IMO Maritime Cyber Risk Management control library
Every control CMDash tracks for IMO Maritime Cyber Risk Management, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history.
25 controls9 families24 mapped to other frameworksNo published text extract yet
Families
Application and scope · 1
| GL-SCOPE | Cyber risk covers both IT and OT systems on board and ashore Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Governance and management · 2
| GL-SENIOR | Senior management leads cyber risk management and builds awareness Maps to NIST Cybersecurity Framework 2.0 |
| GL-RISKBASED | Current and target cyber posture are compared on a risk basis Maps to NIST Cybersecurity Framework 2.0 |
Safety management system integration · 2
| MSC.428-SMS | Cyber risk is addressed within the safety management system Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| MSC.428-DOC | Cyber risk covered by the first annual DOC verification after 1 January 2021 |
Govern · 2
| FE-GOVERN-1 | Strategy, policies, roles and continuity arrangements are set and monitored Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| FE-GOVERN-2 | An accountable person or entity has authority, support and expertise Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Identify · 3
| FE-IDENTIFY-1 | Critical systems, data and dependencies are identified, including supply chains Maps to NIST Cybersecurity Framework 2.0 |
| FE-IDENTIFY-2 | An inventory of onboard digital systems is kept Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| FE-IDENTIFY-3 | Cyber risk assessment covers critical systems and their failure Maps to NIST Cybersecurity Framework 2.0 |
Protect · 10
| FE-PROTECT-1 | User accounts, credentials and authentication are controlled Maps to ISO/IEC 27001:2022, NIS2, NIST Cybersecurity Framework 2.0 |
| FE-PROTECT-2 | Network exposure is limited and OT is segmented from IT Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| FE-PROTECT-3 | Internet-connected and third-party-facing systems have technical protection Maps to ISO/IEC 27001:2022, NIS2, NIST Cybersecurity Framework 2.0 |
| FE-PROTECT-4 | Removable media is controlled Maps to ISO/IEC 27001:2022 |
| FE-PROTECT-5 | Cyber training is mandatory, role-based and tested Maps to ISO/IEC 27001:2022, NIS2, NIST Cybersecurity Framework 2.0 |
| FE-PROTECT-6 | Backups, software updates and incident response plans are maintained Maps to NIS2, NIST Cybersecurity Framework 2.0 |
| FE-PROTECT-7 | Supply chain security policy covers critical software, hardware and vendors Maps to ISO/IEC 27001:2022, NIS2, NIST Cybersecurity Framework 2.0 |
| FE-PROTECT-8 | The effectiveness of cyber risk measures is reviewed Maps to NIST Cybersecurity Framework 2.0 |
| GL-DOCS | Cyber risk management documents are protected against tampering Maps to ISO/IEC 27001:2022 |
| GL-DESIGN | Cyber resilient equipment and systems are considered at acquisition Maps to NIS2, NIST Cybersecurity Framework 2.0 |
Detect · 1
| FE-DETECT-1 | Threats are tracked and systems are monitored for them Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Respond · 2
| FE-RESPOND-1 | Incidents are reported to required parties within required time frames Maps to ISO/IEC 27001:2022, NIS2, NIST Cybersecurity Framework 2.0 |
| FE-RESPOND-2 | Records of cyber incidents are kept Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Recover · 2
| FE-RECOVER-1 | Recovery and reinstatement strategies exist for critical assets and systems Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| FE-RECOVER-2 | Root cause analysis follows cyber incidents Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for IMO Maritime Cyber Risk Management MSC-FAL.1/Circ.3/Rev.4 (2026), published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.