ClassNK splits ship cyber rules into two parts to cut audit pain

ClassNK has published the second edition of its Guidelines for Cyber Security Management System for Ships, splitting the document into two parts — one defining CSMS requirements, the other spelling out audit criteria — in a move designed to make certification predictable for shipowners and managers.

The restructuring matters commercially. Shipping companies have had to guess what ClassNK examiners would scrutinise during certification audits. Now they can see it. The second part of the guidelines specifies the audit criteria and the supporting evidence required for certification, which also lets operators spot gaps in their existing cyber defences before an auditor does.

The revision lands six years after the first edition, published in 2019, and draws on the class society's practical experience running cyber security management certification since then.

What does the update actually change?

Three things stand out.

• ISO alignment. ClassNK rebuilt the framework with reference to ISO/IEC 27001 and ISO/IEC 27002, the international standards for information security management and security controls. That gives ship managers a vocabulary and control set auditors elsewhere already recognise.
• Cross-scheme mapping. The assessment criteria are now mapped against RISQ, SIRE 2.0, DryBMS and TMSA — the major maritime vetting schemes covering tanker, dry cargo and management audits. A single CSMS can serve as the base for preparing multiple external evaluations, cutting the interpretive work companies previously did framework by framework.
• Two-part structure. Part one sets the CSMS requirements; part two sets audit criteria and evidence. Companies can read requirements and expectations side by side.

The framework covers both shore-based management and onboard operations, spanning cyber security policies, responsibilities, risk assessments, technical controls and incident response procedures.

Why now: newbuilds are covered, fleets keep changing

The revision reflects a gap in the regulatory picture. IACS requirements UR E26 and UR E27 address cyber resilience in newbuild vessels and onboard systems — effectively a design-and-build fix. They do not govern what happens after delivery, when equipment changes, software updates and evolving operational practices erode original protections.

ClassNK's position is that ongoing cyber security management stays necessary across a vessel's operational life, not just at the yard. The guidelines fill that lifecycle space: a management system that adapts as the ship and its practices change, rather than a one-off compliance stamp.

For shipowners, the practical gain is consolidation. A manager facing a SIRE 2.0 inspection, a TMSA audit and a ClassNK certification no longer needs three separate preparations. One CSMS, mapped against all of them, does the groundwork.

The guidelines are available through ClassNK's website via its registered My Page service.

With vetting schemes tightening cyber expectations and UR E26/E27 pushing resilience into newbuild contracts, expect class societies to keep converging their cyber audit frameworks toward ISO lines — and expect cyber readiness to become a routine chartering and vetting checkbox rather than a specialist project.