Maritime analysis. Real-time insight.

RightShip Guide

THE DEEPDRAFT · RIGHTSHIP PREPARATION

Cyber-security management in the SMS

RISQ 12.7Section 12 · SecuritySource marking: V

Applicability: Apply to the vessel’s security arrangements and the conditions stated in each question. The section instructs that inspectors should not sight sensitive security materials.

What is being checked

Cyber risks are managed within the SMS and evaluation is addressed.

Ready on board

0 / 8 checked

Check readiness without disclosing sensitive security materials. Do not put protected plans, SSAS locations or security vulnerabilities into this public guide or its contributions.

Have cyber-security management incorporated into the SMS and evidence of implementation.Define user, key-personnel and management responsibilities ashore and on board.Identify systems, assets, data and capabilities whose disruption could affect operations or safety.Have technical protection and continuity measures covering networks, access controls, boundary protection and detection as applicable.Have procedural controls for awareness/training, software maintenance, remote/local access, privileges, removable media and equipment disposal.Have cyber-incident preparedness and response arrangements.Use the current versions of any adopted guidance/standards and address applicable Flag/Member Government requirements.Address RightShip’s encouragement for expert operational, technical and physical evaluation and certification; have evidence available without exposing sensitive configurations.

Practice questions

Preparation prompts derived from this entry, not an official inspector interview script. Keep answers free of sensitive ship-specific security details.

1Does this excerpt require every ship to hold ISO/IEC 27001 certification?

No. It lists that standard among discretionary guidance sources and urges expert evaluation/certification. The explicit finding concerns cyber management not being incorporated into the SMS by the stated verification point.

Where a finding may arise

Explicit RISQ trigger: cyber-security management was not incorporated into the vessel’s SMS by the company’s first annual DOC verification after 1 January 2021. Missing or ineffective controls are further derived preparation concerns; expert certification is not relabelled as this explicit trigger.

Past observations for practice

Anonymised reports, manually reviewed before publication. These are reported experiences, not additional inspection requirements.

No reviewed observations have been added for this entry.

Share an observation for private review

Remove vessel, company and inspector names, report numbers, exact dates and confidential information. Do not paste a complete inspection report.

Source clarification

The question asks about evaluation/certification; the guidance describes RightShip’s recommendation and defines expert firms through relevant ISM and/or ISO/IEC 27001 management-system competence. No single mandatory certification scheme or current standards edition is invented.

References and source status

RightShip Inspection Ship Questionnaire, November 2025, version 3.2. Section 12, page 195, reference 12.7.

The explanation, checklist and practice answer derive from the supplied questionnaire. Reported observations are separately contributed and manually reviewed; they are not official RISQ guidance.

Independent DeepDraft preparation guide, based on the supplied RISQ 3.2 questionnaire. Not an official RightShip product or inspection report.