INDUSTRY FACT FILE · MARITIME, PORTS & SHIPPING

Cybersecurity FAQs for Maritime, Ports and Shipping

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, terminal and marine operations heads, fleet managers, PFSOs, commercial, procurement and privacy teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, safety and compliance 3.  Category 3: Terminals, OT, ships and vendors 4.  Category 4: Cargo platforms, SOC and recovery 5.  Category 5: Data, shipyards and partners

Audience: Boards, chairmen, MDs, CEOs and CISOs

Q1. Why are ports and shipping companies cyber targets?

Cargo cannot wait, so pressure to pay is immediate and public; ports are strategic infrastructure; shipyards hold valuable designs; and cargo release and settlements move high-value goods and money—attracting ransomware groups, state actors and fraudsters alike.

Q2. Which incidents should the Board know about?

NotPetya cost Maersk US$250–300 million in 2017; LockBit ransomware halted the Port of Nagoya for two days in 2023; DP World Australia shut four terminals and stranded about 30,000 containers in November 2023; the Port of Seattle refused a US$6 million ransom in 2024.

Q3. What are the biggest risks for an Indian port or shipping company?

Ransomware stopping the TOS and gates, OEM remote access into cranes and SCADA, cargo release fraud through portals, ship navigation and system compromise, and weak monitoring of terminals, ships and vendors.

Q4. Why link cybersecurity and maritime safety?

Attacks on cranes, SCADA, navigation and engine systems can cause physical incidents, which is why the IMO requires cyber risk in safety management systems and IACS builds it into newbuild rules.

Q5. What should the Board review each quarter?

Terminal OT and OEM access risks, TOS restore test results, portal fraud indicators, ship cyber audit findings, incidents, CERT-In and NCIIPC status, SOC coverage and exercise outcomes.

Q6. Who should own OT security in a port?

The CISO jointly with terminal operations, engineering and marine leadership, with a single asset inventory per terminal and clear ownership of OEM access.

Q7. How should we prioritise investment?

Separate TOS and OT from office IT, broker vendor and ship-to-shore access, make TOS and controllers recoverable, harden cargo portals, assess ships, and build monitoring—in that order.

Q8. How can Codec Networks help?

Codec Networks provides terminal and marine OT assessments, TOS and PCS 1x testing, remote access programmes, recovery reviews, ship cyber risk assessments, 24x7 IT/OT SOC, DPDP programmes and port crisis exercises.

Audience: Compliance, PFSO, marine superintendents, company secretarial and CISO offices

Q9. Do CERT-In Directions apply to us?

Yes. Cyber incidents must be reported within six hours and ICT logs kept for 180 days in India. CERT-In's 2025 audit guidelines expect independent audits that include OT/ICS.

Q10. What does IMO MSC.428(98) require?

That cyber risks are appropriately addressed in the ship's safety management system under the ISM Code, verified at Document of Compliance audits from 1 January 2021; DG Shipping applied it to Indian-flag ships by circular.

Q11. What are IACS UR E26 and E27?

Unified Requirements for the cyber resilience of ships (E26) and of on-board systems and equipment (E27), applied by classification societies to new ships contracted for construction on or after 1 July 2024.

Q12. Does the ISPS Code cover cyber?

The Code governs port facility and ship security assessments and plans; cyber elements are increasingly expected in them, and the Merchant Shipping (Ships and Port Facility Security) Rules 2024 and the 2025 Act frame India's implementation.

Q13. Does NCIIPC apply to our port?

Transport is a notified critical sector; duties attach to systems notified as protected systems, more likely for major ports and strategic operators. Good practice aligns with NCIIPC guidance regardless.

Q14. What must listed port and shipping groups disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report.

Q15. Does DPDP apply to ports and shipping companies?

Yes. Customer, driver, crew, seafarer, visitor and employee data are in scope; most obligations under the DPDP Rules take effect in May 2027.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, IEC 62443 and ISO 27001 gap assessments, MSC.428(98) and UR E26/E27 readiness reviews and cyber inputs to ISPS plans.

Audience: Terminal operations, engineering, marine and fleet teams

Q17. How should IT and OT be separated in a terminal?

Use IEC 62443 zones and conduits: a terminal DMZ, no dual-homed systems, controlled TOS-to-equipment flows and the ability to run cranes and gates in degraded mode without office IT.

Q18. How do we assess cranes and SCADA safely?

Passive discovery, offline configuration and architecture reviews, and any active testing in maintenance windows agreed with operations—never unplanned scanning of live equipment.

Q19. How should OEM remote access work?

Brokered, time-bound sessions with MFA, named accounts, approval per request and recording—never standing links with shared passwords.

Q20. How do we manage dredging and construction contractors?

Scan and control devices, provide segmented temporary networks, use named accounts and remove access when work ends.

Q21. How do we assess a ship's cyber risk?

Inventory bridge, engine-room, cargo and satcom systems, assess remote access and update paths, address findings in the SMS and train the crew—aligned to MSC.428(98) and class guidance.

Q22. How do we handle GNSS spoofing and jamming?

Cross-check positions with radar and visual fixes, use integrity monitoring where available, train bridge teams for degraded navigation and follow UKMTO and flag advisories in affected waters.

Q23. What about legacy PLCs and operator stations?

Segment, restrict access, monitor and plan upgrades with the vendor; compensating controls are expected where patching is impossible.

Q24. How do we secure new terminals and automation projects?

Specify security in tenders, test before go-live, isolate automation in its own zones, change default credentials and monitor from day one.

Audience: Commercial, IT, SOC and incident response teams

Q25. How do we stop cargo release fraud?

Enforce MFA for all portal users, test APIs for authorisation flaws, monitor delivery-order and truck-nomination changes, verify high-value releases and train forwarders and agents.

Q26. What should we test on the TOS and PCS integration?

Authentication and authorisation, API security, message integrity, failover and restore, and the business logic behind releases, billing and manifests.

Q27. Do ports need an OT SOC?

Yes. Monitoring terminals, ports, fleets and enterprise IT 24x7 is essential for early detection, safe containment and six-hour reporting.

Q28. What should the SOC monitor?

Terminal and OT networks, OEM sessions, TOS and portal anomalies, ship-to-shore connections, identity and cloud events and threat intelligence.

Q29. What should incident playbooks include?

Safety decisions, manual yard and gate operation, containment, CERT-In and NCIIPC reporting, DG Shipping and customs engagement, customer communication and disclosure.

Q30. How should backups be designed?

Immutable or offline backups of TOS, gate systems, PLC configurations and ERP, with regular restore tests and documented restart sequences and vendor images.

Q31. How quickly can a terminal recover from ransomware?

With segmented networks, tested restores and manual playbooks, days; without them, a week or more—as Nagoya and DP World Australia experienced.

Q32. When should forensics be engaged?

As soon as OT compromise, ransomware or data theft is suspected, with investigators who can preserve evidence and support regulators, customs and insurers.

Audience: Privacy, legal, shipyard, procurement and commercial teams

Q33. Which personal data do ports and shipping companies hold?

Customer and consignee contacts, driver identities and vehicle data, crew and seafarer records, visitor logs and CCTV, and employee data across operators and platforms.

Q34. How does DPDP affect PCS, portals and agents?

Platform providers and agents processing personal data need contracts, safeguards, retention limits and breach notification arrangements; the port or line remains accountable as data fiduciary.

Q35. How do shipyards protect designs?

Classify design and PLM data, restrict and broker subcontractor access, block personal cloud uploads, monitor exports and hunt for persistent intrusions.

Q36. How should we assess OEMs, agents and platform providers?

Tier them by criticality, assess security and incident history, add security, notification and recovery clauses to contracts and review their access to your systems.

Q37. Our customer, charterer or lender is auditing our security—what now?

Map the questionnaire to ISO 27001, IEC 62443 and IMO/IACS controls, close gaps and build an evidence pack you can reuse.

Q38. How do we train crews and terminal staff?

Run phishing and BEC simulations for commercial and finance teams, awareness for terminal and bridge teams and secure-operations training for engineers.

Q39. What should a breach response for customer data include?

Containment, forensic analysis, CERT-In reporting, DPDP breach intimation when in force, customer and customs communication and remediation.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your terminals, ships, cargo platforms and vendors; Codec Networks will propose a safety-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. Confirm obligations against the official instruments applicable to your ports, ships and contracts.