BIMCO Cyber Security

International

v2021

8 domains

26 controls

BIMCO Guidelines on Cyber Security Onboard Ships

Verified

BIMCO Cyber Security is a compliance framework from International with 8 domains and 26 controls that map to 2 other frameworks. The largest domains are BIMCO Ch1: Cyber Security and Risk Management (5 controls), BIMCO Ch3: Identify Vulnerabilities (5 controls), BIMCO Ch10: Respond and Recover (4 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

BIMCO Ch10: Respond and Recover

4 controls

Controls in the BIMCO Ch10: Respond and Recover domain of BIMCO Cyber Security — 4 controls
Code	Title	Description
BIMCO-10.2	The four phases of incident response	Incident response. The company should respond to cyber incidents following the four phases (preparation, detection and a...
BIMCO-10.3	Recovery plan	Recovery plan. The company should maintain a recovery plan to restore affected shipboard systems and safe operation foll...
BIMCO-10.4	Data recovery capability	Data recovery capability. The company should maintain backups and a data recovery capability for critical shipboard data...
BIMCO-10.5	Investigating cyber incidents	Investigating cyber incidents. The company should investigate cyber incidents to determine root cause and inform improve...

BIMCO Ch1: Cyber Security and Risk Management

5 controls

Controls in the BIMCO Ch1: Cyber Security and Risk Management domain of BIMCO Cyber Security — 5 controls
Code	Title	Description
BIMCO-1.2	Senior management involvement	Senior management involvement. The company's senior management should be involved in and own cyber risk management, inte...
BIMCO-1.3	Roles, responsibilities and tasks	Roles, responsibilities and tasks. Clear roles, responsibilities and tasks for cyber risk management should be defined a...
BIMCO-1.4	Differences between IT and OT systems	Differences between IT and OT systems. The Guidelines require recognising the differences between information technology...
BIMCO-1.5	Plans and procedures	Plans and procedures. The company should develop cyber security plans and procedures, embedded in the SMS, covering prot...
BIMCO-1.8	Relationship with vendors and other external parties	Relationship with vendors and external parties. The company should manage cyber risk arising from vendors, service provi...

BIMCO Ch2: Identify Threats

2 controls

Controls in the BIMCO Ch2: Identify Threats domain of BIMCO Cyber Security — 2 controls
Code	Title	Description
BIMCO-2.1	Threat actors	Threat actors. The Guidelines require identifying the threat actors relevant to the maritime context (e.g. opportunists,...
BIMCO-2.2	Types of cyber threats	Types of cyber threats. The company should identify the types of cyber threats (untargeted and targeted, including malwa...

BIMCO Ch3: Identify Vulnerabilities

5 controls

Controls in the BIMCO Ch3: Identify Vulnerabilities domain of BIMCO Cyber Security — 5 controls
Code	Title	Description
BIMCO-3.1	Common vulnerabilities	Common vulnerabilities. The company should identify common vulnerabilities in shipboard IT and OT (e.g. obsolete systems...
BIMCO-3.3	Typical vulnerable systems	Typical vulnerable systems. The Guidelines identify typical vulnerable shipboard systems (navigation/ECDIS, propulsion a...
BIMCO-3.4	Ship to shore interface	Ship to shore interface. The company should address vulnerabilities at the ship-to-shore interface (data exchange, remot...
BIMCO-3.6	Remote access	Remote access. The company should manage the cyber risks of remote access to shipboard systems (by shore staff, vendors...
BIMCO-3.7	System and software maintenance	System and software maintenance. The company should manage vulnerabilities arising from system and software maintenance,...

BIMCO Ch4-6: Likelihood, Impact and Risk Assessment

4 controls

Controls in the BIMCO Ch4-6: Likelihood, Impact and Risk Assessment domain of BIMCO Cyber Security — 4 controls
Code	Title	Description
BIMCO-4	Assessing the likelihood	Assessing the likelihood. The likelihood of a cyber incident is assessed as the product of threat and vulnerability, and...
BIMCO-5.1	Impact assessment (CIA model)	Impact assessment. The impact of a cyber incident is assessed against the confidentiality, integrity and availability (C...
BIMCO-6.2	The four phases of a risk assessment	Risk assessment. The company should conduct a cyber risk assessment following the four phases (identify, assess likeliho...
BIMCO-6.3	Third party risk assessments	Third party risk assessments. The company should assess cyber risks introduced by third parties (vendors, ports, agents)...

BIMCO Ch7: Develop Protection Measures

3 controls

Controls in the BIMCO Ch7: Develop Protection Measures domain of BIMCO Cyber Security — 3 controls
Code	Title	Description
BIMCO-7.1	Defence in depth and in breadth	Defence in depth and in breadth. Protection should apply layered (defence in depth) and broad (defence in breadth) measu...
BIMCO-7.2	Technical protection measures	Technical protection measures. The company should implement technical protections including network segmentation, access...
BIMCO-7.3	Procedural protection measures	Procedural protection measures. The company should implement procedural protections including crew training and awarenes...

BIMCO Ch8: Develop Detection Measures

2 controls

Controls in the BIMCO Ch8: Develop Detection Measures domain of BIMCO Cyber Security — 2 controls
Code	Title	Description
BIMCO-8.1	Detection, logging, blocking and alerts	Detection measures. The company should implement detection, logging, blocking and alerting to identify cyber incidents a...
BIMCO-8.2	Malware detection	Malware detection. The company should deploy malware detection and prevention appropriate to IT and OT, recognising cons...

BIMCO Ch9: Establish Contingency Plans

1 controls

Controls in the BIMCO Ch9: Establish Contingency Plans domain of BIMCO Cyber Security — 1 controls
Code	Title	Description
BIMCO-9	Establish contingency plans	Establish contingency plans. The company should establish contingency plans to maintain or restore safe operation of the...

Maps to 2 other frameworks

26 total controls

NIST Cybersecurity Framework 2.0

26 source controls mapped|17 target controls covered

100%

ISO 27005:2022

1 source controls mapped|1 target controls covered

Compare BIMCO Cyber Security with NIST Cybersecurity Framework 2.0

What is BIMCO Cyber Security and who does it apply to?

BIMCO Cyber Security is a compliance framework from International with 8 domains and 26 controls. BIMCO Guidelines on Cyber Security Onboard Ships It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does BIMCO Cyber Security actually require?

BIMCO Cyber Security has 26 controls organised across 8 domains. The largest domains are BIMCO Ch1: Cyber Security and Risk Management (5 controls), BIMCO Ch3: Identify Vulnerabilities (5 controls), BIMCO Ch10: Respond and Recover (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of BIMCO Cyber Security do I already cover?

BIMCO Cyber Security maps to 2 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (100% coverage), ISO 27005:2022 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement BIMCO Cyber Security?

Start your BIMCO Cyber Security compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about BIMCO Cyber Security requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 26 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required