BIMCO Cyber Security

International

vThe Guidelines on Cyber Security Onboard Ships, version 5 (November 2024)

8 domains

40 controls

BIMCO's cyber security guidelines for ships (version 5, November 2024), produced with shipping industry associations, insurers, class and companies, help shipowners and managers build cyber risk management into the Safety Management System in line with IMO resolution MSC.428(98) and MSC-FAL.1/Circ.3, drawing on the NIST Cybersecurity Framework. They cover governance and roles (senior management, IT and OT differences, SMS and Ship Security Plan procedures, relationships with managers, agents and vendors), identifying threats and vulnerabilities, assessing likelihood and impact, a four-phase ship risk assessment, protection (defence in depth and breadth, technical and procedural measures), detection, contingency planning including disconnecting OT from shore, and response, recovery, investigation, insurance and incident reporting. They are guidance and expressly not a basis for external audit.

Verified

BIMCO Cyber Security is a compliance framework from International with 8 domains and 40 controls that map to 2 other frameworks. The largest domains are BIMCO Ch1: Cyber Security and Risk Management (8 controls), BIMCO Ch4-6: Likelihood, Impact and Risk Assessment (8 controls), BIMCO Ch10: Respond and Recover (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

BIMCO Ch10: Respond and Recover

7 controls

Controls in the BIMCO Ch10: Respond and Recover domain of BIMCO Cyber Security: 7 controls
Code	Title	Description
BIMCO-10.2	The four phases of incident response	Following NIST, preparation (roles, prioritised critical components and their location, regular backups, single points o...
BIMCO-10.3	Recovery plan	Keep hard-copy recovery plans aboard and ashore for those handling cyber incidents, as part of the business continuity p...
BIMCO-10.4	Data recovery capability	Be able to restore systems and data from a secure image or copy to get a clean system, with governance keeping backup im...
BIMCO-10.5	Investigating cyber incidents	Investigate incidents affecting IT and OT under company procedures wherever possible, with external experts if needed, s...
bimco-cyber-security::10.1	Effective response	Start from the response plan but supplement it with scenario playbooks (malware, data leaks, denial of service, system u...
bimco-cyber-security::10.6	Losses arising from a cyber incident	Insurers treat risk assessment and mitigation as a precondition of cover and ask ever more about cyber programmes; econo...
bimco-cyber-security::10.7	Reporting of cyber incidents	Incident reporting is increasingly a regulatory or contractual duty toward flag and coastal states, customers, vendors a...

BIMCO Ch1: Cyber Security and Risk Management

8 controls

Controls in the BIMCO Ch1: Cyber Security and Risk Management domain of BIMCO Cyber Security: 8 controls
Code	Title	Description
BIMCO-1.2	Senior management involvement	Senior management, not only the ship security officer or IT manager, should stay involved because cyber risks threaten s...
BIMCO-1.3	Roles, responsibilities and tasks	Allocate cyber risk responsibilities and tasks clearly across the company, including any outsourced to third parties, an...
BIMCO-1.4	Differences between IT and OT systems	IT manages data and business functions; OT directly monitors or controls physical equipment and must work independently...
BIMCO-1.5	Plans and procedures	Under IMO resolution MSC.428(98) the SMS should address cyber risk in line with the ISM Code, and MSC 101 agreed that cy...
BIMCO-1.8	Relationship with vendors and other external parties	Evaluate the physical and cyber security of dealings with service providers, vendors and other outside parties, public a...
bimco-cyber-security::1.1	Cyber security characteristics of the maritime industry	Cyber security protects IT, OT, information and data against unauthorised access, manipulation and disruption, and incid...
bimco-cyber-security::1.6	Relationship between shipowner and ship manager	The Document of Compliance holder is ultimately responsible for managing onboard cyber risk. Where a third party manages...
bimco-cyber-security::1.7	Relationship between the shipowner and the agent	Ship agents exchange sensitive, financial and port coordination information continuously with owners, operators, termina...

BIMCO Ch2: Identify Threats

4 controls

Controls in the BIMCO Ch2: Identify Threats domain of BIMCO Cyber Security: 4 controls
Code	Title	Description
BIMCO-2.1	Threat actors	When identifying threats, consider each potential actor's capability, opportunity and intent, then weigh threats against...
BIMCO-2.2	Types of cyber threats	Threats are untargeted (the ship or company is one of many victims or collateral damage, as with NotPetya, using tools f...
bimco-cyber-security::2.3	Stages of a cyber incident	Breaches often go unnoticed for long periods (the Guidelines cite an average of 277 days to contain in 2019). A targeted...
bimco-cyber-security::2.4	Quantifying the threat	Threat is the product of an actor's capability, opportunity and intent, and feeds likelihood; if any factor is near zero...

BIMCO Ch3: Identify Vulnerabilities

7 controls

Controls in the BIMCO Ch3: Identify Vulnerabilities domain of BIMCO Cyber Security: 7 controls
Code	Title	Description
BIMCO-3.1	Common vulnerabilities	Common weaknesses on existing ships (newbuilds fall under IACS UR E26 and E27) include obsolete and unsupported operatin...
BIMCO-3.3	Typical vulnerable systems	Vulnerability identification analyses applications, systems and procedures, with internal or maritime-aware external exp...
BIMCO-3.4	Ship to shore interface	Ships increasingly integrate with shore operations and connect safety-critical systems for engine monitoring, remote dia...
BIMCO-3.6	Remote access	Some IT and OT systems run continuous internet connections for monitoring, data collection, maintenance, safety and secu...
BIMCO-3.7	System and software maintenance	Where IT and OT maintenance is outsourced, the company may not be able to verify providers' security, and where differen...
bimco-cyber-security::3.2	IT and OT systems documentation	Identify IT and OT systems clearly in an asset register kept up to date, with governance and ownership responsibilities...
bimco-cyber-security::3.5	Ship visits	Technicians, vendors, officials, terminal staff, agents and pilots often plug laptops, tablets or removable media into s...

BIMCO Ch4-6: Likelihood, Impact and Risk Assessment

8 controls

Controls in the BIMCO Ch4-6: Likelihood, Impact and Risk Assessment domain of BIMCO Cyber Security: 8 controls
Code	Title	Description
BIMCO-5.1	The CIA model	Use confidentiality, integrity and availability to assess the impact of unauthorised disclosure of ship, crew, cargo or...
BIMCO-6.2	The four phases of a risk assessment	Assessments cover existing, new and second-hand ships (the last deserving extra attention) and are likely to need third-...
BIMCO-6.3	Third party risk assessments	Where in-house capability is limited, third parties can assist, including active penetration testing of critical OT and...
bimco-cyber-security::4.1	Likelihood as the product of threat and vulnerability	Risks are often judged only on impact and existing weaknesses, but the likelihood of a cyber event is threat multiplied...
bimco-cyber-security::4.2	Quantifying the likelihood	Reuse the SMS risk matrix's five-step likelihood scale (from unheard of in the industry to frequent in the work concerne...
bimco-cyber-security::5.2	Quantifying the impact	Use the SMS five-level impact scale across safety of people, environment, cargo, assets, business continuity, finance an...
bimco-cyber-security::5.3	Critical equipment and technical systems	Carry out the impact assessment for every onboard system. For OT it feeds the ISM Code paragraph 10.4 list of equipment...
bimco-cyber-security::6.1	Relationship between factors influencing risk	Only once threats (intent, capability, opportunity), vulnerabilities, impacts and likelihood are established can the ris...

BIMCO Ch7: Develop Protection Measures

3 controls

Controls in the BIMCO Ch7: Develop Protection Measures domain of BIMCO Cyber Security: 3 controls
Code	Title	Description
BIMCO-7.1	Defence in depth and in breadth	Protect critical systems and data with layers combining people, procedures and technology to raise detection chances, us...
BIMCO-7.2	Technical protection measures	Technical controls should be practical, cost-effective and kept current, drawing on the CIS Critical Security Controls....
BIMCO-7.3	Procedural protection measures	Procedural controls in company policy, SMS and security procedures govern how people use onboard systems, and security-s...

BIMCO Ch8: Develop Detection Measures

2 controls

Controls in the BIMCO Ch8: Develop Detection Measures domain of BIMCO Cyber Security: 2 controls
Code	Title	Description
BIMCO-8.1	Detection, logging, blocking and alerts	Establish and manage a baseline of normal activity for systems, applications, accounts and the network and expected data...
BIMCO-8.2	Malware detection	Keep endpoint protection and scanning software that detects and deals with malware up to date and managed; give onboard...

BIMCO Ch9: Establish Contingency Plans

1 controls

Controls in the BIMCO Ch9: Establish Contingency Plans domain of BIMCO Cyber Security: 1 controls
Code	Title	Description
BIMCO-9	Chapter 9: Establish contingency plans	Develop a response plan covering relevant contingencies, kept in hard copy, prioritising actions by safety significance...

Maps to 2 other frameworks

40 total controls

NIST Cybersecurity Framework 2.0

25 source controls mapped|17 target controls covered

63%

IACS Recommendation No. 194 - Cybersecurity Controls for Existing Ships

11 source controls mapped|14 target controls covered

28%

Compare BIMCO Cyber Security with NIST Cybersecurity Framework 2.0

Coverage is not the same as your position

This page shows what BIMCO Cyber Security overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is BIMCO Cyber Security and who does it apply to?

BIMCO Cyber Security is a compliance framework from International with 8 domains and 40 controls. BIMCO's cyber security guidelines for ships (version 5, November 2024), produced with shipping industry associations, insurers, class and companies, help shipowners and managers build cyber risk management into the Safety Management System in line with IMO resolution MSC.428(98) and MSC-FAL.1/Circ.3, drawing on the NIST Cybersecurity Framework. They cover governance and roles (senior management, IT and OT differences, SMS and Ship Security Plan procedures, relationships with managers, agents and vendors), identifying threats and vulnerabilities, assessing likelihood and impact, a four-phase ship risk assessment, protection (defence in depth and breadth, technical and procedural measures), detection, contingency planning including disconnecting OT from shore, and response, recovery, investigation, insurance and incident reporting. They are guidance and expressly not a basis for external audit. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does BIMCO Cyber Security actually require?

BIMCO Cyber Security has 40 controls organised across 8 domains. The largest domains are BIMCO Ch1: Cyber Security and Risk Management (8 controls), BIMCO Ch4-6: Likelihood, Impact and Risk Assessment (8 controls), BIMCO Ch10: Respond and Recover (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of BIMCO Cyber Security do I already cover?

BIMCO Cyber Security maps to 2 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (63% coverage), IACS Recommendation No. 194 - Cybersecurity Controls for Existing Ships (28% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement BIMCO Cyber Security?

Start your BIMCO Cyber Security compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about BIMCO Cyber Security requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 40 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required