The release of cybersecurity controls recommendations for existing ships by the International Association of Classification Societies (IACS) in 2023 is a sign of the growing attention to cybersecurity resilience in the maritime industry. This recommendation is designed to address the existing cybersecurity gaps in older ships built before July 1, 2024.
Cyber Challenges in the Maritime Industry
Recent reports indicate that cybersecurity incidents in the maritime sector continue to rise. These incidents are primarily due to fundamental security vulnerabilities and a lack of cybersecurity hygiene. For example, the prevalence of phishing attacks and weaknesses in credential management are among the main challenges. This situation has become more critical due to the increasing connectivity of ships' digital systems to shore networks and remote support services.
Reports from the U.S. Coast Guard and France regarding maritime cybersecurity threats show that these incidents have increasingly challenged the operational environment for ship owners and port facilities. However, none of the incidents examined in 2025 included AI-based attacks, which somewhat indicates a lack of significant change in the threat landscape.
IACS Recommendation and Strengthening Cyber Resilience
IACS Recommendation No. 194 (Cybersecurity Controls for Existing Ships) helps older ships comply with minimum cybersecurity control standards and enhances the cybersecurity resilience of existing fleets. This recommendation includes a set of controls such as management responsibility, cybersecurity risk assessment, network protection, system maintenance, monitoring, response and recovery, as well as training and awareness for the crew.
Cyber resilience refers to the ability to reduce the occurrence and mitigate the effects of cybersecurity incidents resulting from disruptions or damage to operational technology (OT). This issue is not just a technical matter; it means maintaining safe operations during times when critical systems or support connections are disrupted or damaged.
IACS also advises companies to incorporate periodic assessments into their overall cybersecurity strategy to identify emerging risks and ensure compliance with industry best practices and legal requirements.
Ultimately, Recommendation No. 194 helps ship operators assess whether appropriate cybersecurity measures are in place and where additional actions may be needed. By identifying and protecting IT and OT systems, operators can continue to improve their cybersecurity and resilience.
