Key Takeaways
- National administrations enforce IMO cyber rules. The IMO sets the requirement; the flag state (such as DG Shipping) verifies it at the company and vessel level.
- The legal basis is MSC.428(98) integrated into the ISM Code, so cyber is verified through existing Document of Compliance and Safety Management Certificate audits.
- BIMCO alignment is the practical benchmark. Administrations broadly accept BIMCO-aligned implementation as evidence of meeting the IMO expectation.
- Expect both flag state and port state attention. The administration audits its own flag; Port State Control may also probe cyber during inspections of visiting vessels.
- Preparation is the same regardless of administration: integrate cyber into the SMS, build the evidence pack, train the crew, and rehearse the audit.
How Flag State Cyber Enforcement Works
The International Maritime Organization sets requirements, but it does not inspect ships. Enforcement is delegated to the flag state administration, the national authority of the country whose flag a vessel flies. The Directorate General of Shipping (DG Shipping) is the maritime administration for vessels under its flag, and like every other administration it is responsible for ensuring that companies and vessels under its authority meet the applicable IMO instruments, including the cyber risk management requirement.
For cyber specifically, the administration's role is to verify that a company has integrated cyber risk management into its Safety Management System as required by IMO Resolution MSC.428(98). The administration, or a Recognised Organisation acting on its behalf (typically a classification society authorised to conduct ISM audits), checks this during the audits that lead to and maintain the company's Document of Compliance and each vessel's Safety Management Certificate.
This delegated, audit-based model is why flag state cyber requirements are not a separate rulebook with their own inspectors. They are the IMO requirement, verified through the administration's existing ISM machinery. The practical effect for an owner is that the cyber question arrives inside a familiar process, the ISM audit, conducted by familiar parties, the administration or its Recognised Organisation.
The Legal Basis: ISM Code and MSC.428(98)
The legal mechanism is the International Safety Management (ISM) Code, given effect through SOLAS. The ISM Code requires a company to operate an approved Safety Management System and to hold a Document of Compliance at the company level and a Safety Management Certificate for each vessel. Without these certificates, a vessel cannot trade. IMO Resolution MSC.428(98) inserts cyber risk management into this framework by affirming that an approved SMS should take cyber risk into account.
The consequence is that cyber is enforced with the ISM Code's existing authority, not through a new parallel regime. When an administration or its Recognised Organisation finds that cyber risk has not been adequately addressed in the SMS, the outcome is an ISM non-conformity. A minor non-conformity attracts a corrective action requirement with a deadline; an unresolved or serious one can escalate to a major non-conformity, which in extreme cases threatens the Document of Compliance and the affected Safety Management Certificate.
Administrations have generally taken a constructive, improvement-focused stance since the requirement took effect, working with owners to raise the baseline rather than detaining vessels at the first finding. But the underlying authority is real, and the trajectory across administrations is towards closer and more technical scrutiny of cyber at each verification cycle.
Need a Maritime Cyber Assessment?
Codesecure runs IMO 2021 and BIMCO-aligned cyber risk assessments and OT pentests for shipowners, managers, ports and terminals. ISO/IEC 27001:2022 certified, named consultants with OSCP, CEH, CISSP and ICS credentials, fixed-price proposals and free retest within 90 days.
See Maritime Services →What an Administration Looks For
Whether the audit is conducted directly by the administration or by a Recognised Organisation, the cyber examination follows a recognisable pattern that mirrors the five functions of MSC-FAL.1/Circ.3. The auditor wants to see that cyber risk is genuinely integrated into the SMS and lived on board, not merely documented in a binder.
- SMS integration: cyber procedures embedded in the existing SMS sections, not a detached standalone policy
- Risk assessment: a documented per-vessel-class cyber risk assessment identifying threats, vulnerabilities, impact and residual risk
- Crew competence: the master, chief officer and chief engineer able to describe the cyber procedures in their own words, evidencing real training
- Records: training logs, an incident and drill log with recent entries, a vendor register, and management-of-change records
- Operational controls: clear, consistent USB and removable-media handling, controlled vendor remote access, and basic network segregation
- Response readiness: a cyber incident response plan with defined vessel-to-shore communication and recent drill evidence
Flag State Versus Port State Attention
Owners should distinguish two kinds of scrutiny. Flag state attention comes from the administration whose flag the vessel flies, through the ISM audit cycle, and is the primary route by which cyber compliance is verified. Port State Control (PSC) attention comes from the authority of a port the vessel visits, regardless of flag, through inspections under regional PSC regimes.
Historically PSC focused on physical, structural and operational safety. Cyber has been entering PSC consciousness gradually: inspectors increasingly ask cyber-adjacent questions, look for the existence of cyber procedures within the SMS, and check that the crew is aware of them. A vessel that is well prepared for its flag state cyber audit is generally well prepared for cyber questions during a PSC inspection too, because the underlying evidence (SMS integration, training records, drill logs) is the same.
The practical implication is that cyber readiness is not something an owner can scope to a single jurisdiction. A vessel trades into many ports under many PSC regimes, and the cyber posture travels with it. Building a robust, BIMCO-aligned, IMO-compliant programme satisfies the flag state and equips the master to answer port state cyber questions with confidence wherever the vessel calls.
How Owners Prepare for a Flag State Cyber Audit
Preparation for a flag state cyber audit is essentially the IMO cyber implementation done well, with particular attention to the evidence and crew-competence elements that auditors sample. The work is the same regardless of which administration holds the flag, because all administrations are verifying the same underlying IMO requirement.
The preparation sequence is a gap assessment against the five MSC-FAL.1/Circ.3 functions, integration of cyber procedures into the existing SMS rather than a separate manual, deployment of the achievable technical controls (network segregation between bridge OT, engine OT, vessel IT and crew networks, USB and removable-media controls, controlled vendor access, account hygiene), per-vessel risk assessments, crew training tailored to the roles the auditor will interview, a documented incident response plan with at least one rehearsed tabletop, and a coherent evidence pack reviewed annually and accessible both ashore and on board.
The most common reasons owners stumble at a flag state cyber audit are not technical. They are the master who cannot describe the cyber procedures from memory because training was paper-only, the dormant programme with no drill entries in the last year, inconsistent USB handling between bridge and engine room, and an asset inventory that is missing or stale. Each of these is closable in weeks if addressed before the audit. Codesecure supports owners through the full cycle, running the gap assessment, helping integrate cyber into the SMS, delivering role-specific crew training, conducting a vessel walkthrough, and standing alongside the Designated Person Ashore during the audit itself.
Flag State Audit or Customer Questionnaire?
Whether you need cyber evidence for a flag state, P&I club query, charterer security questionnaire or BIMCO gap closure, our maritime cyber lead is available for a 30-minute free scoping call.
Talk to a Maritime Lead →Beyond Compliance: Why It Matters Commercially
Meeting the flag state cyber requirement is the floor, not the ceiling. The same evidence pack that satisfies an administration increasingly does double and triple duty in commercial contexts. Charterers issue cyber questionnaires as a condition of fixture. P&I clubs and hull underwriters factor cyber posture into risk assessment at renewal. Major ports and terminals ask cyber-adjacent questions as part of pre-arrival inquiries. A clean, well-documented cyber programme is becoming a commercial asset, not merely a regulatory obligation.
Conversely, a weak cyber posture creates friction beyond the audit room. A charter can stall on an unanswered security questionnaire, an insurer can price in uncertainty, and a port can add scrutiny that slows turnaround. The owners who treat cyber as an integrated part of how the fleet is managed, rather than a once-a-year audit scramble, find the marginal cost of staying ready is low and the commercial dividend is real.
Codesecure helps shipowners and managers build cyber programmes that satisfy the flag state administration and serve these wider commercial demands at the same time, from gap assessment and SMS integration through crew training, vessel and shore penetration testing, and the evidence packs that charterers, clubs and ports increasingly expect. ISO/IEC 27001:2022 certified delivery with named consultants, across India, Singapore, UAE, Malaysia and the wider region.
Frequently Asked Questions
What is the role of a maritime administration like DG Shipping in cyber security?
A maritime administration is the flag state authority that verifies IMO requirements for vessels under its flag. For cyber, its role is to confirm that companies have integrated cyber risk management into their Safety Management System as required by IMO Resolution MSC.428(98), checked during the ISM audits that lead to and maintain the Document of Compliance and Safety Management Certificate, often through a Recognised Organisation.
Does DG Shipping have its own separate cyber security standard?
Maritime administrations generally do not create a separate cyber standard. They verify the IMO requirement under MSC.428(98) and MSC-FAL.1/Circ.3, integrated into the ISM Code. In practice administrations broadly accept BIMCO Guidelines on Cyber Security Onboard Ships as the reference interpretation, so a BIMCO-aligned SMS is the most reliable way to meet the expectation.
What happens if a vessel fails a flag state cyber audit?
Inadequate cyber risk management in the SMS is treated as an ISM non-conformity. A minor non-conformity attracts a corrective action requirement with a deadline; an unresolved or serious one can escalate to a major non-conformity, which in extreme cases threatens the Document of Compliance and the affected Safety Management Certificate. Administrations have generally taken a constructive, improvement-focused approach since the requirement took effect.
Is cyber checked by Port State Control as well as the flag state?
Increasingly, yes. The flag state verifies cyber through the ISM audit cycle, which is the primary route. Port State Control inspectors are progressively asking cyber-adjacent questions and checking that cyber procedures exist within the SMS and that the crew is aware of them. A vessel well prepared for its flag state cyber audit is generally well prepared for cyber questions during a PSC inspection.
How does an owner prepare for a flag state cyber audit?
Through proper IMO cyber implementation: a gap assessment against the five MSC-FAL.1/Circ.3 functions, integration of cyber procedures into the existing SMS, achievable technical controls (segregation, USB controls, vendor access control, account hygiene), per-vessel risk assessments, role-specific crew training, a rehearsed incident response plan, and a coherent evidence pack reviewed annually and accessible ashore and on board.
Can Codesecure help us prepare for a flag state cyber audit?
Yes. Codesecure runs the gap assessment, helps integrate cyber into the SMS, delivers role-specific crew training, conducts a vessel cyber walkthrough, and can stand alongside the Designated Person Ashore during the audit. The same evidence also supports charterer questionnaires, P&I reviews and port inquiries. ISO/IEC 27001:2022 certified delivery with named consultants holding OSCP, CEH, CISSP and IEC 62443 experience.
Pass the Flag State Cyber Audit, and Use the Evidence Everywhere
Codesecure prepares shipowners and managers for flag state cyber audits and the charterer, club and port questionnaires that follow, across India, Singapore, UAE, Malaysia and the wider region. ISO/IEC 27001:2022 certified delivery, named consultants with maritime OT experience, fixed-price proposals.
