ClassNK has launched its second edition of Cyber Security Management System Guidelines to bolster ship cybersecurity and ensure compliance.
The Japanese classification society ClassNK has published the second edition of its Cyber Security Management System Guidelines for ship owners and operators. The new regulation aims to protect the digital systems of ships, prepare for cyber attacks, and ensure compliance with international standards during audit processes.
Based in Japan, the international classification society ClassNK (Nippon Kaiji Kyokai) has released a new guide aimed at ship owners and ship management companies in response to the increasing cybersecurity risks in the maritime sector.
In a statement made from Tokyo on October 30, 2026, it was announced that the second edition of the Guidelines for Cyber Security Management System for Ships has been made available.
The guide covers the management of cyber threats that ships may encounter during operational activities, the delineation of responsibilities between company headquarters and vessels, and the security of digital systems used onboard.
New audit criteria for ship operators
The new guide prepared by ClassNK has been restructured based on the international ISO/IEC 27001 and ISO/IEC 27002 information security standards.
The guide consists of two sections; the first section defines the requirements for the Cyber Security Management System (CSMS), while the second section elaborates on the audit criteria and the concrete evidence that will be requested from companies.
Thus, ship owners and operators will be able to learn in advance which practices will be examined during cybersecurity audits.
In the new system, companies' cybersecurity policies, personnel duties and responsibilities, risk assessments, technical protective measures, and preparedness for potential attacks will be evaluated.
Compliance with international standards for tankers and bulk carriers
One of the significant innovations of the guide is its alignment with various auditing systems used in the maritime sector.
ClassNK has matched the new cybersecurity criteria with RightShip's RISQ, OCIMF's SIRE 2.0, and TMSA, as well as the DryBMS assessment systems used in the bulk sector.
This approach allows ship operators to address the cybersecurity requirements of different organizations through a common management system rather than evaluating them separately.
ClassNK aims for the implementation to reduce the preparation time for audits and the workload arising from compliance efforts for companies.
Cybersecurity is not limited to newly built ships
The International Maritime Organization (IMO) recommends that cyber risks on ships be included in Safety Management Systems under the ISM Code.
The UR E26 and E27 requirements developed by the International Association of Classification Societies (IACS) establish technical criteria for the cyber resilience of newly built ships and ship systems.
ClassNK emphasizes that new security risks may arise due to software updates, personnel changes, and operational processes throughout the service life of ships.
Therefore, it is highlighted that cybersecurity should not be limited to the technical measures taken during the construction phase of the vessel, but must be continuously managed throughout its operational life.
In effect since 2019
ClassNK published its first Cyber Security Management System Guidelines for ships in 2019.
The organization has reflected the experiences gained from audits conducted since that time into the new edition.
The updated guide emphasizes topics such as access control, software updates, personnel training, incident response, and the regular review of security practices.
ClassNK has stated that, in addition to the new guide, it will continue to support the maritime sector's cybersecurity efforts through audit and certification activities.
Source: SeaNews Türkiye
