Secure propulsion and navigation systems by managing cyber risk as part of the ship’s safety and operational-resilience program: identify the connected systems and dependencies, assess vessel-specific hazards, protect operational technology (OT), and plan for detection, response, and recovery. The IMO’s current guidance, MSC-FAL.1/Circ.3/Rev.4, dated 28 May 2026, sets out high-level recommendations—not a universal network design or a substitute for applicable flag and Administration requirements.
Why ship cyber security is a safety issue
Propulsion and navigation depend on computer-based systems that monitor or control physical processes. A cyber incident, mistaken maintenance action, or failed connection can therefore affect safe ship operations, not just the confidentiality of information. IMO’s stated goal is “to support safe and secure shipping, which is operationally resilient to cyber risks.”
As an Amazon Associate I earn from qualifying purchases.
IMO defines operational technology as computer-based systems focused on using data to control or monitor physical processes; its example is monitoring main-engine oil temperature. Information technology (IT), by contrast, focuses on data as information. The distinction matters, but it does not mean the systems are isolated: onboard systems may connect to company networks, shore facilities, other vessels, ports, or third parties.
MSC-FAL.1/Circ.3/Rev.4 supersedes the interim guidelines in MSC.1/Circ.1526. It is high-level guidance intended to complement existing safety and security management practices. IMO advises operators to consult their Member Government and flag Administration requirements, as well as relevant current standards and industry practices, when deciding how to implement controls.
#1 Best Overall
- MULTIFUNCTION DISPLAY: With GO9, add GPS navigation, sonar support, radar capability, and much more to your boat: perfect for sportboats, center-consoles, and smaller cruisers
- C-MAP DISCOVER: Included C-MAP DISCOVER card with full-featured Vector Charts, Custom Depth Shading, Tides & Currents, C-MAP high-resolution Bathymetric contours, and ultra-wide coverage in the US and Canada
- HDI TRANSDUCER WITH BUILT‑IN SONAR: Includes 83/200 kHz HDI transducer support for clear CHIRP sonar and DownScan Imaging to help identify bottom structure and fish targets
- INTEGRATED GPS AND CONNECTIVITY: Built-in GPS with Wi-Fi and NMEA 2000 support for seamless system integration
- BUILT-IN CONNECTIVITY: Mirror your display to a smartphone or tablet and get access to charts, radar and other functionality from anywhere on board. NMEA 2000 connectivity offers more integration options
Start with a vessel-specific system and dependency map
Build an inventory of computer-based systems and connections relevant to the vessel’s operation. Include more than equipment commonly labelled “navigation” or “engine control”: a failure or compromised data flow in a connected service can affect a safety-critical system indirectly.
- Bridge and navigation: navigation, ship-safety, and communications systems.
- Propulsion and machinery: propulsion, fuel, machinery-management, and power-control systems.
- Other onboard systems: cargo and pumping, security and access control, and crew or passenger services.
- External interfaces: ship-port interfaces; ship-to-shore integrated systems, including remote-control systems; and connections to company, vendor, or other landside systems. Include Maritime Autonomous Surface Ships where relevant.
For each system, record its purpose, owner or responsible role, network connections, information exchanged, dependencies, and the operational consequences if it becomes unavailable or gives unreliable information. Trace relationships across the vessel—for example, where a navigation, communications, power, or machinery-management dependency could affect another operation. The circular calls for identifying internal and external dependencies and network connections; it does not prescribe a particular inventory format.
Include people and maintenance pathways in the map. IMO identifies risks arising from poor security-by-design, operation, integration, maintenance, or patching; malicious activity such as hacking or malware; and unintentional actions such as careless maintenance or inappropriate permissions. Vendor access, embedded systems, hardware and software supply chains, and maintenance devices can all form part of the exposure.
Make cyber risk management part of the Safety Management System
IMO Resolution MSC.428(98) encourages Administrations to ensure that cyber risks are appropriately addressed in existing Safety Management Systems (SMS). The resolution states a timing of no later than the first annual verification of the company’s Document of Compliance after 1 January 2021. That stated timing does not establish how every flag State has implemented the resolution, so operators should check current Administration requirements and how their SMS applies to each vessel.
Rank #2
- MULTIFUNCTION DISPLAY: With GO9, add GPS navigation, sonar support, radar capability, and much more to your boat: perfect for sportboats, center-consoles, and smaller cruisers.
- C-MAP DISCOVER: Included C-MAP DISCOVER card with full-featured Vector Charts, Custom Depth Shading, Tides & Currents, C-MAP high-resolution Bathymetric contours, and ultra-wide coverage in the US and Canada.
- ACTIVE IMAGING 3-IN-1 TRANSDUCER: See structure and cover with a new level of refined detail with Active Imaging 3-in-1 sonar featuring CHIRP, SideScan and DownScan imaging with FishReveal.
- RADAR READY: GO9 offers safer cruising and more productive fishing with plug-and-play connectivity to Simrad radar solutions for powerboats of all sizes.
- BUILT-IN CONNECTIVITY: Mirror your display to a smartphone or tablet and get access to charts, radar and other functionality from anywhere on board. NMEA 2000 connectivity offers more integration options.
MSC-FAL.1/Circ.3/Rev.4 organizes risk management around six concurrent, ongoing functions: Govern, Identify, Protect, Detect, Respond, and Recover. Treat them as a continuing management cycle rather than a one-time checklist.
Govern: assign ownership and authority
Senior management should assign accountability, authority, resources, and suitable expertise for cyber-risk management. Establish a risk strategy, connect it to the vessel’s safety and security management, and provide for feedback and continuing evaluation. Make clear who can approve changes, who coordinates with the master and shore management, and how cyber concerns are escalated without undermining safe operations.
Identify: assess systems in their operating context
Maintain the digital-systems inventory and use it to assess threats, vulnerabilities, likelihood, and potential impact. Prioritize systems whose failure could create hazardous situations. IMO says assessments should reflect the ship’s type, operational profile, system complexity, and connectivity; a control suitable for one vessel or installation should not automatically be assumed suitable for another.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesProtect OT without compromising safe operations
Choose and maintain safeguards against the vessel-specific risks identified in the assessment. IMO lists multiple protective measures but does not specify a single technical architecture, product, or network layout for all ships.
Rank #3
- Rugged, floating, water-resistant (IPX6 — unit level only) handheld GPS with a high-resolution color display and scratch-resistant, fogproof glass.Special Feature:Designed to Float; Accurate Tracking; Increased Memory; Built-in Compass; BlueChart Coverage.Water Resistant: Yes
- Increased memory to save and track 10,000 waypoints, 250 routes and 300 fit activities
- Supports multiple satellite constellations (GPS, GLONASS, Beidou, Galileo, QZSS and SBAS) for reliable tracking around the world
- Includes preloaded BlueChart g3 coastal charts
- Built-in 3-axis tilt-compensated electronic compass shows heading while standing still
Separate networks and control connections
IMO’s circular states: “Therefore, OT systems should be segmented from IT systems, protected from Internet-facing systems and have appropriate protection tools.” Apply that principle through vessel-specific engineering and operational controls. Review which connections are necessary, how ship-to-shore and vendor links are managed, and how a problem in a less critical network could spread or affect OT. Do not treat segmentation as permission to disconnect systems or alter a safety-critical network without appropriate assessment and authorization.
The circular also recommends limiting exploitable Internet services and using measures to protect ship systems connected to the Internet, company intranet, third parties, or landside systems. Consider the whole connection path, including remote access and maintenance arrangements, rather than only the equipment installed onboard.
Manage identities, permissions, and approved equipment
- Use unique credentials, change default passwords, and separate ordinary user accounts from privileged accounts.
- Apply access controls and, where appropriate, multifactor or continuous authentication.
- Control who may administer or maintain systems, and review permissions in light of assigned duties.
- Use hardware- and software-approval processes suited to the ship’s systems and operational needs.
- Set policies for cryptography and for preventing unauthorized removable media from being used with onboard systems.
These are controls to implement through the vessel’s risk-management and safety processes, not instructions to make unsupervised changes to installed control equipment.
Recommended Free Tools
Train crew and protect maintenance activity
IMO calls for annual basic cybersecurity training, OT-specific training for users of OT, and crew familiarization when joining a ship. Make training relevant to onboard responsibilities: crew should know how to recognize and report suspicious activity, follow approved device and maintenance procedures, and raise concerns through the vessel’s established channels. Include the risks posed by third-party personnel, vendor access, and maintenance devices in relevant procedures.
Rank #4
- Easy-to-use 9” chartplotter with a bright, sunlight-readable touchscreen display with improved detail, clarity and viewing angle
- Included GT56-TM transducer for Garmin traditional, ClearVü and SideVü scanning sonars
- Built-in Garmin Navionics+ coastal charts with integrated Navionics data
- Built-in Wi-Fi connectivity lets you wirelessly share sonar, waypoints and routes with another ECHOMAP UHD2 chartplotter
- Wirelessly connects to your Force trolling motor to create and follow routes, navigate to waypoints, control speed, check battery life and more
Prepare to detect, respond, and recover
Detection and records
Use timely monitoring and secure logs to support detection and response. Establish who reviews relevant alerts or records, how concerns reach the responsible ship and shore personnel, and how incident information is retained. Monitoring should fit the system and operating context; IMO does not prescribe a particular tool or monitoring architecture.
Incident response
Maintain an incident-response plan that fits the vessel’s safety-management arrangements. It should establish responsibilities, escalation and communications, and how to limit effects across ship systems while maintaining safe operations. The circular calls for incidents to be reported within time frames set by the Administration and for incident records to be kept. Check the applicable reporting rules rather than assuming one reporting deadline applies to every ship or flag.
Backups, updates, and recovery
IMO calls for regular system backups and software updates, plus policies addressing critical-system supply chains. Plan these activities around the installed systems, their dependencies, and safe operating requirements. Do not apply a patch, restore a backup, or conduct a test on safety-critical equipment without the vessel-specific engineering, authorization, and operational controls needed to protect safe operation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Recovery planning should address restoring onboard computer-based systems and networks, reinstating essential or mission-critical assets, and analyzing root causes to reduce the chance of recurrence. Audits and periodic review help determine whether the controls, inventory, training, and recovery arrangements remain suitable as systems, connections, and operating conditions change.
Best Value
- easy-to-use 7” color fishfinder with new vivid scanning sonar color palettes to easily distinguish fish and structure
- supports garmin chirp traditional sonar plus chirp clearvü and chirp sidevü scanning sonars (requires compatible transducer)
- high-sensitivity gps to mark waypoints, create routes and view your boat’s speed
- includes built-in quickdraw contours mapping
- wi-fi connectivity allows you to connect to the activecaptain app with compatible smartphone to transfer waypoints, receive smart notifications (including software update notifications) and access the garmin quickdraw community
Use standards and external support as implementation aids
MSC-FAL.1/Circ.3/Rev.4 points to additional references including ISO/IEC 27001; IACS Unified Requirements E26, on cyber resilience of ships, and E27, on cyber resilience of onboard systems and equipment; IACS Recommendation 166; NIST Cybersecurity Framework 2.0; Guidelines on Cyber Security Onboard Ships supported by maritime industry organizations; and IAPH cybersecurity guidance for ports and emerging maritime supply-chain technologies. IMO describes its reference list as non-exhaustive and advises checking current versions and applicable Administration requirements. The circular also says these references are not issued by IMO and their use remains at the discretion of individual users.
When choosing a framework, technical approach, or outside support, assess whether it fits the vessel’s type and operating profile; accounts for safety-critical interdependencies; covers OT/IT boundaries, ship-port and ship-to-shore links, and vendor or maintenance access; aligns with flag, Administration, and classification requirements; and addresses the full lifecycle from design and integration through operation, patching, backup, response, and recovery. For complex or highly connected systems, specialist maritime OT cybersecurity assessment or incident-response support may be appropriate. Verify relevant maritime experience and geographic coverage before engaging a provider; IMO does not endorse a particular vendor.
Keep ship-port regulatory developments in scope
Cybersecurity changes affecting Maritime Single Windows are an adjacent ship-port information-exchange issue, not a direct control prescription for onboard propulsion or navigation OT. In its summary of the 50th Facilitation Committee session in March 2026, IMO said the Committee had approved amendments to the FAL Convention annex that would require Contracting Governments to implement cybersecurity measures for Maritime Single Windows under national legislation. At that time, submission for adoption at FAL 51 in 2027 and entry into force on 1 January 2029 were expected, not completed milestones. Operators should check the current status and relevant national requirements when assessing port-facing systems.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
