Loading…
Maritime cyber security is one of the fastest-growing specialist roles in the shipping industry. Since IMO Resolution MSC.428(98) made cyber risk management mandatory in ship Safety Management Systems from 2021, demand for professionals who combine maritime operational experience with cyber security expertise has grown substantially — and it is expected to grow further as IACS Unified Requirements E26 and E27 (mandatory from July 2024 for new builds) drive class society and flag-state compliance requirements. Experienced deck and engine officers — particularly Chief Mates, Chief Engineers, and ETOs — are well-positioned to transition into maritime cyber roles, bringing the operational technology (OT) systems knowledge that pure IT cyber specialists lack. STCW sets the international floor for the underlying CoC; maritime cyber is an emerging area where class society and industry frameworks are developing faster than flag-state regulation. See the surveyor and auditor careers page for related ashore transition paths, and the career pathways reference.
Yes, since 2021. IMO Resolution MSC.428(98) requires that cyber risk management be incorporated into a ship's Safety Management System (SMS) under the ISM Code no later than the first annual verification of the company's Document of Compliance (DOC) after 1 January 2021. This means ship operators must identify cyber risks, document mitigation measures, and demonstrate compliance during ISM audits. The Resolution does not prescribe specific technical standards, but references IMO MSC-FAL.1/Circ.3 (Guidelines on Maritime Cyber Risk Management) and industry frameworks including the BIMCO Cyber Security Workbook and OCIMF Cyber Security Framework.
IACS Unified Requirements E26 (Cyber Resilience of Ships) and E27 (Cyber Resilience of On-Board Systems and Equipment) are mandatory requirements from the International Association of Classification Societies (IACS) that apply to vessels contracted for construction on or after 1 July 2024. E26 sets ship-level requirements for cyber resilience across five domains: identify, protect, detect, respond, and recover. E27 sets equipment-level cyber requirements that marine equipment manufacturers must meet. Together, they are the most detailed mandatory technical framework for maritime cyber security to date and are expected to drive significant demand for maritime cyber expertise.
For most roles in maritime cyber — including shipboard cyber officer, fleet cyber manager, and class society cyber consultant — a combination of maritime operational experience plus a recognised cyber security qualification is the expected profile. Widely recognised certifications include: CISSP (Certified Information Systems Security Professional), CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), and CompTIA Security+. The maritime-specific overlay — ISM Code, STCW, IACS UR E26/E27, OT (operational technology) systems — is typically gained from seagoing experience. No dedicated IMO STCW standard yet exists for maritime cyber officers, but class societies and BIMCO are developing competency frameworks.
IT (Information Technology) systems on ships include administrative networks, crew welfare internet, company intranet, voyage management systems, and email servers. OT (Operational Technology) systems include navigation systems (ECDIS, AIS, GPS, radar), propulsion control, GMDSS, dynamic positioning, cargo monitoring and control systems, and engine-room automation. OT cyber attacks are of greater safety significance because they can directly affect vessel navigation, propulsion, or cargo safety. Maritime cyber specialists must understand both domains — and the interfaces between them — as the integration of IT and OT networks on modern vessels creates significant cross-contamination risk.
Several class societies offer voluntary cyber notation schemes: DNV CyberSecure (Level 1 and Level 2, with Level 2 requiring third-party penetration testing), Lloyd's Register ShipRight Cyber (notation applied at new build or retrofit), Bureau Veritas Cyber Resilience notation, and ABS CyberSafety. While these notations are currently voluntary (beyond IACS UR E26/E27 mandatory requirements), some charterers, cargo owners, and insurers are beginning to include cyber notation in their vetting criteria — similar to how SIRE vetting has operated in the tanker sector. For maritime cyber specialists, familiarity with the class society cyber framework is essential.
Flag-state caveat: STCW sets the international floor for the underlying seagoing CoC. Maritime cyber security requirements are currently governed primarily by IMO resolutions, IACS unified requirements, and class society frameworks — not by STCW. Individual flag states are developing national implementations at different speeds. Always verify current requirements with the issuing flag-state administration and the relevant class society.
This page is for information only and does not constitute legal or professional advice. Cyber regulations are evolving rapidly — verify with the relevant authorities before acting.