Regulatory and protocol clock

1 Jan 2026 10 months ago Already applies

SOLAS and MARPOL: mandatory reporting of containers lost at sea

Container loss reporting becomes mandatory · Resolution MSC.550(108) (SOLAS chapter V) and MEPC.384(81) (MARPOL Protocol I) · IMO

Maritime International Law

From 1 January 2026 the master of a ship that loses containers overboard must report the loss to ships in the vicinity, the nearest coastal State and the flag State, including position, number of containers and whether they hold dangerous goods. Drifting containers sighted must also be reported. Flag States pass the data to IMO. The change applies to all ships carrying containers, not only container ships.

IMO · IMO amendments in force

What to do (4 items)

• Add a container loss reporting procedure and message template to the SMS and bridge procedures
• Make sure the contact details of coastal State authorities and the flag State are on the bridge
• Brief masters on reporting drifting containers sighted at sea
• Link the procedure to the dangerous goods manifest so cargo content can be reported at once

Open this entry to tick items off

1 Jan 2026 10 months ago Already applies

STCW: mandatory training on violence and harassment at sea

Training requirement in force · Resolution MSC.560(108); STCW Code table A-VI/1-4 · IMO

Maritime International Law

Amendments to the STCW Code adopted at MSC 108 (23 May 2024) entered into force on 1 January 2026. All seafarers must receive training on preventing and responding to violence and harassment, including sexual harassment, bullying and sexual assault, as part of basic safety training under table A-VI/1-4. Training providers and companies have to update course content, and certificates issued after that date have to reflect it. The MLC, 2006 amendments due in 2027 cover the same subject from the labour side.

IMO · IMO resolution MSC.560(108)

What to do (4 items)

• Update the basic safety training syllabus and refresher courses to the revised table A-VI/1-4
• Record completed training for every seafarer in the crew management system
• Add a reporting channel for harassment and bullying to the SMS and the on-board complaints procedure
• Check that manning agencies and training centres use the updated STCW course content

Open this entry to tick items off

22 Nov 2025 11 months ago Already applies

ISO 20022: end of SWIFT MT and MX coexistence for payments

MT messages retired for cross-border payments · ISO 20022 for cross-border payments and reporting · SWIFT

IndustryInfrastructureMaritime International Standard or protocol

The coexistence period for legacy MT and ISO 20022 MX messages in cross-border payments ended on 22 November 2025. Banks now exchange structured ISO 20022 messages. For companies this shows up as structured address and remittance data required by the bank and better data in statements.

SWIFT Date reported, not yet checked against the official text.

What to do (3 items)

• Check that your ERP and treasury tools export structured addresses for payments
• Ask the bank what changes in payment files and statement formats
• Clean master data for suppliers and customers

Open this entry to tick items off

10 Nov 2025 12 months ago Already applies

CMMC: self-assessments required in defence contracts

Phase 1 in force · 48 CFR (DFARS) rule of 10 September 2025; 32 CFR part 170 · US Department of War (Department of Defense)

Industry United States Law

The CMMC contract rule took effect on 10 November 2025. Contracts that involve federal contract information or controlled unclassified information can require a CMMC Level 1 or Level 2 self-assessment recorded in SPRS, with an annual affirmation. Phase 2, which would have required third-party certification from 10 November 2026, was suspended on 13 July 2026; self-assessments stay in force.

Federal Register · Department of War, Office of Industrial Base Growth

What to do (4 items)

• Check whether any US defence contract or subcontract involves CUI or FCI
• Complete the Level 1 or Level 2 self-assessment and record it in SPRS
• Have a senior official sign the annual affirmation
• Watch for the Department's decision on restarting third-party assessments

Open this entry to tick items off

31 Oct 2025 12 months ago Already applies

ISO/IEC 27001:2013 certificates expired

End of transition period · ISO/IEC 27001:2022 transition · ISO, IAF

MaritimeIndustryInfrastructure International Standard or protocol

Certificates to ISO/IEC 27001:2013 expired on 31 October 2025. Anything still relying on a 2013 certificate is no longer certified. The 2022 edition reorganised Annex A into 93 controls and added controls for threat intelligence, cloud services, data leakage and secure coding.

ISO Date reported, not yet checked against the official text.

What to do (3 items)

• Check that your certificate and your suppliers' certificates are to the 2022 edition
• Update the statement of applicability to the 93 controls
• Review supplier contracts that name the 2013 edition

Open this entry to tick items off

17 Oct 2025 1 year ago Already applies

IMO Net-Zero Framework: adoption vote adjourned for a year

MEPC/ES.2 adjourned, reconvening in 12 months · Draft amendments to MARPOL Annex VI (new chapter 5, IMO Net-Zero Framework) · IMO

Maritime International Law

The second extraordinary MEPC session (14 to 17 October 2025) was meant to adopt the IMO Net-Zero Framework: a global fuel standard (greenhouse gas fuel intensity limits that tighten each year) and a GHG pricing mechanism for ships of 5,000 GT and above. Member States agreed to adjourn and reconvene in 12 months. If adopted, MARPOL amendments enter into force about 16 months after adoption, so the earliest start is now 2028. Nothing is legally binding yet, but the approved text (MEPC 83, April 2025) shows what to plan for.

IMO · IMO Net-Zero Framework FAQ

What to do (4 items)

• Keep the MEPC 83 approved text and the draft implementation guidelines in the fleet decarbonisation plan
• Build well-to-wake fuel intensity reporting per ship, reusing FuelEU and DCS data
• Model the two-tier pricing (remedial units) against expected fuel mixes for 2028 to 2030
• Track MEPC 85 (30 November to 3 December 2026) and the resumed extraordinary session

Open this entry to tick items off

14 Oct 2025 1 year ago Already applies

Exchange Server 2016 and 2019 end of support

End of support · Exchange Server 2016 and 2019 lifecycle · Microsoft

MaritimeIndustryInfrastructure International Standard or protocol

Exchange Server 2016 and 2019 both reached end of support on 14 October 2025. The replacement for on-premises mail is Exchange Server Subscription Edition; the alternative is moving mailboxes to a hosted service. Unpatched Exchange servers are a favourite target.

Microsoft Learn Date reported, not yet checked against the official text.

What to do (3 items)

• Check whether any on-premises Exchange server is still running
• Migrate to Exchange Server Subscription Edition or to hosted mail
• Keep the server off the internet until it is patched or replaced

Open this entry to tick items off

14 Oct 2025 1 year ago Already applies

Windows 10 end of support

End of support · Windows 10 Home, Pro and Enterprise lifecycle · Microsoft

MaritimeIndustryInfrastructure International Standard or protocol

Windows 10 stopped receiving security updates on 14 October 2025. Extended Security Updates are available for a fee: one year for consumers, up to three years for organisations. A Windows 10 machine without ESU is unpatched and should not be on a network that matters.

Microsoft Learn

What to do (4 items)

• Count the Windows 10 machines, including bridge PCs, HMIs and kiosks
• Upgrade what can run Windows 11; buy ESU for what cannot yet
• Isolate machines that cannot be upgraded or covered
• Check vendor support for Windows 11 on specialised software

Open this entry to tick items off

30 Sep 2025 1 year ago Already applies

Greece: NIS2 entity registration deadline

Registration deadline (extended) · Law 5160/2024, Article 4(3) · National Cybersecurity Authority (EAK)

MaritimeIndustryInfrastructure Greece Law

The National Cybersecurity Authority extended the deadline for essential and important entities to submit their details on the registration platform to Tuesday 30 September 2025. Entities that had only emailed their details before were told to register again on the platform. A company that is in scope and never registered should do so now rather than wait for a letter.

National Cybersecurity Authority · Registration platform

What to do (4 items)

• Check the registration platform for the company's entry and the named security officer
• Register now if the company is in scope and missed the deadline
• Keep the confirmation of registration with the compliance evidence
• Diary the update duty: changes to the registered details must be notified

Open this entry to tick items off

12 Sep 2025 1 year ago Already applies

Data Act: access to data from connected products

Applies · Regulation (EU) 2023/2854 (Data Act) · European Commission

IndustryInfrastructureMaritime EU Law

Since 12 September 2025 users of connected products and related services have a right to the data those products generate, and can ask the manufacturer to share it with a third party of their choice. It also limits unfair contract terms on data and gives cloud customers the right to switch provider. Anyone who sells machines, sensors, vessel equipment or telematics with a data feed is affected.

EUR-Lex · European Commission

What to do (4 items)

• List the connected products you sell and the data they generate
• Set up a way for a customer to request their product data and receive it in a usable format
• Review contract terms on data use against the unfair-terms list
• Check cloud contracts for switching terms and notice periods

Open this entry to tick items off

6 Aug 2025 1 year ago Already applies

Let's Encrypt stopped OCSP responses

OCSP service ended · Let's Encrypt announcement of 5 December 2024 · Let's Encrypt (ISRG)

MaritimeIndustryInfrastructure International Standard or protocol

Let's Encrypt stopped issuing certificates with OCSP URLs on 7 May 2025 and switched off its OCSP responders on 6 August 2025. Revocation checks rely on CRLs. Any device or software that hard-requires OCSP for Let's Encrypt certificates has been failing since then.

Let's Encrypt

What to do (3 items)

• Check appliances and embedded systems that validate certificates for OCSP dependence
• Enable CRL-based checking where the software supports it
• Test the certificate chain on any device that shows unexpected TLS failures

Open this entry to tick items off

6 Aug 2025 1 year ago Already applies

NCSC Cyber Assessment Framework v4.0 published

CAF v4.0 released · NCSC Cyber Assessment Framework v4.0 · National Cyber Security Centre

MaritimeIndustryInfrastructure United Kingdom Guidance

The NCSC published version 4.0 of the Cyber Assessment Framework on 6 August 2025. UK NIS regulators and critical infrastructure operators use the CAF to assess essential services. Version 4.0 adds a contributing outcome on understanding the threat, a section on secure software development and maintenance, stronger security monitoring and threat hunting indicators, and AI related risk. Operators regulated under the NIS Regulations 2018 have to expect regulators to move assessments to v4.0 in the following assessment cycles.

NCSC · NCSC CAF collection

What to do (4 items)

• Map your current CAF self assessment to the v4.0 indicators of good practice
• Add threat understanding and software supply chain evidence to the next assessment
• Check that network monitoring covers OT segments, not only the corporate estate
• Ask your competent authority when its CAF profile moves to v4.0

Open this entry to tick items off

1 Aug 2025 1 year ago Already applies

Radio Equipment Directive: cyber requirements for wireless products

Applies · Delegated Regulation (EU) 2022/30 under Directive 2014/53/EU · European Commission

IndustryInfrastructure EU Law

Since 1 August 2025 internet-connected radio equipment sold in the EU must protect the network, protect personal data and privacy, and protect against fraud. Wi-Fi and cellular devices, IoT sensors, gateways and wearables are covered. The EN 18031 standards give a route to presumption of conformity, with some gaps that need a notified body.

EUR-Lex Date reported, not yet checked against the official text.

What to do (4 items)

• Check every wireless product for the three requirement sets in Articles 3(3)(d), (e) and (f)
• Test against EN 18031-1, -2 and -3 or get a notified body assessment
• Update the declaration of conformity and the technical file
• Ask suppliers of white-label devices for their conformity evidence

Open this entry to tick items off

28 Jun 2025 1 year ago Already applies

European Accessibility Act applies to products and services

Applies · Directive (EU) 2019/882 · European Commission

IndustryInfrastructure EU Law

Since 28 June 2025 a range of products and services sold to consumers in the EU must be accessible: computers and operating systems, payment terminals, ticketing and check-in machines, e-commerce, banking services, passenger transport information and e-books. Passenger transport services, including ferries, are covered for their websites, apps, ticketing and real-time information.

EUR-Lex Date reported, not yet checked against the official text.

What to do (4 items)

• Check whether any consumer-facing product or service you offer is in the annex
• Test websites, apps and self-service terminals against EN 301 549
• Publish an accessibility statement where the service requires one
• Fix the highest-traffic customer flows first (booking, payment, information)

Open this entry to tick items off

26 Jun 2025 1 year ago Already applies

Hong Kong Convention on ship recycling in force

Convention enters into force · Hong Kong International Convention for the Safe and Environmentally Sound Recycling of Ships, 2009 · IMO

Maritime International Law

The Hong Kong Convention entered into force on 26 June 2025. It applies to ships of 500 GT and above on international voyages flying the flag of a Party, and to ship recycling facilities in Parties. Ships must carry a ship-specific Inventory of Hazardous Materials (IHM); new ships from delivery, existing ships within five years. A ship going for recycling needs a final survey, an International Ready for Recycling Certificate and a ship recycling plan from an authorised facility. EU-flagged ships already follow the EU Ship Recycling Regulation (EU) No 1257/2013, which has required an IHM since 31 December 2020.

IMO · IMO HKC FAQ

What to do (5 items)

• Check which ships fly the flag of a Party and fall under the 500 GT international-voyage scope
• Commission IHM Part I surveys for ships that do not yet have one and plan the five-year deadline (26 June 2030)
• Add a material declaration and supplier declaration of conformity clause to purchasing contracts
• Sell ships for recycling only to facilities holding a Document of Authorization to conduct Ship Recycling
• Keep the IHM updated after every repair or equipment change

Open this entry to tick items off

31 Mar 2025 2 years ago Already applies

PCI DSS v4.0.1: future-dated requirements in force

Future-dated requirements became mandatory · PCI DSS v4.0.1 · PCI Security Standards Council

IndustryInfrastructureMaritime International Standard or protocol

Since 31 March 2025 the requirements that were best practice under PCI DSS 4.0 are mandatory: script management on payment pages, phishing protection, authenticated vulnerability scans, twelve-character passwords, multi-factor authentication for all access into the cardholder data environment and more. Any organisation taking card payments, including ferry and port operators, is affected.

PCI Security Standards Council Date reported, not yet checked against the official text.

What to do (4 items)

• Confirm the assessment or self-assessment questionnaire covers version 4.0.1
• Inventory scripts on payment pages and add integrity monitoring
• Turn on multi-factor authentication for every access to the cardholder environment
• Ask the payment provider which requirements they cover for you

Open this entry to tick items off

1 Feb 2025 2 years ago Already applies

Ballast Water Management: new record book, electronic BWRB allowed

Revised BWRB form and electronic record books apply · Resolution MEPC.369(80); BWM Convention regulations A-1, B-2 and appendix II · IMO

Maritime International Law

Amendments adopted at MEPC 80 (7 July 2023) entered into force on 1 February 2025. They replace the form of the Ballast Water Record Book in appendix II of the BWM Convention and allow an electronic record book approved by the flag administration in place of the paper book. The D-2 discharge standard has applied to all ships since 8 September 2024, so port State control now checks both the treatment system and the record keeping. Further BWM amendments approved at MEPC 84 are due for adoption at MEPC 85 in December 2026.

IMO · IMO resolution MEPC.369(80)

What to do (4 items)

• Replace the paper Ballast Water Record Book with the revised appendix II form
• If using an electronic record book, hold the flag administration's declaration of approval on board
• Train deck officers on the new entry codes and how to log exceptional ballast operations
• Keep BWMS operating logs and the D-2 commissioning test report ready for port State control

Open this entry to tick items off

17 Jan 2025 2 years ago Already applies

DORA: digital resilience rules for the financial sector

Applies · Regulation (EU) 2022/2554 (DORA) · European Commission

Infrastructure EU Law

The Digital Operational Resilience Act has applied to banks, insurers, investment firms and their critical ICT providers since 17 January 2025. If you sell IT or connectivity services to a financial entity, expect contract clauses on incident reporting, exit plans, audit rights and testing, because your customer has to pass those obligations on.

EUR-Lex Date reported, not yet checked against the official text.

What to do (4 items)

• Check whether any customer is a financial entity under DORA
• Review their contract amendments for ICT third-party clauses before signing
• Keep an incident reporting path your financial customers can rely on
• Decide whether you can support threat-led penetration testing if asked

Open this entry to tick items off

1 Jan 2025 2 years ago Already applies

EU MRV: offshore ships and 400 to 5,000 GT cargo ships report

Extended MRV scope applies · Regulation (EU) 2015/757 as amended by Regulation (EU) 2023/957 · European Commission and EMSA (THETIS-MRV)

Maritime EU Law

From 1 January 2025 the EU MRV regulation covers offshore ships of 5,000 GT and above, and general cargo ships and offshore ships between 400 and 5,000 GT, on top of the existing 5,000 GT scope. Companies must have an assessed monitoring plan and report CO2, CH4 and N2O per voyage and per year; the verified report is due by 31 March of the following year. The smaller ships are not in the ETS; offshore ships of 5,000 GT and above join the ETS on 1 January 2027.

EUR-Lex · European Commission (DG CLIMA)

What to do (4 items)

• Identify general cargo and offshore ships between 400 and 5,000 GT that call at EU/EEA ports
• Submit monitoring plans in THETIS-MRV and have them assessed by an accredited verifier
• Collect fuel consumption and voyage data for the whole of each reporting year
• File the verified 2025 report by 31 March 2026 and the 2026 report by 31 March 2027

Open this entry to tick items off

1 Jan 2025 2 years ago Already applies

FuelEU Maritime: GHG intensity limit applies

Regulation applies to ships above 5,000 GT · Regulation (EU) 2023/1805 · European Commission and EMSA

Maritime EU Law

FuelEU Maritime limits the yearly average greenhouse gas intensity of energy used on board ships above 5,000 GT calling at EU/EEA ports, regardless of flag. From 1 January 2025 the limit is 2% below the 2020 reference value of 91.16 gCO2e/MJ, counting 100% of energy used between EU ports and 50% on voyages to or from third countries. Companies had to submit a monitoring plan by 31 August 2024. Each ship needs a FuelEU document of compliance by 30 June of the following year; a compliance deficit costs a penalty per tonne of VLSFO equivalent.

EUR-Lex · European Commission (DG MOVE)

What to do (5 items)

• Confirm every ship above 5,000 GT has a FuelEU monitoring plan assessed by the verifier
• Record fuel type, quantity and well-to-wake emission factors per voyage
• Submit the FuelEU report by 31 January and get the verified compliance balance by 31 March
• Decide by 30 April whether to bank, borrow or pool compliance surplus or deficit
• Hold the FuelEU document of compliance on board from 30 June; port state control checks it

Open this entry to tick items off

27 Nov 2024 2 years ago Already applies

Greece: Law 5160/2024 transposes NIS2

Law in force · Νόμος 5160/2024 (ΦΕΚ Α' 195/27.11.2024) · Hellenic Ministry of Digital Governance, National Cybersecurity Authority

MaritimeIndustryInfrastructure Greece Law

Greece transposed NIS2 with Law 5160/2024, in force since 27 November 2024. Essential and important entities register with the National Cybersecurity Authority, appoint an information and communications security officer, apply the security measures and report significant incidents.

National Cybersecurity Authority · gov.gr

What to do (5 items)

• Confirm whether the company is an essential or important entity under the Greek law
• Register on the National Cybersecurity Authority platform (nis2register.cyber.gov.gr)
• Appoint and notify the information and communications security officer
• Map the security measures of Article 21 of NIS2 onto what you already do
• Prepare the incident reporting chain to the National Cybersecurity Authority

Open this entry to tick items off

18 Oct 2024 2 years ago Already applies

CER Directive: resilience duties for critical entities

Applies, replacing the old critical infrastructure directive · Directive (EU) 2022/2557 (CER) · European Commission

InfrastructureMaritime EU Law

The Critical Entities Resilience Directive covers physical resilience of entities in energy, transport (including ports and shipping), water, health, digital infrastructure and other sectors. It applied from 18 October 2024, the day after the transposition deadline. Entities are not covered until their Member State identifies them, but the identification work is under way in every country.

EUR-Lex · European Commission

What to do (4 items)

• Find out which national authority runs the CER identification for your sector
• Check whether the company provides an essential service listed in the CER annex
• Line up the physical security, business continuity and staff vetting documents
• Assign an owner for CER work who also sits on the NIS2 work, the two overlap

Open this entry to tick items off

17 Oct 2024 2 years ago Already applies

NIS2: national laws had to be in place

Transposition deadline · Directive (EU) 2022/2555 (NIS2) · European Commission

MaritimeIndustryInfrastructure EU Law

NIS2 replaces the first NIS Directive. Member States had until 17 October 2024 to write it into national law, and the old directive was repealed the next day. Shipping companies, ports, energy, water, manufacturing of certain goods and many other sectors are in scope as essential or important entities. The obligations reach you through your national law, so the national text and its deadlines are what count.

EUR-Lex · European Commission

What to do (5 items)

• Check Annex I and II of the directive against what the company does and its size
• Find the national transposition law and the authority that supervises your sector
• Register with the national authority if the national law requires it
• Put management on the hook: they approve the security measures and must be trained
• Set up incident reporting: early warning within 24 hours, notification within 72 hours

Open this entry to tick items off

17 Oct 2024 2 years ago Already applies

NIS2: shipping companies, ports and VTS are essential entities

Transposition deadline; obligations apply from 18 Oct 2024 · Directive (EU) 2022/2555 (NIS2), Annex I Transport: Water · European Commission and national NIS competent authorities

MaritimeInfrastructure EU Law

NIS2 lists sea and coastal passenger and freight water transport companies, managing bodies of ports and port facilities, and operators of vessel traffic services (VTS) in Annex I as transport entities. Member States had to transpose by 17 October 2024 and apply the rules from 18 October 2024, with registration, risk management measures and 24-hour incident reporting. National transposition status differs; see the EU cyber entries for detail.

EUR-Lex

What to do (3 items)

• Check whether the company or port is in scope by size and activity under Annex I
• Register with the national competent authority where transposition is in force
• Map ship and port OT systems into the NIS2 risk management measures

Open this entry to tick items off

1 Jul 2024 2 years ago Already applies

IACS UR E26/E27: cyber resilience rules for new ships

Apply to ships contracted on or after 1 July 2024 · IACS UR E26 Rev.1 and UR E27 Rev.1 · IACS (International Association of Classification Societies)

Maritime International Standard or protocol

UR E26 sets minimum cyber resilience requirements for the ship as a whole: asset inventory, network segmentation, access control, incident response and recovery. UR E27 sets requirements for on-board systems and equipment delivered by suppliers. Class societies apply both to ships contracted for construction on or after 1 July 2024; the original 1 January 2024 date was withdrawn. Existing ships are outside the URs, but newbuild contracts and vendor deliveries are inside.

IACS · IACS Unified Requirements E

What to do (5 items)

• Check newbuild contract dates: contracted on or after 1 July 2024 means E26 and E27 apply
• Ask the yard for the vessel asset inventory and the cyber resilience documentation required by E26
• Require E27 compliance statements from OT, bridge and engine automation suppliers
• Plan the on-board tests the class surveyor will witness before delivery
• Align the SMS cyber procedures with the E26 incident response and recovery sections

Open this entry to tick items off

Jul 2024 2 years ago Already applies

UNECE R155: cyber security type approval for all new vehicles

Applies to all new vehicles registered in the EU and other contracting parties · UN Regulation No. 155 (Cyber Security and Cyber Security Management System) · UNECE World Forum for Harmonization of Vehicle Regulations

Industry International Law

Since July 2024 every new vehicle sold in the EU and other contracting parties must come from a manufacturer with a certified cyber security management system and a type approval that covers cyber security, with software updates under UN Regulation No. 156. Fleet operators see it as vehicles that receive over-the-air updates and telematics with defined security.

UNECE Date reported, not yet checked against the official text.

What to do (3 items)

• For fleets, ask the manufacturer how security updates are delivered and for how long
• For suppliers into the automotive chain, expect cyber security requirements in contracts
• Keep the vehicle software update records for the fleet

Open this entry to tick items off

13 Jun 2024 2 years ago Already applies

Electricity network code on cybersecurity in force

In force · Commission Delegated Regulation (EU) 2024/1366 · European Commission

Infrastructure EU Law

The first EU network code on cybersecurity for cross-border electricity flows has been in force since June 2024. It sets a process for identifying high-impact and critical-impact entities (system operators, large generators, storage, demand response and their suppliers), common minimum and advanced security controls, and incident reporting. The controls roll in over several years through ENTSO-E and EU DSO Entity deliverables.

EUR-Lex Date reported, not yet checked against the official text.

What to do (4 items)

• Check whether the company runs generation, storage, a network or demand response above the thresholds
• Follow the ENTSO-E and EU DSO Entity timetable for the risk assessment and control lists
• Line up existing ISO 27001 or IEC 62443 work against the minimum controls
• Plan for the reporting duties alongside NIS2 reporting

Open this entry to tick items off

29 Apr 2024 2 years ago Already applies

PSTI Act: consumer connectable product security regime in force

Regime in force, still operative · Product Security and Telecommunications Infrastructure Act 2022, Part 1; PSTI (Security Requirements) Regulations 2023 · Office for Product Safety and Standards (Department for Business and Trade)

IndustryInfrastructure United Kingdom Law

Since 29 April 2024 manufacturers, importers and distributors of consumer connectable products sold in the UK must meet three security requirements. Devices must not ship with universal default passwords, the manufacturer must publish a vulnerability disclosure contact and must state a minimum security update period. It covers smart cameras, routers, sensors and similar products that end up on industrial and vessel networks. OPSS enforces it with compliance, stop and recall notices and fines.

GOV.UK · legislation.gov.uk

What to do (5 items)

• List connectable products you buy for sites and vessels and check each one has a statement of compliance
• Ask suppliers for the published minimum security update period before buying
• Reject devices that use a shared default password across units
• Record the vendor vulnerability disclosure contact for each product family
• If you import or resell devices in the UK, put a compliance check in the purchasing process

Open this entry to tick items off

18 Dec 2023 3 years ago Already applies

SEC cyber disclosure: material incidents on Form 8-K in 4 business days

Incident disclosure rule operative · SEC Release 33-11216; Form 8-K Item 1.05; Regulation S-K Item 106 · US Securities and Exchange Commission

MaritimeIndustryInfrastructure United States Law

Since 18 December 2023 companies listed in the US must disclose a material cybersecurity incident on Form 8-K Item 1.05 within four business days of deciding it is material. Annual reports on Form 10-K and 20-F must describe cyber risk management, strategy and board oversight for fiscal years ending on or after 15 December 2023. Foreign private issuers report on Form 6-K. Smaller reporting companies got 180 extra days for the 8-K duty. The rule is still operative in 2026.

SEC

What to do (4 items)

• Write a materiality decision procedure that names who decides and within what time
• Rehearse producing an 8-K Item 1.05 draft within four business days of a materiality decision
• Keep the annual Item 106 description of cyber governance up to date
• Align incident reporting to the SEC with reports owed to other regulators

Open this entry to tick items off

1 Jan 2021 6 years ago Already applies

ISM Code: cyber risk must be in the safety management system

Cyber risk in SMS from first DoC verification · Resolution MSC.428(98) · IMO

Maritime International Law

IMO resolution MSC.428(98) affirms that a safety management system approved under the ISM Code has to take cyber risk into account. Companies had to address cyber risk no later than the first annual verification of the Document of Compliance after 1 January 2021. This is still the operative obligation that flag states and port state control check; the MSC-FAL.1/Circ.3 guidelines describe how to do it.

IMO

What to do (4 items)

• Confirm the SMS has a cyber risk section covering identify, protect, detect, respond and recover
• Keep an inventory of IT and OT systems on each ship and name who is responsible for each
• Record cyber drills and crew training in the SMS evidence pack before the annual DoC audit
• Map the SMS cyber section to the functional elements in MSC-FAL.1/Circ.3/Rev.3

Open this entry to tick items off