Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
Who we protect

Cyber security for port authorities

You manage the port, often its community system and vessel traffic, and serve the public and the trade.

Take the 2-minute test
See the launch offer
Your cyber risks

What public sources say about port authorities

Each card links to its source. We kept only what the sources say.

Public services stop
In September 2018 ransomware hit the Port of San Diego: park permits, public records requests and other business services were affected.
Named in NIS2
NIS2 Annex I lists the managing bodies of ports, their port facilities and the operators of vessel traffic services.
Management is responsible
NIS2 Article 20 says management bodies approve and oversee the measures and must follow training.
Guidance written for ports
ENISA published port cyber security good practices in 2019 and guidelines on cyber risk management for ports in 2020.

Sources: Security Affairs, 28 September 2018 · EUR-Lex: Directive (EU) 2022/2555, Annex I · ENISA, port cyber security good practices, 26 November 2019 · ENISA, cyber risk management for ports, 17 December 2020

Isometric illustration of an open-source port community system
What PCA gives you

What Port Cyber Alliance gives you

Launch offer
Ten one-hour video calls of engineering advice and two site visits a year, for every member.
Team self-test
For whoever leads IT or operations: people, visibility, exercises and the logistics chain.
NIS2 in plain words
Who is covered, the ten Article 21 measures and the 24 h, 72 h and one-month deadlines, with the article numbers.
Best practices
The IMO guidelines, the NIS2 measures and ENISA's port guidance in one page, with the sources.
Report an incident in confidence
Tell us what you see. We answer within one working day and help you prepare the next steps.
IP blocklist and CVE feed
What the PCA API serves today for port software, with your organisation's API key.
Open source

Open-source packages for port authorities

Free tools we build for port and terminal engineers. Some are public, the others we send on request. Open a card for the details.

See every package and how to get them

Isometric illustration: Maritime cyber toolkit

PublicCyber security

Maritime cyber toolkit

Copy-paste snippets that send your security events to the Port Cyber Alliance API.

For
SIEM, SOC and integration engineers, and their coding agents
Stack
curl · Python · JavaScript · PHP · Go · OpenAPI
Licence
See the repository
State
The code is on our public GitHub. Use it today.

What is in it today

  • One snippet per language reports an incident to POST /incidents and prints 201 on success
  • Generated from the PCA OpenAPI description, never hand-written
  • AGENTS.md: instructions an AI coding agent can follow to wire your SIEM unattended
  • Error table: 401 bad key, 422 bad schema, 429 over quota
View on GitHubTalk to us about itGet an API key
Isometric illustration: Open detection rules (Sigma)

AvailableCyber security

Open detection rules (Sigma)

Sigma rules that spot abnormal access to a terminal operating system, convertible for most SIEMs.

For
SOC teams and security officers of ports and terminals
Stack
Sigma · Windows Security log · pySigma · sigma-cli
Licence
DRL-1.1
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • A remote desktop logon (event 4624, type 10) on a TOS server from outside the approved admin network
  • An account added to the local Administrators group (event 4732) of a TOS server
  • Validated with sigma-cli; sample events that must and must not match, with a test script

What it will never do

  • Carry a real host name, address or customer name: every value is an example you replace
Download the rules (zip)Talk to us about itRead how to deploy them
Isometric illustration: Vendor cyber questionnaire

AvailableCyber security

Vendor cyber questionnaire

The cyber questions a terminal sends a software vendor, with an online form that sends nothing.

For
IT and security teams of ports and terminals, and the software vendors who answer them
Stack
YAML · JSON · PDF · HTML form · JavaScript
Licence
CC-BY-4.0
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • 34 questions in eight families (access, data, logs, backups, incidents, subcontractors, penetration tests, end of contract), one id each
  • An online form that runs in the browser only: answers stay on the device until exported as JSON or CSV
  • The same questionnaire in YAML, JSON and PDF, with the dated public sources behind each family
  • Questionnaire under CC BY 4.0, form script under MIT, README in the zip

What it will never do

  • Send your answers anywhere: the form has no server and blocks every network call
  • Certify a vendor
Download the questionnaire (zip)Talk to us about itRead how to use it
Isometric illustration: Post-deployment pentest regression scripts

AvailableCyber security

Post-deployment pentest regression scripts

Five shell probes that check, after every deployment, that fixed web findings have not come back.

For
Security and DevOps engineers who deploy web applications and APIs
Stack
bash · curl · GitHub Actions · GitLab CI
Licence
MIT
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • Five probes: CORS origin reflection, WordPress login enumeration, hidden webhook route, health endpoint, build and commit endpoint
  • One request each, exit code 0 (holds), 1 (regressed) or 2 (usage error or unreachable, never a pass)
  • A runner for all five, GitHub Actions and GitLab CI examples
  • A self-test against a local test server: 13 cases, hardened and regressed

What it will never do

  • Replace a penetration test: they re-check five known fixes and find nothing new
  • Run against a system you do not own or are not authorised in writing to test
Download the scripts (zip)Talk to us about itRead how to run them
Isometric illustration: Port SIEM rules and cyber governance

ComingCyber security

Port SIEM rules and cyber governance

The Wazuh detection rules and decoders we write, with the written rules behind them.

For
Security officers and SOC teams of ports and terminals
Stack
Wazuh rules · Wazuh decoders · Markdown
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Wazuh detection rules and decoders
  • Security policy and risk analysis templates
  • Patch delays by severity
  • Incident notification procedure, 24 h and 72 h (NIS2 article 23), and an incident register

What it will never do

  • Carry a secret, an IP address, a host name or a customer name
Get the package and talk to usSIEM and AI agents for ports
Isometric illustration: Security advisories

ComingCyber security

Security advisories

Advisories on port and container-logistics software, under coordinated disclosure, machine-readable.

For
Security teams of ports and terminals, and the software vendors they rely on
Stack
CVE JSON 5 · CVSS · CSAF 2.0 · OSV · RSS / JSON feeds
Licence
CC-BY-4.0
State
Specified, being built. Ask us to be told first.

What it will contain

  • A disclosure policy
  • Advisory ids PCA-YYYY-NNNN, linked to a CVE id when one is assigned
  • Machine-readable records and RSS / JSON feeds

What it will never do

  • Publish a vendor's vulnerability without coordinating with the vendor
Get the package and talk to usRead the advisories
Isometric illustration: CVE sync for WordPress

ComingCyber security

CVE sync for WordPress

Mirror the CVE list into a WordPress site, filtered for port and terminal software.

For
Teams that run a security or community website on WordPress
Stack
PHP · WordPress · WP-CLI · NVD API 2.0 · CVE JSON 5
Licence
GPL-2.0-or-later
State
Specified, being built. Ask us to be told first.

What it will contain

  • Tables for CVEs, products, watchlists, sync log and advisories
  • Full and delta sync run by the system cron, resumable and idempotent
  • Admin filters (vendors, keywords, severity) and public pages with structured data

What it will never do

  • Scan your WordPress for vulnerabilities: other plugins do that
Get the package and talk to us
Isometric illustration: Error reporting

ComingCyber security

Error reporting

Send errors and security events from your own port systems to a receiver you control, without personal data.

For
Engineers who run port web systems, WordPress first
Stack
JSON Schema · WordPress agent · HTTP receiver
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • An event envelope (JSON Schema)
  • A WordPress agent
  • A receiver: HTTP endpoint, grouping, alerts
  • Scrubbing: no IP address, no secret, no personal data leaves

What it will never do

  • Send personal data
  • Phone home to anyone you did not configure
Get the package and talk to us
Isometric illustration: Open-source port community system

ComingPlatforms

Open-source port community system

A free port community system, built from bricks we already run at terminals.

For
Port authorities and port communities
Stack
PHP · REST API · Playwright tests
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What is in it today

  • Specifications: 17 bricks, 48 features, 8 UML diagrams

Next

  • Each feature starts with its API contract test, then the code, then a browser test
Get the package and talk to us
Isometric illustration: Truck appointments (VBS) and gate (GOS)

ComingPlatforms

Truck appointments (VBS) and gate (GOS)

Our vehicle booking system and gate operating system, opened as open source.

For
Container terminals and their hauliers
Stack
PHP 8.1 · MySQL · REST API
Licence
To be decided before anything is published
State
Specified, being built. Ask us to be told first.

What it will contain

  • The core of the VBS and the GOS
  • Connectors and plugins around it
Get the package and talk to us
Questions

Port authorities: questions

Click a question to read the answer.

Yes. Any organization in the port chain can join: terminals, port authorities, marinas, oil and gas ports, shipping lines, hauliers, freight forwarders and the industrial shippers that depend on them. Start with the launch offer.

Very likely, if the port is in the EU. Annex I of Directive (EU) 2022/2555 lists, under water transport, the managing bodies of ports, their port facilities, the entities operating works and equipment within ports, and vessel traffic services. Read our NIS2 page.

Yes. Our philosophy is to harmonise the logistics chain: terminals, lines, hauliers and forwarders can each join, and the pages for each actor show what we give them.

No. Port Cyber Alliance is not a CSIRT nor a competent authority. If you are in scope of NIS2, notifications go to your national CSIRT or competent authority. See incident reporting.

Launch offer

Talk to engineers who work inside ports

Ten hours of engineering advice and two site visits a year, for the authority and the systems it shares with the port community.

Want to know where you stand?

Take the 2-minute test

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting