Compliance

IMO cyber guidelines (Rev.4): a terminal's checklist

Rev.4 of 28 May 2026, point by point: the evidence to hold and the ISPS Code link.

Rev.4

What Rev.4 is, and what it is not

The IMO guidelines fit in nine pages. This page takes every point of paragraph 3.5, adds the few that sit elsewhere in the text (management, gap assessment, protection of the documents), and says, for a container or bulk terminal, what to hold as evidence and where it meets the ISPS Code. Paragraph numbers are those of Rev.4 as published by IMO.

The six functions

The six functional elements, as a terminal reads them

Open the points below for what Rev.4 asks, what it means for a terminal, the evidence to hold and the ISPS Code paragraph.

Govern · 4 points

Rev.4 3.5.1. Strategy, roles and business continuity, including backups, disaster recovery and crisis management.

Identify · 4 points

Rev.4 3.5.2. The systems, their dependencies and supply chains, the inventory and the risk assessment.

Protect · 12 points

Rev.4 3.5.3. The minimum controls: accounts, passwords and MFA, exposure, logs, segmentation, media, training, backups, supply chain, audits.

Detect · 1 point

Rev.4 3.5.4. Know the relevant threats and watch the systems for them.

Respond · 3 points

Rev.4 3.5.5. Report within the required time frames, keep records, contain the incident.

Recover · 2 points

Rev.4 3.5.6. Restore the critical systems and fix the root cause.

Point by point

The 26 points and the evidence to hold

Click a point to read what Rev.4 asks, the evidence to hold and the link with the ISPS Code.

What Rev.4 asks (paragraph 3.5.1.1)

Designate a person or entity accountable for the planning, resourcing and execution of cybersecurity activities.

For a terminal

Name one owner for cyber risk across IT and operational systems (gate, yard, cranes, access control, cameras), not only for office IT. If this is not the port facility security officer, write down how the two work together.

Evidence to hold

A dated designation letter or organisation chart naming the person or entity
The scope of that role, covering IT and operational technology (OT)
How the cyber owner and the port facility security officer (PFSO) coordinate

ISPS Code, Part A 17.1 and 16.3.10

The PFSO is designated and identified in the plan with 24-hour contact details; the plan can name the cyber contact the PFSO calls.

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (2026-05-28) · ISPS Code, Parts A and B, as reproduced in Annexes II and III of Regulation (EC) No 725/2004 on enhancing ship and port facility security (2004-03-31)

What Rev.4 asks (paragraph 3.5.1.2)

Give the designated person or entity the necessary authority and support, and make sure they have sufficient knowledge and expertise in cyber risk management.

For a terminal

The cyber owner can stop a risky change, get a budget decision and reach management. Their competence is shown, not assumed.

Evidence to hold

The written mandate or delegation of authority
The budget or resource decisions for cybersecurity (meeting minutes)
Training certificates or a short competence record for the person

ISPS Code, Part A 17.3

The ISPS Code uses the same idea for the PFSO: « given the necessary support to fulfil the duties ».

What Rev.4 asks (paragraph 3.3)

Cyber risk management starts at senior management level: management follows relevant training, embeds a culture of cyber risk awareness at all levels, and keeps the regime in continuous operation with feedback mechanisms.

For a terminal

The management of the terminal is briefed on cyber risk, has taken a short training, and reviews the cyber position at a set interval.

Evidence to hold

Management training attendance (date, names or roles)
Minutes of management meetings where cyber risk was reviewed
The feedback loop: how incidents, audits and drills reach management

ISPS Code

No direct paragraph: keep it in your cyber file.

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (2026-05-28)

What Rev.4 asks (paragraph 3.5.1)

Govern includes ensuring business continuity, such as backup management and disaster recovery, and crisis management.

For a terminal

A continuity plan that says how the terminal keeps working (gate, vessel and yard operations) when a critical system is lost, who decides, and how the crisis team is called.

Evidence to hold

The business continuity plan covering the critical systems, with its date and owner
The disaster recovery plan for those systems
The crisis team list and call-out procedure

ISPS Code, Part A 16.3.3

The plan must cover procedures for responding to security threats or breaches, « including provisions for maintaining critical operations of the port facility or ship/port interface ».

What Rev.4 asks (paragraph 3.5.2.1)

Identify the systems, assets, services, data and capabilities, and the interdependencies between safety-critical systems (including the information flow), whose disruption poses risks, including those related to the software and hardware supply chains.

For a terminal

List the systems the terminal cannot run without, how data flows between them, and which suppliers they depend on: for example the terminal operating system, gate and appointment systems, crane and equipment controls, access control and video, and the links to shipping lines, customs and the port community system.

Evidence to hold

The list of critical systems with an owner for each
A data-flow or dependency diagram between them
The suppliers and service providers each critical system depends on

ISPS Code, Part A 15.5.1 · Part B 15.3.5

The port facility security assessment identifies and evaluates the important assets and infrastructure to protect, and addresses « radio and telecommunication systems, including computer systems and networks ».

What Rev.4 asks (paragraph 3.5.2.2)

Establish and maintain an inventory of digital systems, and identify internal and external system dependencies and network connections.

For a terminal

Rev.4 writes « on board the ship »; the terminal equivalent is an inventory of its IT and OT systems and of every connection to the outside: vessels, shipping lines, customs, rail and road partners, and suppliers' remote access.

Evidence to hold

The asset inventory (IT and OT), with the date of the last update
A network diagram showing the zones and the connections between them
The list of external connections, with the purpose and owner of each

ISPS Code, Part B 15.3.5

The inventory is the input the assessment needs for computer systems and networks.

What Rev.4 asks (paragraph 3.5.2.3)

Carry out a risk assessment of the systems, services, assets, data and capabilities critical to operations whose sudden failure may result in hazardous situations: identify cyber threats and vulnerabilities, and assess the likelihood and impact of a cyber incident on safety, availability, integrity and confidentiality.

For a terminal

A dated cyber risk assessment of the critical systems, with the threats, the weaknesses found and the treatment decided for each risk.

Evidence to hold

The risk assessment report, with its date and method
The risk register with likelihood, impact, owner and treatment
The date of the next review

ISPS Code, Part A 15.4 and 15.5.2 to 15.5.4

The port facility security assessment identifies threats and their likelihood, countermeasures and weaknesses, « including human factors », and is reviewed when threats or the facility change.

What Rev.4 asks (paragraph 3.4)

Assess and compare the organisation's current and desired cyber risk management postures, to reveal gaps and address them through a risk-based approach.

For a terminal

Pick a reference (the guidelines name ISO/IEC 27001, the NIST framework 2.0 and the IAPH guidelines for ports, among others), measure where the terminal stands against it, and turn the gaps into a dated action plan.

Evidence to hold

The gap assessment against the chosen reference, dated
The action plan with owners and target dates

ISPS Code

No direct paragraph: keep it in your cyber file.

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (2026-05-28)

What Rev.4 asks (paragraph 3.5.3.1)

Assign unique credentials for all users, separate user and privileged accounts, collect security devices and deactivate accounts for departing employees or users.

For a terminal

No shared logins on the terminal systems (including the crane, gate and access-control consoles where technically possible), separate administrator accounts, and a leaver procedure that also covers contractors and suppliers.

Evidence to hold

The account review of the critical systems, with the date and the shared accounts left (and why)
The list of privileged accounts and who holds them
The leaver procedure and the record of the last leavers processed (badges, tokens, accounts)

ISPS Code, Part A 16.3.2

The plan covers measures to prevent unauthorised access to the facility and its restricted areas; the badge and access-control system that enforces them is itself a computer system with accounts.

What Rev.4 asks (paragraph 3.5.3.2)

Change all default passwords on all devices, enforce a strong password policy, protect against brute force and phishing, and use multi-factor authentication or continuous authentication, secured communications and secured emergency communication systems, where appropriate.

For a terminal

Default passwords changed on cameras, controllers, switches and appliances; multi-factor authentication on remote access, administrator accounts and e-mail first.

Evidence to hold

The record that default passwords were changed, per device type
The password policy
The list of systems with multi-factor authentication, and those without (and why)
The secured means used for security and emergency communications

ISPS Code, Part B 16.3.2 and 16.8.4

The plan details the communication systems that keep the security organisation working and in contact with ships and authorities.

What Rev.4 asks (paragraph 3.5.3.3 · 2.2.2)

Limit exploitable services on the Internet and segment OT device networks from IT networks; OT systems should be segmented from IT systems and protected from Internet-facing systems.

For a terminal

Know what the terminal exposes to the Internet, close what is not needed, and keep crane, equipment and other operational networks apart from the office network.

Evidence to hold

The result of the last external exposure check, with its date
The firewall rule review between the zones
The network diagram showing the OT zones separated from IT

ISPS Code, Part B 15.3.5

Exposure and segmentation are part of the computer systems and networks the assessment addresses.

What Rev.4 asks (paragraph 3.5.3.3 · 3.8)

Establish a hardware and software approval process, and ensure security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure. Equipment and systems should be designed and tested to international standards for cyber resilience.

For a terminal

Nothing joins the network without approval; security requirements are written into tenders and contracts; the terminal follows the security advisories of its suppliers and applies the fixes.

Evidence to hold

The approval procedure and its log for new hardware and software
The security clauses used in purchases (see the RFP cyber checklist)
The tracking of supplier security advisories for the systems in use

ISPS Code

No direct paragraph: keep it in your cyber file.

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (2026-05-28)

What Rev.4 asks (paragraph 3.5.3.3)

Collect and securely store logs for intrusion detection and incident response.

For a terminal

Logs from the critical systems, the firewalls and the remote-access paths are collected in one place, kept long enough for an investigation, and protected from change.

Evidence to hold

The list of log sources collected
The retention period decided by the terminal, and where the logs are stored
Who can read, and who cannot alter, the logs

ISPS Code, Part A 16.3.9 · 17.2.8

Logs support the reporting of security incidents and the records the PFSO keeps.

What Rev.4 asks (paragraph 3.5.3.4)

Implement security measures (such as firewall or antivirus) for digital systems and devices that have access to the Internet or the intranet, or interact with third-party or landside systems, particularly those of ship/port interfaces; implement policies and procedures on the use of cryptography.

For a terminal

Every link with a vessel, a shipping line or a partner goes through a controlled point; endpoints are protected; encryption is used for data in transit on those links.

Evidence to hold

The list of ship/port and partner interfaces with the control applied to each
The anti-malware coverage of the endpoints and servers
The cryptography policy

ISPS Code, Part A 16.3.7

The plan holds the procedures for interfacing with ship security activities.

What Rev.4 asks (paragraph 3.5.3.5)

Establish controls to protect systems from the use of unauthorised removable media.

For a terminal

USB keys and laptops brought by staff, crews and maintenance suppliers are controlled before they touch operational systems.

Evidence to hold

The removable media policy
The technical control in place (blocking, scanning station) and where

ISPS Code

No direct paragraph: keep it in your cyber file.

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (2026-05-28)

What Rev.4 asks (paragraph 3.5.3.6 · 3.5.4.2 · 3.5.5.3 · 3.5.6.2)

Mandate annual basic cybersecurity training for all employees and OT-specific training for OT users, covering cyber hygiene and how to recognise, respond to and recover from a cyber incident; test the knowledge occasionally, for example through drills and exercises.

For a terminal

A yearly training plan for everyone, a specific one for operators and engineers of the operational systems, and a cyber scenario in the drills the terminal already runs.

Evidence to hold

The training plan and attendance records, per year
The OT-specific training records
The report of the last drill or exercise with a cyber scenario

ISPS Code, Part A 18.1 to 18.4 · Part B 18.5 and 18.6

The ISPS Code already requires training, drills and exercises for the port facility (Part B guidance: drills at least every three months, exercises at least once each calendar year with no more than 18 months between them); a cyber scenario can be one of them.

What Rev.4 asks (paragraph 3.5.3.7)

Perform regular system backups and software updates, and develop and maintain incident response plans.

For a terminal

Backups of the critical systems, including a copy that an attacker on the network cannot reach, restore tests, updates applied on a schedule, and a written incident response plan.

Evidence to hold

The backup schedule and the report of the last restore test
The update status of the critical systems
The incident response plan, with its date and owner

ISPS Code, Part A 16.3.3

Responding to security threats while maintaining critical operations is a required part of the plan.

What Rev.4 asks (paragraph 3.5.3.8 · 2.2.6)

Establish policies on software and hardware supply chain security for the systems and assets identified as critical, and consider the risks posed by third-party vendors, embedded systems and maintenance devices.

For a terminal

A written policy for the suppliers of the critical systems: what they must prove before connecting, how their remote access is controlled, and what the contract says about patches, incidents and exit.

Evidence to hold

The supplier security policy
The list of critical suppliers and how each reaches the network
The security clauses of their contracts (see the vendor onboarding grid)

ISPS Code

No direct paragraph: keep it in your cyber file.

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (2026-05-28)

What Rev.4 asks (paragraph 3.5.3.9)

Establish policies and procedures to assess the effectiveness of cyber risk management measures, such as audits, and to periodically review and update these measures.

For a terminal

An audit or test of the cyber measures at a set interval, and a review that updates the measures and this checklist.

Evidence to hold

The audit plan and the last audit or test report
The record of the last review and the changes it made

ISPS Code, Part A 16.3.8, 16.3.13 and 16.4

The plan provides for its periodic review and its auditing; internal auditors are independent of the activities audited unless that is impracticable.

What Rev.4 asks (paragraph 3.6)

Protect any documents developed for these functional elements by procedures aimed at preventing unauthorised access, deletion, destruction or amendment.

For a terminal

Network diagrams, inventories, risk assessments and this checklist are sensitive: keep them in one controlled place with access rights and version history.

Evidence to hold

Where the documents are stored, and who has access
The version history or change log

ISPS Code, Part A 16.3.11, 16.7 and 16.8

Almost the same words as the ISPS Code for the plan itself: protected from unauthorised access or disclosure, and, in electronic format, from « unauthorised deletion, destruction or amendment ».

What Rev.4 asks (paragraph 3.5.4 · 3.5.4.1)

Maintain a list of relevant threats and of threat actor tactics, techniques and procedures, and actively monitor systems for those threats; implement measures to detect unintended activity and identify a cyber incident in a timely manner.

For a terminal

A short list of the threats that matter to the terminal, and monitoring that would see them on the critical systems, with a named person who looks at the alerts.

Evidence to hold

The threat list, with the date of its last update
The monitoring coverage: which systems, which alerts, who reviews them and when

ISPS Code, Part A 15.4 and 15.5.2

The assessment identifies possible threats and is reviewed as threats change.

What Rev.4 asks (paragraph 3.5.5.1)

Report incidents to the necessary parties within the required time frames as defined by the Administration.

For a terminal

Know who must be told and how fast: the national authority, the computer security incident response team, and, in the EU where NIS2 applies, the early warning within 24 hours and the notification within 72 hours.

Evidence to hold

The reporting procedure with recipients and time frames
The up-to-date contact list

ISPS Code, Part A 16.3.9 · 17.2.8

The plan holds the procedures for reporting security incidents; the PFSO reports to the relevant authorities and keeps records of occurrences.

What Rev.4 asks (paragraph 3.5.5.2)

Keep records of cyber incidents.

For a terminal

An incident register, including the incidents that were contained quickly.

Evidence to hold

The incident register (date, systems, impact, actions, closure)

ISPS Code, Part A 17.2.8

The PFSO maintains records of occurrences which threaten the security of the port facility.

What Rev.4 asks (paragraph 3.5.5)

Develop, implement and practise activities and plans to restore systems needed for shipping and ship-port operations, and minimise the effect of a detected incident on other parts of the systems.

For a terminal

Playbooks that say how to isolate a zone or a supplier link without stopping the whole terminal, tested in an exercise.

Evidence to hold

The response playbooks for the main scenarios
The report of the last exercise and the actions it produced

ISPS Code, Part A 16.3.3 · Part B 18.6

Exercises under the ISPS Code test communication, coordination, resource availability and response.

What Rev.4 asks (paragraph 3.5.6 · 3.5.6.1)

Develop, maintain and implement strategies for the recovery and reinstatement of essential business or mission critical assets or systems that might be impacted by a cyber incident.

For a terminal

The order in which systems come back, the recovery times the terminal sets for itself, and the manual fallback for gate and vessel operations while systems are down.

Evidence to hold

The recovery plan with the restoration order and the target times set by the terminal
The manual fallback procedures, and when they were last used or tested

ISPS Code, Part A 16.3.3

Maintaining critical operations of the port facility and the ship/port interface.

What Rev.4 asks (paragraph 3.5.6.3)

Carry out root cause analysis of cyber incidents, to resolve the underlying issues and vulnerabilities and prevent recurrence.

For a terminal

After each significant incident, a short analysis of why it happened, and actions tracked until closed.

Evidence to hold

The root cause analysis reports
The action tracker and its closure dates

ISPS Code, Part A 17.2.5

The PFSO recommends modifications to the plan to correct deficiencies.

ISPS Code

Where the points meet your port facility security plan

Twenty-one of the 26 points have an ISPS Code paragraph next to them. The other five (senior management, gap assessment, acquisition, removable media, supply chain policy) have no direct equivalent: keep them in your cyber file and reference it from the plan.

Assessment, Part B 15.3.5

The port facility security assessment addresses « radio and telecommunication systems, including computer systems and networks »: the inventory, the dependencies and the risk assessment (I1 to I3) feed it.

Plan, Part A 16.3

The plan holds procedures for responding to threats while maintaining critical operations, interfacing with ships, reviewing, reporting incidents, protecting its information and auditing (G4, P6, P9, P11, R1, C1).

Protection, Part A 16.7 and 16.8

Rev.4 asks to protect cyber documents from unauthorised access, deletion, destruction or amendment (3.6): the words the ISPS Code uses for the plan itself (P12).

Drills and exercises, Part A 18

Drills at least every three months and exercises at least once each calendar year (Part B 18.5 and 18.6): a cyber scenario in one of them answers Rev.4's call to test knowledge (P8, R3).

Free tool

Download the checklist

One checklist, two formats. Version 1.0, published 11 November 2026, from MSC-FAL.1/Circ.3/Rev.4 of 28 May 2026. Generic: no client, no invented figure.

CSV

One row per point: the Rev.4 paragraph, what it asks, the evidence, the ISPS Code paragraph and empty columns for status, owner, where the evidence is and review date. Opens in any spreadsheet.

PDF

The same checklist on paper, with a one-page summary sheet and the sources.

Licence

Creative Commons Attribution 4.0 (CC BY 4.0): reuse and adapt it, credit Port Cyber Alliance.

Download the checklist (CSV)

Download the checklist (PDF)

Questions

IMO cyber guidelines: questions

Click a question to read the answer.

They are primarily intended for ships (Rev.4, paragraph 2.3.1), but they cover ship-port interfaces and the systems that connect ships to shore, and they list the IAPH Cybersecurity Guidelines for Ports and Port Facilities among the references. For the port facility itself, the mandatory frame is the ISPS Code, whose security assessment covers computer systems and networks, plus any national rule such as NIS2 in the EU.

MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management, dated 28 May 2026. It was approved by the Facilitation Committee at its fiftieth session (23 to 27 March 2026) and by the Maritime Safety Committee at its 111th session (13 to 22 May 2026), and it supersedes the earlier versions of the circular.

It is a circular of guidelines: recommendations that Member Governments are invited to bring to the attention of all stakeholders. What is mandatory for a terminal comes from its Administration and national law; Rev.4 itself tells users to refer to those requirements. The guidelines call the controls of each functional element the minimum controls that should be implemented.

Each point names the ISPS Code paragraph it relates to, when there is one: the assessment of computer systems and networks (Part B 15.3.5), the plan's procedures for incidents, reporting, review and audit (Part A 16.3), the protection of the plan (16.7 and 16.8), and drills and exercises (Part A 18, Part B 18.5 and 18.6). The plan stays the document your authority approves; this checklist helps you find what to add or reference.

Yes. The CSV and PDF are published under the Creative Commons Attribution 4.0 licence (CC BY 4.0): copy and adapt them, including commercially, as long as you credit Port Cyber Alliance and link to this page. The checklist is not legal advice and does not replace the text of the guidelines or your Administration's requirements.

Keep going

Port cyber compliance

NIS2 and the ISPS Code for port facilities: what they ask, with sources.

RFP cyber checklist

Point P4 and P10 in practice: the eight cyber requirements to write into a port software tender, and how to score the answers.

Cyber maturity grid

Once the checklist is filled in: where the terminal stands on a five-level maturity grid, and what the next level asks.

Vendor cyber onboarding

What a terminal asks a software vendor before connecting it: eight families of questions and a free grid.

Team self-test

Twelve questions for whoever leads IT or operations, about two minutes.

Launch offer

Preparing for the IMO guidelines?

Members use their advisory calls to go through this checklist with engineers who work inside terminals, in confidence.

Want an engineer to review your checklist?

See the launch offer

Compliance

IMO cyber guidelines (Rev.4): a terminal's checklist

Rev.4

What Rev.4 is, and what it is not

The reference

Written for ships, open to ports

Six functions, minimum controls

The ISPS Code stays the frame

The six functions

The six functional elements, as a terminal reads them

Govern · 4 points

Identify · 4 points

Protect · 12 points

Detect · 1 point

Respond · 3 points

Recover · 2 points

Point by point

The 26 points and the evidence to hold

ISPS Code

Where the points meet your port facility security plan

Assessment, Part B 15.3.5

Plan, Part A 16.3

Protection, Part A 16.7 and 16.8

Drills and exercises, Part A 18

Free tool

Download the checklist

CSV

PDF

Licence

Questions

IMO cyber guidelines: questions

Keep going

Related pages

Port cyber compliance

RFP cyber checklist

Cyber maturity grid

Vendor cyber onboarding

Team self-test

Launch offer

Preparing for the IMO guidelines?

Send this page to a colleague

Port Cyber Alliance

Securing Maritime Trade Through Collective Cyber Defense