – In case you have vessel(s) calling at Singapore soon please get in contact with us so we can arrange on-board attendance  !


Maritime Cyber Attack

Cyber attacks like the NotPetya malware that struck Maersk are raising concerns about cyber risk and its effects on resilience, according to specialty insurer XL Catlin

Shipping industry firms and port operators are worried about linkage between cyber-attacks and supply chain risk, insurer XL Catlin has warned.

Big interdependencies between systems mean maritime firms face major business continuity risks from online threats.

“The problem is that nobody knows, other than the computer systems, where your goods are,” said Pascal Matthey, head of global lines for marine risk engineering at XL Catlin.

“You might never find your container again. Refrigerated containers might lose power, which would mean huge damage,” said Matthey.

Maersk was among those organisations worst hit by the NotPetya contagious malware attack last year.

The global shipping and logistics firm had to reinstall some 4,000 servers, 45,000 PCs, and 2,500 applications; the process took 10 days and cost the company around $450m.

The company was forced to temporarily switch to manual systems – pen and paper, and lots of overtime – resulting in a temporary 20% drop in volumes.

Another cyber-attack, revealed in 2013, struck two shipping companies operating in the Belgian port of Antwerp, and had reportedly gone undetected for about two years before that.

An organised crime group allegedly used hackers to infiltrate computer networks, allowing cocaine and heroin, hidden in containers shipped from South America, to be intercepted by criminals.

“The idea was not to harm the port but to get things out by hacking the system,” said Matthey, based in the specialty insurer’s Zurich office.

He warned about the potentially catastrophic consequences of a cyber-attack by terrorists, such as targeting a ship and interfering with its steering or navigation to cause a collision in congested waters, such as a port or major trade artery such as the Panama Canal.

Maritime Cyber Attack

“What happened on 9/11, you could perhaps now do with a ship, by steering a large vessel into an oil or gas terminal, which could have disastrous consequences,” said Matthey.

XL Catlin is among those re/insurance firms involved in developing blockchain applications – distributed ledger technology for smart contracts, sharing data instantaneously between the relevant counterparties.

A new blockchain platform for marine insurance contracts at XL Catlin and MS Amlin is expected to go live this year.

Maritime Cyber Attack




The insurance losses and liabilities arising from cyber risks is an increasing area of focus for both shipowners and their insurers, argues Mr. Adrian Durkin, Director (Claims) and Mr. Colin Gillespie, Deputy

Potentially owners may be exposed to gaps in cover arising from cyber incidents – an unsatisfactory situation in today’s connected world. For example, an owner’s hull and machinery insurance may contain a cyber risk exclusion which mirrors, or is derived from, institute clause 380.

There are also cyber exclusions in war risk policies that relate to computer viruses. The war risks clause is derived from market clause 3039. Many other market insurance policies specifically exclude losses or liabilities arising as a result of cyber risks.

Why is Cyber Excluded?

Cyber risks present a range of issues for insurers. Cyber risks are relatively new – claims data relating to these risks is quite limited. Another difficulty is that cyber security is not yet well established in the maritime industry. The sheer complexity of the information technology, operational technology and internet available across the industry also presents a challenge, as does the potential for cyber problems to spread quickly across the globe. As a result the likelihood, extent and costs associated with claims involving cyber risks are difficult to calculate and potentially significant, hence the reluctance to offer cover.

It is in an owner’s interests to scrutinise their various policies in order to identify potential gaps in their insurance cover. It is possible to close the gaps by working with insurers and brokers. This may require owners to demonstrate that they have robust cyber risk management practices in place both ashore and afloat. An additional premium may be payable. The market is responding to these risks – albeit slowly.

P&I Cover for Cyber Risks

The International Group of P&I Clubs’ poolable cover does not exclude claims arising from cyber risks.

This means that club members benefit from the same level of P&I cover should a claim arise due to a cyber risk, as they would from such a claim arising from a traditional risk. As always cover is subject to the club rules.

While there are currently no internationally agreed regulations in force as to what constitutes a prudent level of cyber risk management or protection, this does not mean that owners, charterers, managers or operators of ships can ignore the need to take proper steps to protect themselves in the belief that their club cover will always respond.

If a claim with a cyber element arises, an owner may need to demonstrate that they took all obvious steps to prevent foreseeable loss or liability. As more and more potential cyber risks are being identified, clubs will expect to see the operation of sensible and properly managed cyber risk policies and systems both ashore and on vessels.


Don’t delay – act now

Barely a month goes by without news of a major cyber-attack affecting a large or high profile commercial or government entity. Cybercrime is a rapidly growing global threat in all industries and the maritime supply chain is vulnerable as the problems experienced by Maersk in 2017 have demonstrated. In that incident problems ashore had a knock on effect on vessels, highlighting the fact that as marine transport operations become more connected, the more chance there is of problems impacting across the system both ashore and afloat.

The authorities and large charterers are concerned about the risk to operations ashore and afloat and are taking steps to drive change in the industry. Actively managing cyber risks is now both a commercial and compliance priority.

Cyber Risks & ISM Code

The IMO’s Maritime Safety Committee (MSC) has confirmed that cyber risks should be managed under the ISM Code.

Resolution MSC.428(98) affirms that an approved safety management system should take into account cyber risk management and encourages administrations to ensure that cyber risks are appropriately addressed in safety management systems no later than the first annual verification of the company’s Document of Compliance after 1 January 2021.


Cyber risk management has been included in TMSA 3 under elements 7 and 13. KPI 7.3.3 includes cyber security as an assigned responsibility for software management in the best practice guidelines. Under element 13 cyber security is specifically identified as a security threat to be managed. It seems clear that the oil industry has recognised the need for action from tanker owners and is encouraging action through commercial pressure via TMSA 3. For tanker operators the time to act is already here.

Rightship Inspections

Cyber risk management now forms part of Rightship inspections and a company’s cyber security maturity may be one aspect dry bulk charterers will take into account.

A Daunting Task?

The prospect of dealing with cyber security will be daunting for many shipping companies. It’s new, involves things that may not be fully understood, and most of us are not likely to have received any formal training in such risks.

What is a definite plus is that shipping companies will be very familiar with the risk management framework suggested by the IMO Guidelines on Cyber Risk Management and industry Guidelines on Cyber Security Onboard Ships. We can also use the experience gained in other sectors of industry that have already put cyber security systems in place.

2021 is not far away, but the potential for cyber risks to result in losses or liabilities is clearly already upon us.

Cyber risks can affect almost every part of a shipping company. There will be lots to do to identify risks and vulnerabilities and to take steps to prepare for, and respond to, cyber threats. It’s time for us all to act.

By Adrian Durkin, Director (Claims) & Colin Gillespie, Deputy Director (Loss Prevention), North P&I Club

Asian Gypsy Moth – Introduction
The Asian Gypsy Moth (AGM) is a highly destructive forest pest that feeds on both deciduous and coniferous trees.
The voracious appetite of AGM larvae (caterpillars) coupled with the ability of the female moth to travel up to 21 nautical miles can cause widespread defoliation leaving trees weakened and susceptible to disease and other pests.
AGM is found in the Far East with a high risk of infestation of vessels with AGM eggs in Korea, Northern China (North of
Shanghai; North of latitude 31 ̊15’N), and in particular in the Russian Far East and Japan during the flight season of the female moth.
Due to the destructive nature of the AGM, the following countries, where the pest is not indigenous, have procedures
in place to prevent AGM entering on vessels and becoming established:
•New Zealand
•United States
The inspection of vessels for the presence of egg masses, their removal and disposal are the principal tools in preventing AGM
becoming established in new regions. Some destination countries require vessels that have called in high risk countries
during the flight season to be inspected for the presence of AGM by a nominated authority immediately prior to departure.
If no signs of AGM infestation are found, the nominated authority will issue the vessel with certification stating that it is free of AGM; depending on the issuing authority the certificate may be a “Certificate of Inspection of Freedom from the Asian Gypsy Moth” or a “Phytosanitary Certificate”. If multiple ports in the same country or a number of ports in different countries within the high risk area are visited, the official inspection
should be undertaken immediately prior to departure from the last port in the high risk area.



Is your vessel FREE OF AGM ? Call SHIP IP LTD TODAY to arrange an Inspection on board your vessels calling at Singapore!

Vessels which fail to comply with such requirements or which are found to be carrying AGM after inspection may be ordered into international waters till they are deemed to be completely risk free.


The Asian Gypsy Moth (AGM) is an exotic and highly destructive forest pest which is native to Far East countries such as Japan, Russia, China and Korea. AGM have the ability to cause extensive defoliation of trees, either killing them or leaving them weakened and open to other diseases and pests.

The AGM’s flight season, i.e. the period during which the females lay eggs, normally runs between June and September. Therefore, ships calling in those Far Eastern ports where AGM are found in high density during such period are likely to be infested with egg masses on some part of the cargo or external area of the vessel.

Female AGM are attracted towards bright lights, thus any part of the vessel which is lit up has a high chance of being deposited with egg masses. Such egg masses are extremely tough and resistant to changes in temperature as well as moisture. Once deposited on the structure of the vessel, usually in sheltered locations, they travel well and are very tough to displace. After they hatch, the ability of the female moth to travel as far as 21 nautical miles, along with its voracious appetite to feed on trees and shrubs, makes it a highly invasive species that poses a serious threat to the landscape and natural resources of a country.

Due to these reasons, certain countries where the AGM is not indigenous have put into place procedures in order to prevent vessels which may be carrying such pests from entering their ports. They include the United States, Canada, Australia, New Zealand and Chile.

Such procedures consist of the requirement of certification from the port of departure in high risk areas verifying that the vessel is free from AGM and also inspections at the port of arrival of ships suspected of carrying AGM onboard.

Please contact us TODAY for a FREE Obligation Quotation – Our Network being trusted by TOP Maritime Companies!


| T: ( +30) 211 850 1121
| e: sales@shipip.com
| w: https://shipip.com


Maritime External  Cyber Security Audit

[wp_cart_button name=”MCSM-CYBER SECURITY MANUAL” price=”1500″]


Vulnerability scanning is an inspection of the potential points of exploit on a computer or network to identify security holes. A vulnerability scan detects and classifies system weaknesses in computers, networks and communications equipment and predicts the effectiveness of countermeasures.

SHIP IP LTD via our Network of local engineers can attend your vessels and complete an External  Cyber Security Audit that includes and not limited to :

  •  Policies and Procedures
  • Cyber security risk management
  • Training and awareness
  • Physical security and access control
  • Network security
  • Vulnerability scan of your onboard network

Why you should ask for an External Cyber Security Audit ? 

Answer is straight forward and that because both TMSA and RightShip have already include it as a requirement to their latest revisions which you can read below 

Where are our specialist located ?

Singapore and Greece.

We can cover ASIA and EUROPE via our engineers.

How much it costs ?

That it depends the port and country we visit but for example in Singapore can be as low as USD 1500 all included !

Time Required to complete the Audit ?

Under normal circumstances our Singapore Team will complete the Audit same day . Boarding Team consists of our Captain Thum and our Local IT Engineer .

We have post below relevant Requirements : 



2.4 The company actively promotes cyber security awareness.

Effective means are used to encourage responsible behaviour by shore-based personnel, vessel personnel and third parties.

Such behaviour may include:

• Locking of unattended work stations.
• Safeguarding of passwords.
• No use of unauthorised software.
• Responsible use of social media.
• Control/prevention of misuse of portable storage and memory sticks.



4.2 Independent specialist support is used to mitigate identified security threats.

Any contracts for specialist support both onboard and ashore, are supported by a comprehensive scope of work.


4.5 The company is involved in the testing and implementation of innovative security technology and systems.

This may include:

• Physical measures to improve security.
• Software enhancements to IT systems.


Inspection and Assessment Report For Dry Cargo Ships

4.7 Cybersecurity
4.7.1 Does the vessel and/or company have documented software/firmware and
hardware maintenance procedures ………………………………………………………….? Are service reports available ………………………………………………………..?
4.7.2 Does the vessel and/or company have any cyber security procedures…………..? Has a Risk Assessment for Cyber attack been completed. ……………….? Is a Cyber attack Response Plan available …………………………………….?
4.7.3 Does the vessel and/or company provide any cyber security training ………..


| T: ( +30) 211 850 1121
| e: sales@shipip.com
| w: https://shipip.com
| Skype : anyawb1

SINCE 2013


Maritime Cyber Security – Five key cyber questions and challenges facing the maritime industry!

To wrap up this year’s National Cybersecurity Awareness Month series, Lt. Cmdr. Brandon Link with the Office of Port & Facility Compliance poses five key questions maritime professionals can consider when deciding how to manage risks to cyber systems.


Cyber systems are prevalent in our daily lives. We face an ever-increasing amount of cyber influence in how we live, work, and operate. The Marine Transportation System (MTS) uses cyber systems in all aspects of operations. With the convenience and improved performance offered by technology come continually-evolving questions and challenges. Cyber threats are real and pose considerable risks requiring attention and action at all organizational levels.

Below are five key cyber questions and challenges facing the maritime industry and how you can begin assessing and reducing risk:

1. How much should I invest in cybersecurity and cyber risk management? The answer varies from organization to organization. Cybersecurity should be viewed as an investment, not a cost. You are in the best position to evaluate your company’s cyber footprint to determine where risks are highest. The National Institute of Standards and Technology (NIST) Cybersecurity Framework and Coast Guard/NIST Cybersecurity Profiles are a few resources available. The Coast Guard continues to work on further guidance to assist in cyber risk management efforts, including the upcoming Navigation and Vessel Inspection Circular (NVIC) 05-17, Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act Regulated Facilities.

2. We have a closed system with an air gap between our network and outside influences. Am I still at risk? Does the system have access control/authentication procedures to prohibit unknown or unauthorized access? Can an equipment vendor access that system remotely, even for seemingly harmless activities such as program updates? Can the system be accessed in person, connecting via laptop or other equipment, introducing an avenue for malicious access? To answer these questions, it is important to know and understand the landscape of, and access to your cyber systems.

3. What are the greatest threats to my cyber systems? A direct cyber attack can come from a malicious actor, either internal or external. Cyber threats can also arise from accidental corruption, like an employee unknowingly connecting a corrupted device (smart phone, “thumb” drive) to a USB port. Risks can increase due to improper system configurations or failure to stay current on software updates. Having policies in place to account for these issues, and ensuring employee awareness, can greatly reduce risks.

4. I think our organization is the victim of a cyber attack or incident. Who can I notify? The National Cybersecurity and Communications Integration Center (NCCIC) is a 24/7 cyber situational awareness, incident response, and management center serving as the national nexus of cyber and communications integration for the Federal Government, intelligence community, and law enforcement. A cyber incident that does not impact physical security or include a pollution event can be reported to the NCCIC at 1-888-282-0870, who will then forward the report to the National Response Center (NRC), meeting the reporting requirements in 33 CFR 101.305, if made aware that you are calling as a Coast Guard-regulated facility. Reports of suspicious activity or a breach of security, and incidents affecting physical security or including a pollution event should be reported to the NRC at 1-800-424-8802.

5. We need to address cyber risks in our organization, where do we begin? There is no single solution that will work the same for every company, but there are steps that will help get you on the path toward an improved cyber posture:

  • Increase cybersecurity training and awareness at all levels of your organization.
  • Understand and educate the workforce on the difference between Information Technology (IT), the storing, retrieving, transmitting, and manipulating of data, and Operational Technology (OT), the hardware and software that detects or causes changes in processes through monitoring or control of physical devices (the “Internet of Things”).
  • Establish positions, teams, or workgroups that are cyber threat-focused. Integrate your IT workforce’s corporate knowledge of systems with the OT workforce and others who possess expertise in your company’s operations.
  • Conduct an assessment to see where cyber threats exist, and identify ways to mitigate those risks. Incorporate cyber risk management into existing policies and procedures, including the Facility Security Plan. Conduct exercises that test your organization’s cyber threat resilience.
  • Identify your local Area Maritime Security Committee, particularly those with a dedicated cybersecurity subcommittee, or other opportunities that allows for the sharing of knowledge and experience. What affects your organization could affect others, so information sharing is crucial to combating threats.


Managing cyber risks will continue to be an ongoing effort requiring time and attention. The most significant threats and highest priorities may not remain the same from month-to-month or even week-to-week, so staying informed could mean the difference between a strong cyber posture or becoming victim to a cyber incident or breach.

Source :

10/30/2017: Nat’l Cybersecurity Awareness Month – Five key cyber questions and challenges facing the maritime industry



BadRabbit Ransomware !

A new cyber attack is affecting computer systems around Europe.

BadRabbit Ransomware

A strain of ransomware known as “Bad Rabbit” is believed to be behind the trouble, and has spread to Russia, Ukraine, Turkey and Germany.

Cyber security firm Kaspersky Lab, which is monitoring the malware, has compared it to the WannaCry and Petya attacks that caused so much chaos earlier this year.

Once a computer is infected, victims are sent to a page on the Tor browser that demands .05 Bitcoins (about $275) within around 41 hours, in exchange for the decryption of the data and access to the machine. If time expires, the ransom increases.

As always, anyone infected is discouraged from paying the ransom. For one, there’s no guarantee you’ll get the data back but importantly, refusing to pay the ransom discourages future ransomware attacks.

Although BadRabbit shows similarities to Petya, it’s still unclear who is behind the recent attack. The original Petya took down a number of government agencies and businesses earlier this year, mostly in Ukraine. Russia is a viable suspect for Petya, but all evidence tying the malware with any nation state has been circumstantial.

You can readmore about BadRabbit Ransomware :








IMO has given shipowners and managers until 2021 to incorporate cyber risk management into ship safety !

Owners risk having ships detained if they have not included cyber security in the ISM Code safety management on ships by 1 January 2021.

One of the discussions that took place at the IMO Maritime Safety Committee’s 98th session (MSC 98) in June was whether the IMO’s newly approved guidelines on maritime cyber risk management should be incorporated into the International Safety Management Code (ISM), the international standard for safe ship operations.

While such a directive was not formally adopted, what was adopted was a resolution affirming that approved safety management systems (SMS) should take cyber risk management into account in accordance with the requirements of the ISM.

The resolution encouraged flag administrations to ensure that cyber risks are addressed in SMS no later than the first annual verification of the company’s document of compliance after 1 January 2021.

SHIP IP LTD – Can assist your company to ensure compliance with Cyber Security requirement  as we can offer FULL support to your company like :

  • Maritime Cyber Security Manual with only EUROS 500 ( pls click here to read more… )
  • Consultancy to complete with TMSA 3 – Element 13 Maritime Security
  • ask for more …



Please prove you are human by selecting the Cup.