The three things a one-page resolution asks of a safety management system on cyber risk (MSC.428(98))

Resolution MSC.428(98) is a single page. Adopted on 16 June 2017, it does not change a word of the ISM Code. It adds no chapter and creates no certificate. Yet after it, cyber risk became a question asked at the DOC annual verification.

The reason lies in how the resolution points at the existing text. It records that the objectives of the ISM Code already include the assessment of all identified risks, and affirms that cyber risk is among those risks. That confirms the reach of an existing duty rather than creating a new one, so the Code did not need amending.

This article takes the three things the resolution asks for in turn: what to take into account, the deadline, and confidentiality. It then adds how the Administration guidelines in A.1118(30) treat a modification of the safety management system at the annual verification.

The resolution hangs cyber risk on the existing objectives of the ISM Code

NOTING the objectives of the ISM Code which include, inter alia, the provision of safe practices in ship operation and a safe working environment, the assessment of all identified risks to ships, personnel and the environment, the establishment of appropriate safeguards, and the continuous improvement of safety management skills of personnel ashore and aboard ships,

The objectives listed here are those of section 1.2 of the ISM Code: safe practices, the assessment of all identified risks with appropriate safeguards, and continuous improvement of the safety management skills of personnel. The risk assessment wording was inserted as 1.2.2.2 by MSC.273(85) in 2010, and this resolution takes it up.

1 AFFIRMS that an approved safety management system should take into account cyber risk management in accordance with the objectives and functional requirements of the ISM Code;

This is the first ask. An approved safety management system should take cyber risk management into account. The yardstick is the objectives and functional requirements of the ISM Code. The sentence does not call for a separate cyber manual; it says the existing system has to be handling that risk.

The deadline is the first DOC annual verification after 1 January 2021

2 ENCOURAGES Administrations to ensure that cyber risks are appropriately addressed in safety management systems no later than the first annual verification of the company’s Document of Compliance after 1 January 2021;

This is the second ask. The deadline has three reference points: the date 1 January 2021, the first annual verification after it, and the company’s DOC. Because the reference is the DOC annual verification and not the SMC intermediate verification, the deadline differs from company to company. The annual verification window is the three months either side of the anniversary date set by paragraph 13.4 of the ISM Code, so depending on the DOC anniversary the deadline fell early in that year for some companies and at its end for others.

Note the addressee as well. The resolution encourages Administrations, not companies, to ensure this. The company’s obligation arrives through the Administration checking cyber risk at that annual verification, so how deep the check goes differs by flag.

The annual verification covers every element of the system and whatever was modified

The annual verification will address all the elements of the safety management system and the activities to which the requirements of the ISM Code apply. The purpose of these audits is to verify that the safety management system is functioning effectively and that any modifications made to the safety management system comply with the requirements of the ISM Code.

This is paragraph 4.4.1 of A.1118(30). The annual verification addresses all elements of the safety management system and checks that the system functions effectively and that any modifications comply with the Code. A procedure that brings in cyber risk is exactly such a modification, so the company has to be able to show, through its revision history, where it was added and what was added.

As a basis for planning the audit, the auditor should review the safety management manual to determine the adequacy of the safety management system in meeting the requirements of the ISM Code. If this review reveals that the system is not adequate, the audit will have to be delayed until the company undertakes corrective action.

Paragraph 4.10 is the document review in audit preparation. The auditor reads the safety management manual first and judges whether the system meets the Code. If it falls short, the audit is delayed. If cyber risk appears nowhere in the manual, it is caught at this stage, before the on-site audit.

The guidance is MSC-FAL.1/Circ.3 and it sits on top of existing risk management

BEARING IN MIND MSC-FAL.1/Circ.3 on Guidelines on maritime cyber risk management approved by the Facilitation Committee, at its forty-first session (4 to 7 April 2017), and by the Maritime Safety Committee, at its ninety-eighth session (7 to 16 June 2017), which provides high-level recommendations for maritime cyber risk management that can be incorporated into existing risk management processes and are complementary to the safety and security management practices established by this Organization,

The guidance the resolution points to is MSC-FAL.1/Circ.3, approved by the Facilitation Committee in April 2017 and by the Maritime Safety Committee in June of the same year. The resolution describes the guidance in two ways. It is high-level recommendation, and it can be incorporated into existing risk management processes as a complement to the safety and security management practices the IMO has established. It does not call for a separate system.

The content of the circular is outside the scope of this article. Only how the resolution positions it is recorded here.

The resolution acknowledges that parts of it need to stay confidential

3 ACKNOWLEDGES the necessary precautions that could be needed to preserve the confidentiality of certain aspects of cyber risk management;

This is the third ask. Some parts of cyber risk management are information that becomes a vulnerability once disclosed. The resolution acknowledges that precautions could be needed to preserve their confidentiality. Read it not as a licence to withhold from the auditor, but as a reason to decide in advance which information is shown, to what extent and how.

4.17.2 Personnel participating in the verification are responsible for complying with the requirements governing the verification, ensuring confidentiality of documents pertaining to the certification and treating privileged information with discretion.

A.1118(30) places a duty on the verification side as well. Verification personnel keep certification documents confidential and treat privileged information with discretion. The company’s need for confidentiality and the auditor’s duty of confidentiality face each other.

Worth confirming

This article covers only the text of MSC.428(98) and the verification procedure in A.1118(30). The content of MSC-FAL.1/Circ.3 and its later revisions are not covered. The resolution is written in recommendatory terms, so how a flag checks is a matter for that flag’s procedures. When the company’s DOC anniversary falls, which revision of the safety management system brought in cyber risk, and whether that revision is on board are where the actual judgement starts.

You can consult the cited source documents

These links lead to the official publishers of the documents discussed here. Match the edition and provisions cited in the article, and check subsequent amendments and flag-state implementation before applying them.

• IMO · Resolution MSC.428(98)
• IMO · Resolution A.1118(30)

Continue with the related operational guidance

• The five lines the 2010 ISM Code amendments left in the internal audit interval and the risk assessment wording (MSC.273(85))
• Where the DOC annual verification and the SMC intermediate verification run on different clocks (ISM Code chapter 13, MSC.104(73))