Manage maritime cyber risk to IMO MSC-FAL.1/Circ.3 with less effort

MSC-FAL.1/Circ.3 is the IMO's Guidelines on maritime cyber risk management. It gives high-level recommendations for protecting ships from current and emerging cyber threats, organised into six functional elements: Govern, Identify, Protect, Detect, Respond and Recover. First approved in 2017, it was revised in 2025 and again in 2026, and the current version is Revision 4, dated 28 May 2026.

The guidelines themselves are non-mandatory. However, IMO Resolution MSC.428(98) encourages flag Administrations to ensure cyber risks are addressed in safety management systems under the ISM Code, no later than the first annual verification of a company's Document of Compliance after 1 January 2021. In practice, ISM companies are expected to show cyber risk management during audits, and some flag states set their own requirements.

MSC.428(98) is the IMO resolution on maritime cyber risk management in safety management systems, adopted by the Maritime Safety Committee in June 2017. It encourages Administrations to ensure that cyber risks are appropriately addressed in existing safety management systems, as defined in the ISM Code, by the first annual Document of Compliance verification after 1 January 2021. The MSC-FAL.1/Circ.3 guidelines describe how to do it.

The six functional elements are Govern, Identify, Protect, Detect, Respond and Recover. Govern sets strategy, roles and business continuity. Identify covers asset inventories and risk assessment. Protect covers access control, network segmentation, training and backups. Detect covers threat monitoring. Respond covers incident reporting and records. Recover covers restoration and root cause analysis. The guidelines say all six should run concurrently and continuously.

The IMO guidelines list ISO/IEC 27001 and IACS Unified Requirements E26 and E27 as additional standards that can support implementation. ISO 27001 provides a certifiable information security management system, which can evidence many Govern, Protect and Detect controls for shore-side IT. IACS E26 and E27 focus on cyber resilience of ships and onboard equipment. The IMO text is high-level and points to these standards for detail.

Start by designating an accountable person, then build an inventory of onboard and shore systems and carry out a cyber risk assessment. Implement the minimum controls under each functional element, such as unique credentials, multi-factor authentication, OT and IT segmentation, backups and annual training. Document everything within your ISM safety management system, follow your flag Administration's requirements, and review effectiveness through audits.

The IMO guidelines carry no penalties of their own. Because MSC.428(98) links cyber risk to the ISM Code, a missing or weak approach can be raised as a finding during ISM audits by the flag Administration or its recognised organisation. Consequences then depend on the flag state and the finding, so operators should check their Administration's specific requirements.

Yes, on request. The IMO guidelines are mapped in OneClickComply's control library, and support is available on request rather than as a standard framework today. Mapped controls let shore-side evidence such as access reviews, multi-factor authentication, backups and training records count towards the IMO functional elements and other frameworks such as ISO 27001 at the same time.