Who calls whom, a controlled stop of the gate and yard, the evidence to keep, and the reporting deadlines.
Four public texts, one plan on paper
When a cyber attack stops a gate or freezes the terminal operating system, nobody has time to write a plan. The people on duty need to know who decides, who calls whom, what stops and in which order, what must be kept for the investigators and which report is due when. This page gives the steps, and a template to fill in with your own names and numbers.
The first six hours, window by window
Six hours is our planning window, not a legal deadline. Each window has one goal and one owner. The steps of each window are listed below and in the template.
Who does what in the first six hours
Click a time window to read its steps. In the template each step has a box to tick, a time and the initials of the person who did it.
Goal · Turn a strange screen or an alert into a declared incident, with one person in charge.
Owner · Duty manager
- Whoever sees the problem (a frozen gate lane, a ransom note, an unknown account, an alert) calls the duty manager, not only IT.
- The duty manager opens the incident log on paper: time, who reported, what was seen, which systems.
- The duty manager declares the incident and names the incident lead. From now on one person decides.
- Do not switch off, wipe or reinstall anything yet. Do not pay, answer or contact the attacker.
Goal · The crisis team is reached by phone, not by the e-mail that may be compromised.
Owner · Incident lead
- Call the crisis team in the order of the call list: IT or OT on call, head of operations, the person accountable for cyber, the security officer.
- Call the software vendors whose systems are affected, on the numbers written in the plan.
- Open an out-of-band channel (phones, a separate messaging group) and say that the normal e-mail is not used for the incident.
- Note every call in the log, with the time.
Goal · Stop what must stop, in order and safely, and switch to the written manual procedure.
Owner · Head of operations, with IT or OT
- Bring the cranes and yard equipment to a safe position before any network is cut. Safety comes before IT.
- Close the automated gate lanes or switch them to the manual procedure; tell the trucks on site and those on their way.
- Freeze moves that cannot be checked: no release of a container on a status the system can no longer prove.
- Isolate the affected systems from the network as the plan says. Power a device down only if it cannot be disconnected.
- Keep a paper record of every move made in manual mode, to re-enter it later.
Goal · Stop the spread without destroying what the investigators will need.
Owner · IT or OT lead, with the incident response provider
- Disconnect the affected systems and the links to partners (EDI, port community system, vendor remote access) that may carry the attack.
- Before any clean-up, take a system image and a memory capture of a sample of affected machines, and keep the logs.
- Keep the evidence untouched: dated copies, who handled them and when, stored offline.
- Disable the accounts that are suspected, and reset the passwords of the administrator accounts from a clean machine.
- Check that the backups are intact and offline before relying on them.
Goal · Know which authority must be told, by whom and before which time, and brief the people who depend on the terminal.
Owner · Person accountable for cyber, with legal and the security officer
- Assess whether the incident is significant (NIS2) or reportable (US Coast Guard rule) with the criteria written in the plan; note the time you became aware of it.
- Prepare the early warning or the report with the facts known so far; send it within the deadline even if the facts are incomplete.
- Tell the shipping lines, the truckers and the port authority what is affected and what to do, with one approved message.
- Set the next crisis meeting and the hour of the next update. Write the decisions in the log.
Stopping the gate and the yard without making it worse
A terminal is not an office: stopping a system has physical effects on the quay, in the yard and at the gate. The order of the stop is written in advance, system by system, with who decides and the manual fallback. The containment and evidence steps follow the CISA, MS-ISAC, NSA and FBI, #StopRansomware Guide (update of the 2020 Ransomware Guide) (2023-09).
Safety first
Gate to manual
No release on doubt
The reporting deadlines
NIS2, Article 23(4), points (a), (b) and (d), the text:
« without undue delay and in any event within 24 hours of becoming aware of the significant incident, an early warning, which, where applicable, shall indicate whether the significant incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact; (b) without undue delay and in any event within 72 hours of becoming aware of the significant incident, an incident notification, which, where applicable, shall update the information referred to in point (a) and indicate an initial assessment of the significant incident, including its severity and impact, as well as, where available, the indicators of compromise; […] (d) a final report not later than one month after the submission of the incident notification under point (b) » (Directive (EU) 2022/2555, 14 December 2022)
Click a regime to read who reports, to whom and when.
For · Ports and terminals that are essential or important entities under NIS2 (Annex I, water transport)
Report to · The national CSIRT or competent authority
The clock starts at · Becoming aware of the significant incident
- 24 hours: Early warning: whether the incident is suspected to be malicious or could have a cross-border impact
- 72 hours: Incident notification: an update, a first assessment of severity and impact, the indicators of compromise where available
- On request: Intermediate report on relevant status updates
- 1 month: Final report, one month after the incident notification: description, severity and impact, root cause, mitigation, cross-border impact
For · Facilities with a Facility Security Plan under 33 CFR part 105, U.S.-flagged vessels and Outer Continental Shelf facilities
Report to · The National Response Center (NRC)
The clock starts at · The reportable cyber incident
- Without delay: Report every reportable cyber incident to the NRC, unless already reported to the Coast Guard under 33 CFR 6.16-1 (in force since 16 July 2025)
For · Ships and the ship/port interface, as guidance
Report to · As national rules and the plan require
The clock starts at · The incident
- Respond (3.5.5): Plans that are developed, implemented and practised; incidents reported within the required time frames; records kept
- Recover (3.5.6): Measures to restore the systems impaired by the incident: recovery strategies for critical systems, training, root cause analysis
Return to normal operations
Recovery is planned like the stop: in the order of operations, one system at a time, with a named person able to stop again. IMO Rev.4 asks for recovery strategies for critical systems and a root cause analysis (paragraph 3.5.6).
Restore in the order of operations
Check before you reconnect
Re-enter the manual period
Restart in steps
Learn and close
Download the incident response plan
One source, three formats. Version 1.0, published 11 November 2026. Names, numbers and site steps are left blank for your terminal to fill in. Generic: no client, no statistic, no price. Sources: Directive (EU) 2022/2555 (NIS2), Article 23 (reporting obligations) and Annex I (water transport: managing bodies of ports, their port facilities and entities operating works and equipment within ports) (2022-12-14) · U.S. Coast Guard, Cybersecurity in the Marine Transportation System, final rule, 90 FR 6298 (33 CFR part 101 subpart F; reporting in §§ 101.615 and 101.620(b)(7); in force 16 July 2025) (2025-01-17) · IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (functional elements Respond, paragraph 3.5.5, and Recover, paragraph 3.5.6) (2026-05-28) · NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (supersedes Rev. 2 of 2012) (2025-04-03) · CISA, MS-ISAC, NSA and FBI, #StopRansomware Guide (update of the 2020 Ransomware Guide) (2023-09) · ENISA, Guidelines - Cyber Risk Management for Ports (a four-phase approach mapped to the risk assessment steps of the ISPS Code) (2020-12-17).
Incident response plan: questions
Click a question to read the answer.
For the people who run a container terminal or a port facility: the head of operations, the IT or OT lead, the person accountable for cyber and the security officer. It gives them one written plan for the first hours of a cyber incident, the reports to send and the way back to normal operations.
Six hours is Port Cyber Alliance's planning window, not a legal deadline. It covers what has to be decided early: who leads, what stops, what evidence is kept and which report is due. Under NIS2 the clock for the 24-hour early warning starts when the entity becomes aware of the significant incident, so these hours count.
In the EU, NIS2 Article 23 applies to ports and terminals that are essential or important entities: an early warning within 24 hours, an incident notification within 72 hours and a final report one month after that notification. In the United States, facilities covered by the Coast Guard rule report every reportable cyber incident to the National Response Center without delay. Check with your competent authority which rules apply.
No. The #StopRansomware Guide of CISA and its partners says to identify the affected systems and isolate them immediately, and to power a device down only if it cannot be disconnected from the network. Before cleaning anything, take a system image and a memory capture of a sample of affected machines, and keep the logs.
Run a tabletop exercise: a short scenario, the crisis team around a table, the paper plan in hand. Note what is missing and update the plan. The 2-minute team test is a quick way to see where the team stands first.
Yes. The DOCX, Markdown and PDF files are published under the Creative Commons Attribution 4.0 licence (CC BY 4.0): copy and adapt them, including commercially, as long as you credit Port Cyber Alliance and link to this page.
Related pages
Report it to the alliance: members and engineers who work inside terminals help you read the first signs, in confidence. Your legal reports to the authorities stay yours to send.
Need help in the first hours?