Cyber compliance for ships, fleets and ports
Maritime cyber rules are written per ship, per facility and per company. CMDash tracks the frameworks that reach each of them, with owners, status and evidence, in the same place as the rest of your program.
Built around how maritime organizations are structured
Cruise lines
Ship operational technology, guest-facing IT and shore systems under one set of evidence.
Ship operators and owners
One cyber program across the fleet, from the class documents to the safety management system.
Ports and terminals
Facility cyber plans, assessments and incident reporting for the people who run the quay.
Maritime equipment suppliers
The documents shipyards and owners ask for, ready per system.
The maritime frameworks CMDash tracks
IACS UR E26: Cyber resilience of ships
The class requirement for ship cyber resilience: identify, protect, detect, respond and recover requirements for the computer-based systems that run a vessel, plus the documents shown for design approval, commissioning and survey. Assessed per vessel.
IACS UR E27: Cyber resilience of on-board systems and equipment
What a maker of shipboard computer-based systems documents, builds in and tests, tracked as rows a buyer can request and a maker can evidence: the maker documents, the security capabilities and the secure development lifecycle.
IMO Maritime Cyber Risk Management
The IMO guidance every ship operating company is expected to fold into its safety management system: six functional elements from governance and risk assessment through recovery, and Resolution MSC.428(98).
USCG Cybersecurity in the Marine Transportation System
The US Coast Guard cybersecurity rule for US-flagged vessels, MTSA facilities and OCS facilities: the cybersecurity plan and officer, training, assessment, drills and incident reporting, with the regulation text on every row. Assessed per vessel or facility.
Cruise Vessel Security and Safety Act
The records and IT duties of the Cruise Vessel Security and Safety Act: video surveillance and retention, the crew stateroom-access log, the crime log and reporting, medical confidentiality and crime-scene training, with the statute text on every row. Assessed per vessel.
IACS and IMO wording is CMDash’s paraphrase; US federal text is verbatim. IMO’s cyber guidance is non-mandatory, and MSC 110 agreed that a non-mandatory code should be developed.
The maritime frameworks are crosswalked to NIST CSF 2.0, ISO/IEC 27001:2022 and, for company-level obligations, NIS2.
A unit for every vessel and port facility
On Command and Enterprise, each vessel or port facility is a unit with its own profile, applicability check and control status for the ship-level frameworks, rolled up into a fleet view.
An applicability check reads a vessel’s type, tonnage, voyages, build contract date, flag and passenger figures and shows which instruments are likely to apply, with the citation for each. It is not legal advice.
The inventory and zone documents for design approval and survey
A computer-based-system inventory with the fields UR E27 asks makers to supply, importable from CSV and exportable as the UR E26 vessel asset inventory.
Security zones and conduits per vessel, checked against UR E26 zone rules and exported with the inventory and exceptions as a documentation pack.
A tracker for the ten UR E27 maker documents per system, and a maker questionnaire built on UR E27.
The deadlines on the incident record
Incident records carry the reporting clocks you add: NIS2’s 24-hour, 72-hour and one-month stages, GDPR’s 72 hours, NYDFS’s 72 hours, the Coast Guard’s report to the National Response Center without delay and the CVSSA’s FBI report as soon as possible. CMDash tracks the deadlines; you choose which regimes to track, and CMDash does not decide which apply and does not file reports. Not legal advice.
Which instruments are likely to apply to a vessel
Enter a vessel’s type, tonnage, voyages, build contract date, flag and passenger figures and see the instruments likely to apply, with the citation for each. It is not legal advice.
Which instruments reach a ship depends on its type, size, voyages, flag and contract date. CMDash shows the instruments that are likely to apply, with the citation for each. It is not legal advice, and your classification society, flag state and counsel decide.
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.