Maritime Cybersecurity: NIS2 Responsibilities Across Shipping Management, IT, OT and Crew

Maritime cybersecurity is an operational responsibility

Cyber risk in a shipping company rarely starts and ends in the data centre. It affects the connection between shore organisation, vessel, suppliers, and port. A compromised account can alter planning data, a missed update can impair an onboard system, and a poorly coordinated response can turn an IT outage into a safety or operational problem. The organisation therefore needs one shared way of working that connects technology, decision rights, exercises, and retrievable evidence. This guide is not a substitute for case-specific advice. It shows how responsible teams can turn abstract duties into reliable routines for fleet and shore operations.

The starting point should not be a long list of technical products, but the operation: which digital functions matter for navigation, communication, cargo, maintenance, crew change, billing, and the safe conduct of the voyage? Teams that answer this together see dependencies earlier and avoid having IT, fleet management, and the master plan separately. The overview of <a href="https://conformbase.com/en/shipping-companies">training for shipping companies</a> helps place these topics within existing roles and learning paths instead of treating cybersecurity as an isolated project.

Read NIS2 first as a scope and governance question

The <a href="https://eur-lex.europa.eu/eli/dir/2022/2555/oj">NIS2 Directive</a> requires in-scope entities to adopt risk-based cybersecurity measures. Articles 20 and 21 do not focus only on technical controls. They also direct attention to oversight by management bodies, risk management, incident handling, business continuity, supply chains, access control, and training. For a shipping company, this does not produce an automatic answer on whether it is in scope. It needs a documented assessment of activity, size, jurisdiction, and national implementation. That assessment belongs in an owned decision with a date, source, and next review date.

The practical question is therefore: which decision must leadership make, what information does it need, and how will the organisation track whether agreed measures work? A monthly technology report on its own is not enough. A concise steering report should show open risk, impact on vessels and shore operations, responsible role, decision taken, due date, and escalation route. This keeps visible what should be accepted, treated, transferred, or closed. Leadership can then exercise oversight without personally judging every technical setting.

Create one shared role model for vessel and shore

Maritime cybersecurity often fails at unclear interfaces. IT can secure accounts, but it does not automatically own decisions on safe ship operation. The master can recognise effects onboard, but may not hold all information about central services or suppliers. Fleet management, the Designated Person Ashore, technical inspection, HR, and procurement therefore need one shared role model. The distinction in <a href="https://conformbase.com/en/ism-isps-differences-responsibilities-training-evidence-shipping-company">ISM and ISPS responsibilities</a> is useful here: safety management, security duties, and technical controls may connect, but must not be blended invisibly.

A usable matrix answers five questions for every important workflow: who detects the deviation, who assesses operational impact, who may order an action, who informs external parties or customers, and who confirms resumption? Record a deputy for periods outside office hours as well. The separation between technical advice and operational release is especially important. It prevents a quick technical fix from changing the operation without involving the responsible nautical or operational role.

Make critical dependencies visible across the voyage

Start with a manageable map rather than a complete inventory. For one typical voyage, plot the services without which a safe or commercially orderly operation cannot continue: communication paths, identity services, route and weather information, maintenance access, cargo data, port notifications, and handover ashore. Add the owner, interface, fallback, data type, supplier, and recovery objective for each service. This produces a list that can actually be used during exercises, changes, and disruptions.

The map should describe operational reality, not just systems from the IT register. During <a href="https://conformbase.com/en/port-state-control-preparation-evidence-vessel-shore-joint-check">port state control preparation</a>, accountable roles, records, and actual processes matter together. Apply that thinking to cyber risk: for which service is a current instruction available on board, where can shore support be reached, which manual alternative is permitted, and which decision cannot wait? If these answers are absent, the gap is prioritised work, not a note for later.

AI-generated

Assess risk without overloading vessels with forms

A good risk assessment is short enough to support decisions. For every prioritised service, scenario, likely cause, safety and operational consequence, existing control, responsible role, and next action are often sufficient. Use concrete scenarios: a lost multi-factor device, a locked supplier account, suspicious remote access, a missing update approval, or a manipulated attachment. Only specific situations show whether crew and shore organisation understand the same escalation logic.

Connect the assessment to other duties without equating the subjects. The article on <a href="https://conformbase.com/en/eu-ets-mrv-shipping-data-handoffs-roles">EU ETS and MRV data handoffs</a> shows why clearly defined transfers between vessel and shore matter. The same discipline helps with cyber risk: source, handler, plausibility check, and approval must remain visible. This does not mean emissions data automatically become a cyber matter. It means critical data paths, permissions, and exceptions should be owned and evidenced in both cases.

Control access, remote maintenance, and changes

Remote access and supplier access deserve their own operating rule. Define when access is requested, who limits it in time, how the vessel side is informed, where activity is logged, and how access ends again. Review not only privileged accounts, but also shared mailboxes, service portals, mobile devices, and emergency access. Every exception needs an expiry date and a role that confirms closure. This rule protects both the operation and supplier from the assumption that somebody else will control it.

Changes to connected systems must not appear only as background tickets. They need an assessment of whether navigation, communication, maintenance, cargo, or evidence processes may be affected. The coordination in <a href="https://conformbase.com/en/fueleu-maritime-daily-work-bunker-team-technical-compliance">FuelEU Maritime in daily work</a> offers a useful pattern: data, the business function, technology, and compliance must meet at one point before a decision is treated as complete. For cyber changes, that means documenting technical tests, operational release, fallback plan, and communication as one coherent closure.

Train crews without generic awareness slogans

Effective training does not only describe phishing or strong passwords. It rehearses the decision that must actually be made on board: an unusual call requests a payment change, a supplier asks for remote access, an email attachment concerns cargo papers, or a navigation system behaves unexpectedly. The person on board needs a clear first step, a reachable contact, and confidence that an observation can be reported without blame. Short formats before watch change or for new crew rotations often work better than one annual group session.

Plan learning objectives by role and situation. The <a href="https://conformbase.com/en/compliance-training-matrix-shipping-companies-vessel-shore-port">compliance training matrix for shipping companies</a> offers a model for assigning work across vessel, shore, and port. Add cyber decisions, not only topic headings: who recognises a suspicious message, who locks an account, who assesses voyage impact, and who records the case as evidence? This keeps clear which competence was tested and which role must be able to act in an incident.

AI-generated

Organise incident management as a shared exercise

A reliable process begins with a simple decision table: what is secured immediately, when is vessel operation assessed, when is a supplier involved, who informs leadership, and which facts must be clarified before any external notification? Test this process with at least one plausible case involving shore and vessel. Record not only response time, but also conflicting assumptions, missing contact details, and decisions without a named deputy. Those are the findings from which the next improvement is made.

After an exercise or a real event, the organisation needs closure beyond technical restoration. Was the cause assessed, were temporary accesses closed, were instructions updated, did the affected role learn, and is the decision retrievable? The logic in <a href="https://conformbase.com/en/training-records-without-spreadsheets-audit-ready">training records without spreadsheets</a> also fits here: evidence joins responsibility, delivery, result, and a retrievable record. Only this chain turns an incident into a manageable improvement.

Bring suppliers and a 60-day plan into the same governance

Suppliers are part of the risk position when they provide maintenance, cloud services, communication systems, portals, or data access. Before contracting and at renewal, ask about incident contacts, notification periods, remote access, subcontractors, data return, logs, and exit support. Assess the answers by their operational importance and agree improvements with an owner and due date. A questionnaire without a follow-up decision does not create control.

In the first 30 days, the shipping company should make its role matrix, critical services, contact routes, and most important remote accesses traceable. Over the following 30 days, it runs a shared exercise, closes the highest-priority gaps, and establishes a fixed reporting rhythm for leadership and fleet operations. The aim is not perfect completeness. The aim is a visible order: first dependencies with high safety or operational impact, then recurring controls, then deeper work. Maritime cybersecurity becomes an ongoing operating discipline rather than a one-off campaign.

In daily operations, a fixed handover point prevents observations from vessel operations disappearing in email inboxes. After every relevant disruption, change, or exercise, the named owner records status, affected services, immediate actions, open decisions, and the next date in one concise shared register. The report must be available in the same version to shore organisation and vessel. Improvements are then not merely agreed, but followed through to effective delivery. This routine is particularly valuable during crew change, when knowledge could otherwise disappear with individual people or shifts.