Cyber Shipping Guide
This cyber shipping guide gives ports, shipping companies and logistics operators a practical, regulation-mapped framework for securing maritime operations against ransomware, GPS spoofing, AIS manipulation and operational technology attacks.
NIS2 Article 21, IMO maritime cyber risk management and ISO 27001:2022 now require evidence that cyber risk is identified, assessed, treated and monitored across vessel, port and shore-side environments.
Trusted by 100+ organisations across Europe
NIS2 
IMO 
Maritime 
ISO 27001:2022 What you need to know from this cyber shipping guide
- IMO maritime cyber risk management requires cyber risk to be addressed inside Safety Management Systems, with evidence available for inspection.
- NIS2 Article 21 requires essential maritime entities to maintain proportionate cyber risk management, supply chain security, incident handling and continuity controls.
- NIS2 incident reporting requires a 24-hour early warning and 72-hour notification to the relevant national competent authority for significant incidents.
- GPS spoofing, AIS manipulation, ransomware and OT compromise are the highest-impact maritime cyber threats for European operators.
- A credible maritime cyber programme needs asset identification, regulation-mapped risk assessment, tested incident response and continuous control evidence.
- NIS2 penalty exposure for essential entities can reach €10 million or 2% of global annual turnover.
- StartComply automates maritime cyber compliance by mapping controls, assessments and evidence to IMO, NIS2 and ISO 27001:2022 requirements.
Last updated May 2026.
What Is a Cyber Shipping Guide?
A cyber shipping guide is a structured operating model for identifying, assessing, treating and monitoring cyber risk across maritime organisations. It covers vessel systems, port infrastructure, cargo management platforms, crew networks, logistics integrations and the third parties that connect them.
Unlike a generic IT checklist, a cyber shipping guide translates maritime-specific risks into actions that compliance officers, CISOs, fleet managers and risk owners can evidence. That means linking controls to IMO cyber risk management, NIS2 Article 21, incident reporting duties and operational resilience requirements.
Port authorities, shipping lines, classification societies and logistics operators all need documented cyber risk management because cyber incidents can interrupt safety, cargo throughput, customs processes and commercial operations at the same time.
Spreadsheets are not a defence. Maritime operators need live evidence showing which assets are in scope, which controls are active, who owns each risk and when the last review happened.
Maritime Cyber Risk Requires Operational Evidence
Documented, tested and evidenced maritime controls
- IMO cyber risk management incorporated into the Safety Management System
- NIS2 Article 21 measures for risk management, supply chain security and incident handling
- NIS2 Article 23 reporting workflow for significant incidents
- Evidence of control ownership, testing, remediation and management review
- Board-level visibility into risks that affect safety and continuity
Penalty exposure: NIS2 essential entities can face fines up to €10 million or 2% of global annual turnover. Source: NIS2 Directive.
Annual documents that fail under inspection
- No complete IT and OT asset inventory across fleet and shore-side systems
- No mapped relationship between risks, controls and regulatory obligations
- Incident response procedures written but never tested
- Supplier access and remote maintenance risks reviewed inconsistently
- Control failures tracked through email rather than a managed workflow
The audit reality: inspectors ask for files, dates, owners, decisions and follow-up evidence, not promises that a document exists somewhere.
Key Cyber Threats This Cyber Shipping Guide Helps You Control
Operational Technology Attacks
Vessel OT includes navigation, engineering, ballast, cargo and safety-adjacent systems. Satellite connectivity, remote diagnostics and crew internet access increase exposure where traditional IT controls do not reach.
- ECDIS and bridge system risk tracking
- Engine and cargo control risk ownership
- Segmentation and remote access control evidence
- OT control testing and remediation workflows
GPS and AIS Spoofing
Navigation data integrity is a maritime-specific risk area. GPS spoofing can mislead vessel position data, while AIS manipulation can create ghost vessels, hide real movement or undermine situational awareness.
- Threat scenario documentation
- Detection and escalation playbooks
- Navigation sensor anomaly evidence
- Incident response ownership and testing
Ransomware in Port Logistics
Ports are attractive ransomware targets because downtime affects container movement, customs processes, berth schedules and commercial throughput immediately. Business continuity planning needs to be tested before an incident, not invented during one.
- Immutable backup evidence
- Recovery objective tracking
- Critical system prioritisation
- Supplier and terminal operator dependencies
Supply Chain and Remote Access Risk
Maritime operations rely on ship managers, maintenance providers, port communities, customs integrations and logistics platforms. Each connection can become an attack path when access is not governed.
- Third-party access register
- Contractual security requirement tracking
- Supplier evidence collection
- Subcontractor and remote diagnostics review
Incident Reporting Readiness
Maritime incident response is complicated by geography. A cyber incident may involve vessel crew, shore-side IT, flag state authorities, port state control and national competent authorities.
- 24-hour early warning workflow
- 72-hour notification evidence
- One-month final report preparation
- Tabletop exercise records
Audit-Ready Evidence
A maritime cyber programme only works if evidence is easy to retrieve. StartComply keeps risk decisions, control testing, remediation and review history connected to the relevant regulatory obligation.
- Control-to-regulation mapping
- Owner, date and status trail
- Audit package generation
- Management review dashboards
Building a Cyber Shipping Compliance Programme in Five Steps
Map every IT and OT asset IMO and NIS2
Build an inventory of vessel navigation systems, engine controls, cargo systems, port terminal software, customs integrations, crew networks, cloud services and remote access paths. Unknown assets create unmanaged risk, especially where corporate IT and vessel OT are connected informally.
Map risks to maritime obligations Article 21
Assess likelihood, impact and control maturity for each critical asset. Every finding should map to IMO maritime cyber risk management, NIS2 Article 21 or ISO 27001:2022 so the assessment is useful to both operators and auditors.
Assign controls and owners Control evidence
Turn findings into tracked remediation work. Assign owners, due dates and control evidence for access management, segmentation, backup, supplier access, incident handling and business continuity.
Exercise incident response 24h and 72h
Test the plan through realistic tabletop scenarios, such as ransomware affecting cargo management while a vessel is days from port. Incident response plans must be tested to be credible.
Keep evidence current Continuous review
Review risks annually at minimum and after material operational changes, including vessel acquisitions, port system upgrades, supplier changes or new remote maintenance arrangements. Regulators expect living evidence, not archived PDFs.
Cyber Shipping Compliance Requirements vs. Manual Evidence
Maritime cyber compliance fails when teams cannot connect controls, owners and evidence to specific obligations. StartComply keeps the chain visible.
Audit-ready maritime cyber compliance means every requirement has an owner, a control, a review cadence and retrievable evidence.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
Frequently Asked Questions About This Cyber Shipping Guide
What does a cyber shipping guide cover for maritime operators?
A cyber shipping guide covers the full lifecycle of maritime cyber risk management: regulatory obligations under IMO and NIS2, asset identification across IT and OT environments, risk assessment methods, maritime threats such as GPS spoofing and ransomware, incident response procedures and evidence requirements for inspections. It is regulation-mapped operational guidance, not generic IT advice.
Is maritime cyber security compliance legally mandatory in Europe?
Yes. IMO maritime cyber risk management has been incorporated into Safety Management Systems, and NIS2 Article 21 separately requires essential and important entities to implement cyber risk management measures. For maritime entities in scope, compliance is mandatory and evidence-based, with NIS2 fines reaching €10 million or 2% of global annual turnover for essential entities.
What is the NIS2 incident reporting timeline for maritime operators?
NIS2 Article 23 sets a three-stage reporting timeline for significant incidents. Essential entities must issue a 24-hour early warning, provide a detailed 72-hour notification and submit a final report within one month. These obligations can apply even when operational teams are managing an incident across vessel, shore-side and port contexts.
How does GPS spoofing affect vessel cyber security?
GPS spoofing broadcasts false signals that can make vessel navigation systems display an incorrect position. AIS manipulation can also falsify vessel identity or movement data. These scenarios can contribute to groundings, collision risk, misdirected routing and insurance fraud. Detection requires maritime-specific monitoring, not only standard network telemetry.
What is the difference between IT and OT cyber risk on ships?
IT risk covers corporate networks, crew internet, cargo software and administrative systems. OT risk covers operational technology such as ECDIS, engine control, ballast water management and cargo loading systems. OT attacks can create physical consequences, so maritime cyber risk management must use controls that recognise safety, navigation and operational impacts.
How often must maritime cyber risk assessments be updated?
Maritime cyber risk assessments should be reviewed at least annually and after significant operational changes, such as a new vessel acquisition, port system upgrade or change in third-party provider. NIS2 expects measures to remain proportionate and maintained, which means the assessment should be a living evidence record, not a filed-and-forgotten report.
