IMO Maritime Cyber Risk Management

The IMO guidance every ship operating company is expected to fold into its safety management system: six functional elements from governance and risk assessment through recovery, and Resolution MSC.428(98).

What IMO Maritime Cyber Risk Management is

MSC-FAL.1/Circ.3/Rev.4 (28 May 2026) is the International Maritime Organization's guidance on maritime cyber risk management. It describes six functional elements that run together and continuously: govern, identify, protect, detect, respond and recover. It treats the computer-based systems on board as both information technology and operational technology, and it supersedes the interim guidelines in MSC.1/Circ.1526.

Resolution MSC.428(98), adopted in June 2017, affirms that an approved safety management system should take cyber risk management into account under the ISM Code. It encourages flag administrations to see that cyber risk is addressed no later than the first annual verification of the company's Document of Compliance after 1 January 2021.

IMO's cyber guidance is non-mandatory; MSC 110 agreed a non-mandatory code. In practice the guidelines are enforced through flag-state expectations and ISM audits, which is why they work as the baseline for any ship operating company, not only for new builds.

Who it applies to

• ISM companies operating passenger ships and cargo ships on international voyages, the vessels the ISM Code covers.
• Shore-side teams that carry the company's safety management system and the people accountable for cyber risk across the fleet.
• Ship managers and crewing companies acting for an owner, who answer to the same safety management system audit.

How it is structured in CMDash

CMDash seeds one row for each duty under the six functional elements, plus rows for the general recommendations (scope, senior management, risk-based comparison, protection of documents, cyber resilient equipment) and the two points of MSC.428(98). Control ids follow that structure (for example FE-PROTECT-2, MSC.428-SMS). The statements and evidence lines are CMDash's paraphrase; the IMO text is not reproduced.

Scope: Paraphrased in CMDash's own words; the IMO text is not reproduced. The guidance is non-mandatory and is checked through flag-state and ISM audits. Flag-state reporting time frames are not seeded.

The control text

What CMDash does for IMO Maritime Cyber Risk Management

• Each duty is a tracked row with an owner, a status, reviewer notes and dated evidence, grouped by functional element.
• A seeded crosswalk to NIST CSF 2.0, ISO/IEC 27001:2022 Annex A and NIS2, so a company already tracked against those frameworks sees which guideline duties it speaks to.
• One connector rule reaches the account and authentication row (FE-PROTECT-1) through that crosswalk: the Okta multi-factor coverage rule on ISO 27001 A.8.5 also applies to it, and is labeled as derived.
• Company level: the guidelines bind the ISM company's system, so this framework sits beside the per-vessel frameworks (IACS UR E26 and the USCG and CVSSA frameworks) and not in place of them.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artifact being gathered twice, and they are how a second framework costs a fraction of the first.

Where CMDash stops

Know the boundaries before you plan the work.

• The guidelines are guidance, not a regulation. Flag administrations set the reporting time frames and the audit expectations, and those are not seeded.
• The further standards the circular lists in its section 4 (ISO/IEC 27001, the IACS requirements, the industry guidelines) are references, not rows.
• Nothing here is legal advice, and CMDash does not report incidents to a flag administration; it tracks the procedure and keeps the evidence.

Common questions

Also in Maritime & OT

Paid plans cap how many frameworks you run at once, never which ones — IMO Maritime Cyber Risk Management is available on every paid plan.