Where does your terminal stand on cyber?

IMO Rev.4 · Determine the current cyber risk to ships and ship/port interfaces: systems, assets, data, dependencies, supply chains, risk assessment.
NIST CSF 2.0 · The organization's current cybersecurity risks are understood (ID).

Level 1 · Ad hoc
Nobody can list every system the terminal runs on. Knowledge of the TOS servers, gate lanes, crane controllers and vendor connections sits in a few people's heads.
Evidence that proves it: Nothing beyond invoices and vendor contracts
To reach level 2: Write a first list of the systems that would stop the gate, the yard or the quay if they failed, with an owner for each.

Level 2 · Started
A list exists for office IT or for the TOS, but operational equipment (cranes, gates, OCR, reefer monitoring) and vendor remote access are missing or out of date.
Evidence that proves it: A spreadsheet of IT assets · A network diagram more than a year old
To reach level 3: Extend the inventory to operational technology and to every external connection, and rank the systems by what they stop when they fail.

Level 3 · Defined
One inventory covers IT and operational technology, with an owner, the network connections and the supplier of each system. The systems critical to operations are ranked and a risk assessment was written for them.
Evidence that proves it: Inventory with OT and vendor connections, and the date of its last update · Written risk assessment of the critical systems · List of the vendors that can reach the site remotely
To reach level 4: Update the inventory through change management, and repeat the risk assessment on a schedule and after each major change.

Level 4 · Managed
The inventory is updated with every change and compared with what is really seen on the network. The risk assessment is repeated on a schedule and after major changes, and it covers the software and hardware supply chains.
Evidence that proves it: Change records that update the inventory · A network discovery report compared with the inventory · Dated risk assessments, supplier risk reviews
To reach level 5: Feed the risk register with the threat information shared by your port community and the authorities, and map your dependencies on chain partners.

Level 5 · Adaptive
The risks include the ship/port interfaces and the dependencies on partners in the port chain (port community system, port authority, shipping lines, hauliers). Shared threat information updates the risk register.
Evidence that proves it: Risk register entries linked to shared alerts · Dependency map with the chain partners · Minutes of the yearly review
To stay there: Keep it there: review the profile once a year and after any major incident in the port chain.

IMO Rev.4 · Implement risk control processes and measures to protect computer-based systems: accounts, passwords, multi-factor authentication, segmentation, removable media, training, backups, updates, supply chain policies, audits.
NIST CSF 2.0 · Safeguards to manage the organization's cybersecurity risks are used (PR).

Level 1 · Ad hoc
Shared or default passwords on gate kiosks, OCR and crane screens. Vendor remote access stays open all the time. Office IT and operational systems sit on the same network. Nobody had cyber training.
Evidence that proves it: None
To reach level 2: Remove default and shared passwords on the systems that run the gate and the quay, put multi-factor authentication on remote access, and close vendor access that is not in use.

Level 2 · Started
Multi-factor authentication protects some remote access and office IT gets its updates, but operational systems are not separated or patched. Training happens now and then.
Evidence that proves it: VPN settings showing multi-factor authentication · Patch reports for office IT only
To reach level 3: Separate operational technology from office IT, give every user a named account, extend the patch policy to OT and train all staff once a year.

Level 3 · Defined
Every user has a named account, administrators have a separate one, and remote access asks for a second factor. Operational technology is segmented from office IT, new hardware and software are approved, removable media are controlled, staff are trained every year, and backups and updates follow a written routine.
Evidence that proves it: Account list with separate admin accounts · Network diagram and firewall rules showing the segmentation · Training attendance records · Patch and backup logs · Removable media policy
To reach level 4: Measure the controls: access reviews on a schedule, patch time per severity, a test that the segmentation holds, security clauses in vendor contracts.

Level 4 · Managed
The controls are checked, not assumed: access reviews run on a schedule, patch times are tracked, segmentation is tested, critical suppliers sign security clauses and audits check that the measures work.
Evidence that proves it: Access review records · Patch time per severity, month by month · Penetration or segmentation test summary · Audit report · Vendor contracts with security clauses
To reach level 5: Turn test findings and incidents into control changes, and set your security requirements in every software tender.

Level 5 · Adaptive
Findings from tests, exercises and incidents change the controls. Security requirements are written into tenders, and connected partners are asked for the same level.
Evidence that proves it: Security annex of the last software tender · Control changes linked to findings · Connection agreements with partners
To stay there: Keep it there: review the controls once a year against new threats and new connections.

IMO Rev.4 · Develop, implement and practise activities to detect a cyber incident in a timely manner; maintain a list of relevant threats and actively monitor systems.
NIST CSF 2.0 · Possible cybersecurity attacks and compromises are found and analyzed (DE).

Level 1 · Ad hoc
Incidents are found by chance: a frozen screen, a slow TOS, a call from a vendor. Logs are not kept.
Evidence that proves it: None
To reach level 2: Collect the VPN, firewall and TOS logs in one place, keep them, and name the person who looks at alerts.

Level 2 · Started
Some systems keep logs for a short time and they are read only after a problem. Antivirus alerts reach the office IT team; operational systems are not watched.
Evidence that proves it: Log settings of a few systems · Antivirus console
To reach level 3: Centralise the logs with a retention period, include operational systems, and have a named person check alerts every working day.

Level 3 · Defined
Logs from the TOS, VPN, firewalls, directory and key operational systems are collected centrally. Named people check alerts every day, a list of relevant threats is kept, and staff are trained to recognise an incident.
Evidence that proves it: List of log sources with retention · Alert handling procedure and rota · Threat list with its last update · Training records
To reach level 4: Cover nights and weekends, write detection rules for terminal-specific threats, and measure the time to detect.

Level 4 · Managed
Monitoring runs around the clock, in-house or through a service. Rules catch terminal-specific events, such as a new administrator account on the TOS or vendor access outside its window, and the time to detect is measured and reported.
Evidence that proves it: Detection rule list with test dates · Monthly report with alerts and handling times · Monitoring service contract or rota
To reach level 5: Exchange threat information with your port community and the authorities, and tune the rules after every exercise.

Level 5 · Adaptive
Threat information is exchanged with the port community and the authorities, the team hunts for threats instead of waiting for alerts, and every incident or exercise improves the rules.
Evidence that proves it: Information-sharing agreements · Threat hunting reports · Rule changes linked to lessons learned
To stay there: Keep it there: test the detection once a year with an exercise that simulates a real attack path.

IMO Rev.4 · Develop, implement and practise plans to provide resilience and restore operations impaired by a cyber incident; report incidents within the required time frames and keep records.
NIST CSF 2.0 · Actions regarding a detected cybersecurity incident are taken (RS).

Level 1 · Ad hoc
There is no plan. Who decides, who calls the vendors and who reports to the authorities would be worked out on the day.
Evidence that proves it: None
To reach level 2: Write a one-page incident procedure: who decides, who to call, who reports to the authorities, and how the gate keeps running.

Level 2 · Started
A contact list and a basic procedure exist but were never practised, and the reporting obligations are unclear.
Evidence that proves it: Contact list · Procedure document
To reach level 3: Write an incident response plan with roles, reporting deadlines and degraded operations, and run a first tabletop exercise.

Level 3 · Defined
A written plan sets the roles, who decides, how incidents are reported to the authorities within the required time and how people are informed. Incidents are recorded, staff are trained, and a tabletop exercise took place in the last 12 months.
Evidence that proves it: Incident response plan with its version date · Incident log · Exercise report · Reporting templates
To reach level 4: Practise with operations and vendors, prepare containment steps for the TOS, the gate and operational systems, and measure the time to contain.

Level 4 · Managed
Exercises with operations, IT, vendors and management happen at least once a year. Containment steps are ready for the TOS, the gate and operational systems, outside help is arranged in advance, and response times are measured.
Evidence that proves it: Exercise reports with tracked actions · Containment playbooks · Incident response support agreement · Response time records
To reach level 5: Exercise with your chain partners (port authority, shipping lines, hauliers) and agree how you will inform each other.

Level 5 · Adaptive
The terminal exercises with its port community, notifications and public messages are coordinated with partners, and lessons learned are shared.
Evidence that proves it: Joint exercise reports · Communication agreements with partners
To stay there: Keep it there: change the exercise scenario every year and include a new partner each time.

IMO Rev.4 · Identify and implement measures to restore systems impacted by a cyber incident: recovery strategies for critical systems, training, root cause analysis.
NIST CSF 2.0 · Assets and operations affected by a cybersecurity incident are restored (RC).

Level 1 · Ad hoc
Nobody knows where the backups are, or they sit on the same network as the systems. Nobody knows how long a restore would take, and there is no written manual mode for the gate or the yard.
Evidence that proves it: None
To reach level 2: Make an offline or immutable backup of the TOS database and of the key configurations, and write down how the gate works in manual mode.

Level 2 · Started
Backups run, but a restore was never tested. People know informally how to work in degraded mode.
Evidence that proves it: Backup job reports
To reach level 3: Test and time a restore of the TOS, and write the recovery priorities and a degraded-mode runbook.

Level 3 · Defined
Critical systems have offline or immutable backups, a restore was tested and timed in the last 12 months, the recovery order and the degraded-mode runbook are written, and every incident gets a root cause analysis.
Evidence that proves it: Restore test report with times · Degraded-mode runbook · Root cause analysis reports
To reach level 4: Agree recovery objectives per system with operations, test against them, and run a recovery exercise that includes operational systems and vendors.

Level 4 · Managed
Recovery objectives per critical system are agreed with operations, regular restore tests meet them, recovery exercises include vendors, and actions from root cause analyses are followed to closure.
Evidence that proves it: Recovery objectives table · Test results compared with the objectives · Action tracker
To reach level 5: Coordinate recovery with your chain partners, and let recovery lessons shape design and purchasing choices.

Level 5 · Adaptive
Recovery is coordinated with the port chain, lessons from incidents and exercises change the architecture, and communication during recovery is planned with partners.
Evidence that proves it: Joint recovery plans · Architecture changes linked to lessons learned
To stay there: Keep it there: test a full recovery once a year, including a partner.

IMO Rev.4 · Establish and monitor risk management strategy, expectations and policies; define roles and responsibilities; ensure business continuity and crisis management; designate an accountable person with authority and support.
NIST CSF 2.0 · The organization's cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored (GV).

Level 1 · Ad hoc
Nobody is named for cyber. Whoever runs IT handles it when something happens, and management hears about it afterwards, if at all.
Evidence that proves it: None
To reach level 2: Name one accountable person with time and authority, and put cyber on the management meeting agenda.

Level 2 · Started
Someone is named but has no budget or authority. A few policies exist as drafts, and management talks about cyber after incidents.
Evidence that proves it: Nomination note · Draft policies
To reach level 3: Have management approve a cyber policy, define the roles, give the accountable person a budget and a regular report.

Level 3 · Defined
The accountable person has the authority, support and knowledge the role needs. Management approved the policies, roles are defined, business continuity and crisis management cover cyber, and management receives a regular report.
Evidence that proves it: Approved policy · Role descriptions · Management meeting minutes · Continuity and crisis plan
To reach level 4: Set measurable objectives, have management review them and follow cyber training, and check the measures with audits.

Level 4 · Managed
Management reviews objectives and indicators on a schedule, follows cyber training and approves the measures. Audits check that they work, and cyber is part of enterprise risk management and of purchasing.
Evidence that proves it: Indicator dashboard · Audit reports · Board or management minutes · Training records of managers
To reach level 5: Write your target profile and share your expectations with suppliers and partners in the port chain.

Level 5 · Adaptive
Cyber is part of the business strategy. The terminal states its target profile to suppliers and partners and takes part in the cyber governance of its port community.
Evidence that proves it: Strategy document · Supplier requirements · Participation in port community work
To stay there: Keep it there: review the strategy and the target profile once a year with management.