| 4.2.1.1 | CBSs grouped into zones with a policy, controlled boundaries and allowed traffic Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.1.3(a) | Zone members meet this UR and E27; zones separated logically or physically Maps to ISO/IEC 27001:2022 |
| 4.2.1.3(b) | Safety-function CBSs sit in their own zones, physically segmented Maps to ISO/IEC 27001:2022 |
| 4.2.1.3(c) | Navigation and communication systems kept out of machinery and cargo zones |
| 4.2.1.3(d) | Wireless devices placed in dedicated zones |
| 4.2.1.3(e) | Out-of-scope systems treated as untrusted and segmented, or held to the zone requirements Maps to ISO/IEC 27001:2022 |
| 4.2.1.3(f) | Each zone can be isolated without losing the primary functions of its CBSs |
| 4.2.2.1(a) | Zones protected by firewalls or equivalent boundary controls Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.2.1(b) | Networks protected against excessive traffic and other service-degrading events |
| 4.2.2.1(c) | CBSs run only the functions, ports, protocols and services they need Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.2.3 | Network design sized for the intended data flow to limit denial-of-service and storm risk |
| 4.2.3.3(a) | Malware protection installed and kept updated where supported Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.3.3(b) | Alternative malware protection where an agent cannot be installed Maps to ISO/IEC 27001:2022 |
| 4.2.4.1 | Access controls restrict interaction with CBSs and networks by need and least privilege Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.4.3 | Only authorized personnel with a need can reach CBSs and stored information Maps to ISO/IEC 27001:2022 |
| 4.2.4.3.1 | Category II and III CBSs in lockable rooms, cabinets or consoles that crew can still reach Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.4.3.2 | Visitors to the ship kept away from CBSs unless supervised Maps to ISO/IEC 27001:2022 |
| 4.2.4.3.3 | Network access points to Category II and III CBS networks blocked unless supervised |
| 4.2.4.3.4 | Removable media policy with malware checks and signature validation Maps to ISO/IEC 27001:2022 |
| 4.2.4.3.5 | Credentials managed: ACLs, time-limited accounts, strong authentication, admin control Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.4.3.6 | Least privilege applied with low defaults, temporary elevation and account audits Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.5.1 | Wireless networks designed to contain incidents and admit only authorized parties |
| 4.2.5.3(a) | Industry-standard cryptography protects wireless traffic integrity and confidentiality Maps to ISO/IEC 27001:2022 |
| 4.2.5.3(b) | Wireless devices communicate only on the wireless network (no dual-homing) |
| 4.2.5.3(c) | Wireless networks built as separate segments with zone and network protection |
| 4.2.5.3(d) | Access points and wireless devices configured so network access can be controlled |
| 4.2.5.3(e) | Wireless-using systems identify and authenticate every user, process and device |
| 4.2.6.1 | CBSs protected from unauthorized access and other threats arriving from untrusted networks |
| 4.2.6.3(a) | User manual and role guidelines for remote access to onboard IT and OT |
| 4.2.6.3(b) | No IP address of an in-scope CBS exposed to untrusted networks |
| 4.2.6.3(c) | Untrusted-network traffic uses authenticated, integrity-protected, encrypted channels Maps to ISO/IEC 27001:2022 |
| 4.2.6.3.1(a) | Onboard side can end a remote connection; remote access starts only after approval |
| 4.2.6.3.1(b) | Remote session interruptions do not compromise safe operation or data integrity |
| 4.2.6.3.1(c) | All remote access events logged and retained long enough for offline review Maps to ISO/IEC 27001:2022 |
| 4.2.6.3.2(a) | Documentation shows how remote maintenance connects to and integrates with the shore side |
| 4.2.6.3.2(b) | Patches and updates tested and the supplier confirms before remote installation Maps to ISO/IEC 27001:2022 |
| 4.2.6.3.2(c) | Suppliers provide plans and make security updates available to the owner |
| 4.2.6.3.2(d) | Authorized staff can interrupt, abort and roll back remote maintenance at any time |
| 4.2.6.3.2(e) | Multi-factor authentication for human access to in-scope CBSs from untrusted networks Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 4.2.6.3.2(f) | Remote access blocked temporarily after repeated failures |
| 4.2.6.3.2(g) | Automatic logout when the connection to the maintenance location drops |
| 4.2.7.1 | Mobile and portable devices limited to necessary use; ports blocked if not controllable Maps to ISO/IEC 27001:2022 |
| 4.2.7.3 | Only authorized people and devices connect, under the owner policy |