OT security for cranes and yard equipment

What to check

Each crane and yard machine has a list of its programmable components: PLCs and safety controllers, drives, HMIs, industrial PCs, network switches, radios, cameras and remote access gateways, with make, model, location on the machine and owner.

Why

NIST SP 800-82 Rev. 3 calls a complete and accurate asset inventory critical for managing OT risk: it supports risk assessment, vulnerability management and obsolescence tracking (6.1.1). IMO Rev.4 asks for an inventory of digital systems and of their network connections (3.5.2.2).

Evidence to hold

• The inventory per machine class, with the date of the last update
• The owner of each machine class (maintenance, automation or a supplier under contract)

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)

What to check

For each component, the inventory records the software and firmware versions installed, and the PLC program version currently running on the machine.

Why

NIST lists software and firmware inventory, with version numbers and a software bill of materials (SBOM) where available, among the elements of OT asset management (6.1.1). Without versions, no advisory can be matched to a machine.

Evidence to hold

• Versions per component, as read on the machine, with the date read
• The SBOMs received from suppliers, where they exist

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

A diagram shows how each machine class is connected: to the TOS or crane management system, to the cameras and OCR, to the radio or fibre network of the yard, and to any supplier's remote access, with the direction of each data flow.

Why

IMO Rev.4 asks to identify internal and external system dependencies and network connections (3.5.2.2). NIST uses the mapped data flows to decide which communications the network should allow (5.2.3.1).

Evidence to hold

• The network and data-flow diagram per machine class, dated
• The list of external connections, with purpose and owner

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026) · NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

A component swapped, a firmware updated or a program changed during maintenance is written into the inventory the same week.

Why

NIST recommends updating inventory information when components are added, removed or changed (patched, new firmware, a component swapped during maintenance) (6.1.1).

Evidence to hold

• The maintenance work orders that changed OT components, linked to the inventory updates

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Any automated discovery or scanning tool is first tried on an offline component or a test bench, and passive methods are preferred on working machines. Where no tool fits, the inventory is kept by hand.

Why

NIST warns that active scanning may have a negative impact on OT systems and recommends testing automated asset management tools on offline systems or components before using them in production (6.1.1).

Evidence to hold

• The record of the bench or offline test of the tool
• The rule that says which methods are allowed on working machines

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

The OT is divided into zones that make sense for the terminal: for example one zone per crane or per machine class, a zone for the crane management and remote monitoring servers, a zone for the supplier access, and the safety functions kept in their own layer.

Why

NIST describes grouping components into levels, tiers or zones as the step that comes before placing isolation devices between them (5.2.3.1). The ISA/IEC 62443 series uses the same idea of zones and conduits.

Evidence to hold

• The zone model, with the components of each zone
• The reason for each boundary (criticality, owner, location, supplier)

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023) · ISA/IEC 62443 series of standards (general reference, no text reproduced) (overview page read on 11 November 2026)

What to check

Each connection between two zones (a conduit) goes through a firewall or a one-way gateway whose rules allow only the flows of the diagram (A3). Outbound rules from the OT are as strict as inbound rules. The rules are reviewed at a set interval.

Why

NIST recommends rulesets that only permit connections between adjacent levels, tiers or zones, and outbound rules as stringent as inbound rules; a unidirectional gateway (data diode) is an alternative where data only needs to leave the OT (5.2.3.1).

Evidence to hold

• The firewall or gateway rules per conduit, with the date of the last review
• The list of flows each rule allows, matched to the diagram

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

No crane or yard equipment network is reachable from the office network or from the Internet except through the documented conduits; any OT system reachable from outside has a written justification.

Why

IMO Rev.4 asks to segment OT device networks from IT networks and to limit exploitable services on the Internet (3.5.3.3). For US facilities, 33 CFR 101.650 requires segmentation between IT and OT networks, logging and monitoring of all IT-OT connections, and a documented justification for any remotely accessible OT system.

Evidence to hold

• The network diagram showing the OT zones separated from IT
• The result of the last external exposure check, with its date
• The justification for each OT system reachable from outside

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026) · eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026)

What to check

The wireless network that serves the yard cranes, straddle carriers and other mobile machines is its own segment, with its own conduit to the rest of the OT; a site survey has checked coverage and where the signal leaks beyond the terminal.

Why

NIST recommends placing devices that use wireless communication in a separate network segment and performing a wireless survey before installation, noting that attackers use directional antennas to reach a network beyond its standard range (6.2.9).

Evidence to hold

• The segment and conduit of the yard wireless network in the zone model
• The latest wireless survey, with its date

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Access to the e-houses, electrical rooms and control cabinets of the cranes is limited to authorised people and logged; unused network and USB ports on the machines are blocked, disabled or removed.

Why

For US facilities, 33 CFR 101.650(i) requires limiting physical access to OT and related IT equipment, securing and logging access to HMIs and other hardware, and blocking, disabling or removing unused physical access ports.

Evidence to hold

• The access list for e-houses and electrical rooms, and its log
• The port-blocking procedure and its last check

Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026)

What to check

The terminal knows every way a supplier can reach a crane or a yard machine from outside: VPNs, remote desktop tools, cellular modems or routers installed on the machine, and remote monitoring links. Paths nobody owns are removed.

Why

In its 2024 notices on ship-to-shore cranes, the US Coast Guard writes that such cranes may by design be « controlled, serviced, and programmed from remote locations ». IMO Rev.4 asks to consider the risks posed by third-party vendors, embedded systems and maintenance devices (3.5.3.8).

Evidence to hold

• The list of remote access paths per machine class, with the supplier and the owner on the terminal side
• The date of the last check for paths that are not on the list

Sources: Federal Register, US Coast Guard notice of availability of MARSEC Directive 105-4 on ship-to-shore cranes (89 FR 13726) (23 February 2024) · Federal Register, US Coast Guard notice of availability of MARSEC Directive 105-5 on ship-to-shore cranes (19 November 2024) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)

What to check

A supplier asks before each remote session; the terminal enables the access for the stated job only, on the machines concerned, and disables it at the end.

Why

NIST asks for a process for requesting and enabling remote access, and says remote access should be provided only if justified and limited to what the business need requires (6.2.10).

Evidence to hold

• The remote access procedure
• The record of the last sessions: who, which machine, why, start and end

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Each remote user of a supplier has a named account (no shared supplier login) and uses multi-factor authentication.

Why

NIST recommends considering multi-factor authentication for remote access to the OT (6.2.10). IMO Rev.4 asks for unique credentials for all users (3.5.3.1) and for multi-factor or continuous authentication (3.5.3.2).

Evidence to hold

• The list of supplier accounts and their holders
• The MFA setting of the remote access gateway

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)

What to check

A remote session cannot override an interlock, bypass a safety function or open a path that skips the zone boundaries; changes to a crane program made remotely follow the same approval as on-site changes.

Why

NIST: « Remote access should not circumvent or negate safety or security controls » (6.2.10).

Evidence to hold

• The written rule on what a remote session may and may not change
• The change records of the last remote program changes

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

The maintenance and service contracts of the cranes and yard equipment state how the supplier connects, how access is logged, how security updates and incidents are handled, and what happens to the access when the contract ends.

Why

IMO Rev.4 asks for policies on software and hardware supply chain security for critical systems (3.5.3.8). NIST covers supply chain risk management for OT (4.2.1 and 6.1.5).

Evidence to hold

• The security clauses of each equipment service contract
• The list of critical equipment suppliers and how each reaches the machines

Sources: IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026) · NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

The terminal has a documented process for crane and yard equipment updates: how advisories are watched, who decides, when a patch is applied, how it is tested, and which compensating control is used while it waits.

Why

NIST asks for a systematic, accountable and documented OT patch management process covering how to monitor for patches, when to apply them, how to test them and how to select compensating controls when patching is delayed (6.2.11).

Evidence to hold

• The OT patch procedure, dated and owned
• The list of open advisories per machine class and the decision taken for each

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

A patch or firmware update is tested on a test bench, an offline component or with the supplier, with regression tests, then installed in a planned maintenance window, one machine first.

Why

NIST: patches should be adequately tested, for example on offline systems, and regression testing is advised; a patch may remove a vulnerability but introduce a greater risk from a production or safety perspective (6.2.11).

Evidence to hold

• The test record of the last patches installed
• The maintenance window plan

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Each component that can no longer be patched (an operating system or a controller out of support) is listed, with the compensating controls that protect it (stricter zone, no remote access, monitoring) and a replacement plan.

Why

NIST notes that many OT systems use older operating systems no longer supported by the vendor, so patches may not be available, and points to compensating controls (6.2.11).

Evidence to hold

• The list of unsupported components and their compensating controls
• The replacement plan, with the planned dates

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

The laptops and tools used to program the cranes stay in the OT environment or are checked before use, run only approved software obtained from the supplier, and are disconnected after the job. USB keys and other media are controlled before they touch a machine.

Why

NIST recommends approved maintenance software with verified authenticity, limiting the use of maintenance devices outside the OT, and disconnecting any device and temporary connection after maintenance (6.2.5); it also covers removable media (6.2.7). IMO Rev.4 asks for controls against unauthorised removable media (3.5.3.5).

Evidence to hold

• The list of maintenance laptops and who holds them
• The removable media rule and the technical control in place

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)

What to check

After maintenance or an update, the configuration of the component is compared with its approved state, and any feature that was switched back on is switched off again.

Why

NIST: device configuration should be verified after maintenance and software patching, as some features may have been re-enabled or new features installed (6.2.5).

Evidence to hold

• The approved configuration per component type
• The post-maintenance check in the work order

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Emergency stops, overload and limit protections, anti-collision and the other safety interlocks of each machine act locally, through the safety controller and hard-wired circuits, and do not need the TOS, the office network, the yard radio or any remote link to work.

Why

NIST describes safety systems as often independent from the other control systems, so that a failure of the control system does not affect them (2.3.7), and asks organisations to ensure adequate separation when control and safety are combined (4.2.2).

Evidence to hold

• The list of safety functions per machine class and how each is implemented
• Confirmation, from the supplier or the engineering file, that none depends on an IT link

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

For each machine class, it is written what happens when the network or the radio link drops: the machine stops in a safe state, and the thresholds for degraded operation are defined.

Why

NIST: OT systems typically use fail-safe design, loss of network communications can trigger fail-safe events, and organisations should define the thresholds at which components can operate with reduced or disrupted capabilities (5.3.1).

Evidence to hold

• The documented behaviour on loss of communication per machine class
• The result of the last test, done in a maintenance window

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Where the safety assessment requires it, safety controllers sit on a physically separate network, not only a logical one (VLAN).

Why

NIST: safety considerations may require physical separation as opposed to logical separation (5.3.1).

Evidence to hold

• The decision, per machine class, on physical or logical separation of the safety layer

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

The people who run the crane safety assessments and those who run the cyber risk assessment share their results, and every new security control is checked for its effect on the safety functions before it goes live.

Why

NIST asks to consider the safety assessment results in the security risk assessment, and to evaluate the impact of security controls on the safety system (4.2.2).

Evidence to hold

• The last joint review of cyber and safety risks for the equipment
• The safety impact check of the last security change

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)

What to check

Every connection between the office or TOS networks and the equipment networks, and every remote session, is logged, and someone reviews the logs.

Why

For US facilities, 33 CFR 101.650(h) requires that all connections between IT and OT systems are logged and monitored. IMO Rev.4 asks to monitor systems for relevant threats (3.5.4).

Evidence to hold

• Where the logs of the conduits and remote sessions are kept, and for how long
• The last review, with its date and who did it

Sources: eCFR, 33 CFR 101.650, Cybersecurity measures (US Coast Guard rule) (in force since 16 July 2025, read on 11 November 2026) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)

What to check

The PLC programs, drive parameters, HMI projects and network configurations of each machine are backed up at a set interval and after each change, a copy is kept out of reach of the network, and a restore has been tested.

Why

NIST asks for backups of the OT systems' state, data, configuration files and programs at regular intervals, and for processes to restore them in a timely manner (3.3.9). IMO Rev.4 asks for regular backups (3.5.3.7).

Evidence to hold

• The backup list per machine and the date of the last backup
• The report of the last restore test

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023) · IMO, MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management (28 May 2026)

What to check

The incident plan says how cranes and yard equipment are run, or safely stopped, when the TOS or the equipment network is lost, and in what order they restart, safety first.

Why

NIST: the recovery capability should prioritise human and environmental safety before restarting the OT operation that was impaired (3.3.9).

Evidence to hold

• The equipment section of the incident response and continuity plans
• The last exercise that used it (see the tabletop exercise kit)

Sources: NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (September 2023)