Maritime cybersecurity and the IMO legal instruments: Sluggish response to an escalating threat?

Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0

“…• Govern Function: There has been a focus on 'Organizational Context' [24][25][26][27][28] and 'Risk Management Strategy' [14,[29][30][31][32][33], with several articles addressing these areas. This indicates progress in the understanding and implementation of cybersecurity within the organizational frameworks and risk management processes of maritime operations.…”

“…According to the Governance subcategory, in addressing cyber risks, comprehensive governance and risk management processes are crucial [24]. In parallel, Karim et al's [25] article critically assesses existing IMO legal instruments regarding maritime cybersecurity, highlighting the need for comprehensive international legal reform and collaboration between state and non-state actors. Furthermore, Kaczerska et al [26] examined the legislative measures that oversee cybersecurity and digitalization in maritime navigation, particularly in the context of ferry transportation, delving into the governance dimension.…”

“…Alongside this, a notable study by Shipunov et al [64] presented a computer-assisted investigation into maritime transport based on regulations. This regulatory perspective was echoed by Karim et al [25], who highlighted the insufficiencies of the current IMO framework in the face of increasingly sophisticated maritime cybersecurity threats. The need for updated and robust protection models in the context of shipping and ports within the "world 4.0" was emphasized by de la Peña Zarzuelo et al [15].…”

Literature review on maritime cybersecurity: state-of-the-art

“…Mraković and Vojinović (2019) described the connectivity between the components in the systems of a ship and advocate the adequate proactive framework to solve onboard cybersecurity problems by integrating situation awareness, building competence, and solidification, and prediction to turn the conceptual framework into practical applications. Daum (2019) and Karim (2022) emphasised that the legal environment should keep pace with various advances in the cybersecurity domain of maritime shipping, including duty and sanction catalogue clarification. The IOM guidelines and regulations with specific and detailed maritime cybersecurity actions are precedents and predecessors for legislation and amendments.…”

Protective security at sea: a counter terrorism framework for cruise and passenger ships

“…Other developments related to the protection of information include two IMO legal instruments adopted in 2017: a non-mandatory cyber-guideline [23] and a resolution on the application of the international safety management code (ISM) Code [24]. However, many agree "maritime cybersecurity is yet to get proper attention on the IMO agenda" and so legal instruments on maritime safety, security and facilitation of maritime tra c have become relevant in a legal context for maritime cybersecurity [29]. The ambiguous use of such guidelines, as demonstrated in the case of cybersecurity, underscores the need for a comprehensive protectively security framework which not only acknowledges but synthesises existing e↵orts to look at information security on ships-and further pulls together on land and at sea activities.…”