Guest Wi-Fi, card payment, cameras, pontoon gates and customer data: fifteen checks for a small team without IT.
Why a marina is a cyber question
A marina runs the same kind of systems as a large port, with a team of a few people and often no IT department. This checklist keeps to what such a team can check itself, in one working session, with its providers on the phone. Every point is tied to a public, dated source.
Five points to check first
If you only have an hour, start with these five: the guest network, the payment providers, cameras open to the Internet, customer data and a named owner.
Six areas, 15 points
Open the points below for what to check, why, the evidence to hold and the sources.
A · Guest Wi-Fi · 3 points
B · Card payment · 2 points
C · Cameras · 3 points
D · Pontoon access control · 2 points
E · Customer data · 2 points
F · A small team without IT · 3 points
The 15 points and the evidence to hold
Click a point to read what to check, why, and the evidence to hold.
Start here.
What to check
The network the boaters use has no route to the harbour office computers, the card terminals, the camera recorder or the access control system. Test it: from a phone on the guest Wi-Fi, try to reach the office printer or the recorder's web page; it must fail.
Why
A guest network is shared with people you do not know. If it reaches the office, any infected laptop on a boat reaches the office too.
Evidence to hold
- A simple drawing of the networks (guest, office, payment, cameras, gates), dated
- The date and result of the test from the guest Wi-Fi
Sources: NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs) (February 2012) · ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021)
What to check
The routers and access points have their default administrator password changed, their administration page is not reachable from the Internet, and their software is updated (automatic updates on where available).
Why
Default passwords are among the first things attackers try. CISA asks manufacturers to stop shipping them; until every device does, changing them is the owner's job.
Evidence to hold
- The list of Wi-Fi devices with their software version and update date
- The administrator passwords stored in a password manager, not on a sticker
Sources: CISA, Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords (15 December 2023) · ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021)
What to check
The office Wi-Fi uses WPA2 or WPA3 with a password that is changed when someone leaves. Where the equipment supports it, the guest Wi-Fi uses WPA3 or Wi-Fi Enhanced Open so that boaters' traffic is encrypted even on an open network.
Why
Old or open Wi-Fi lets anyone nearby read or join the traffic. A Wi-Fi password known by former staff is a key that was never returned.
Evidence to hold
- The encryption setting of each Wi-Fi network, read on the device
- The date the office Wi-Fi password was last changed
Sources: Wi-Fi Alliance, Wi-Fi CERTIFIED WPA3 security (and Wi-Fi CERTIFIED Enhanced Open for open networks) (25 June 2018) · NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs) (February 2012)
Start here.
What to check
List every way a customer pays by card: desk terminal, fuel dock, online booking, phone. For each, name the provider, keep its confirmation that it complies with PCI DSS for the service it provides you, and the written agreement that says what it is responsible for.
Why
PCI DSS applies to any business that accepts cards, even when a provider handles all the payment processing; the merchant stays responsible for checking that the provider protects the card data.
Evidence to hold
- The list of payment channels with their provider
- Each provider's current compliance confirmation and the agreement
Sources: PCI Security Standards Council, FAQ: Does PCI DSS apply to merchants who outsource all payment processing operations? (read on 11 November 2026) · PCI Security Standards Council, PCI DSS v4.0.1 (general reference, no text reproduced) (11 June 2024)
What to check
Payment terminals connect through the provider's network or a network of their own, never the guest Wi-Fi. Card numbers are never written down, e-mailed or kept in a spreadsheet. Staff look at the terminals regularly for signs of tampering or substitution and know whom to call.
Why
A terminal on a shared network can be reached by anyone on it. Card numbers outside the provider's system bring the whole office into scope.
Evidence to hold
- The list of terminals (location, serial number) and the date of the last visual check
- A short written rule: no card numbers on paper, in e-mail or in files
Sources: PCI Security Standards Council, PCI DSS v4.0.1 (general reference, no text reproduced) (11 June 2024) · NIST SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs) (February 2012)
Start here.
What to check
Every camera and the recorder have their default password changed, are not reachable directly from the Internet (no port opened on the router for them), and remote viewing goes through a secure app or a VPN with a strong login. Their software is updated.
Why
Cameras and recorders exposed with default or weak passwords are found by automated scans. CISA, the FBI, the EPA and the DOE (6 May 2025) put removing Internet exposure and changing default passwords first.
Evidence to hold
- The list of cameras and the recorder with software versions
- The router's port-forwarding page showing no rule for them, dated
Sources: CISA, FBI, EPA and DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology (Internet exposure, default passwords, remote access, segmentation, manual operation) (6 May 2025) · CISA, Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords (15 December 2023)
What to check
Signs at the entrances and on the pontoons say who films and why, and where to find more information. A retention period is written for the footage and the recorder is set to it. Only named people can view or export footage, and every export is noted.
Why
In the EU, video of people is personal data. The EDPB guidelines on video devices ask for layered signs and say footage should in most cases be erased after a few days; the longer the period, especially beyond 72 hours, the more it must be justified.
Evidence to hold
- A photo of the signs
- The written retention period and the recorder setting
- The list of people who can view or export, and the export log
Sources: EDPB, Guidelines 3/2019 on processing of personal data through video devices, version 2.0 (29 January 2020) · Regulation (EU) 2016/679, General Data Protection Regulation (Articles 5, 13, 28, 32 and 33) (27 April 2016)
What to check
Cameras and the recorder sit on a network of their own (or a separate VLAN), not on the guest Wi-Fi and not mixed with the office computers.
Why
Cameras rarely get updates as often as computers. Keeping them apart means a weak camera does not open the rest of the marina.
Evidence to hold
- The network drawing of point A1 showing the camera network
Sources: CISA, FBI, EPA and DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology (Internet exposure, default passwords, remote access, segmentation, manual operation) (6 May 2025) · EDPB, Guidelines 3/2019 on processing of personal data through video devices, version 2.0 (29 January 2020)
What to check
The controller of the pontoon gates, showers and car park barriers has its default password changed, is not open to the Internet, and the supplier's remote access is switched on only when needed, with its own login, and noted.
Why
An access controller is operational technology: if someone else can manage it, they can open the gates or lock everyone out. Remote access is one of the five priorities CISA and its partners list for these systems.
Evidence to hold
- Who administers the system (name, supplier contact) and how the supplier connects
- The log or notes of the supplier's remote sessions
Sources: CISA, FBI, EPA and DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology (Internet exposure, default passwords, remote access, segmentation, manual operation) (6 May 2025) · CISA, Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords (15 December 2023)
What to check
Badges and codes are cancelled when a berth contract ends or a staff member leaves; shared codes are changed on a schedule. A written fallback says what happens when the system fails (keys, who holds them, how openings are recorded) and it has been tried once.
Why
A badge that still works after the contract ended is an open door. A system that fails with no fallback leads to gates propped open. CISA and its partners ask that manual operation be possible and practised.
Evidence to hold
- The last review of active badges against current contracts, dated
- The written fallback and the date it was tried
Sources: CISA, FBI, EPA and DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology (Internet exposure, default passwords, remote access, segmentation, manual operation) (6 May 2025) · ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021)
Start here.
What to check
List what you keep about boat owners and crews (identity, contact details, boat papers, insurance, payment history, passport copies if any) and where (booking software, e-mail, spreadsheets, paper). Keep only what you need, write a retention period for each, and have a contract with every software provider that processes it.
Why
The GDPR asks to collect only what the purpose needs, keep it no longer than needed, secure it and have a contract with every processor (Articles 5, 28 and 32). A passport copy forgotten in an inbox is data you hold without needing it.
Evidence to hold
- The list of data and where it is, with retention periods
- The processor agreements of the booking software and other providers
Sources: Regulation (EU) 2016/679, General Data Protection Regulation (Articles 5, 13, 28, 32 and 33) (27 April 2016) · ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021)
What to check
A one-page note says who decides, whom to call (IT provider, booking software provider, insurer), how to notify the data protection authority within 72 hours where the GDPR requires it, and when to inform the customers concerned.
Why
Under the GDPR, a personal data breach that is likely to put people at risk must be notified to the authority without undue delay and where feasible within 72 hours (Article 33). Deciding this during the incident costs time.
Evidence to hold
- The one-page note, dated, with the contacts
- A register of incidents, even if it is empty
Sources: Regulation (EU) 2016/679, General Data Protection Regulation (Articles 5, 13, 28, 32 and 33) (27 April 2016) · UK NCSC, Small organisations guide to cyber security (backups, devices, accounts, phishing) (read on 11 November 2026)
Start here.
What to check
One named person (often the harbour master or the office manager) owns this checklist, even part-time. They keep the list of IT, Wi-Fi, payment, camera, access control and booking providers with their contacts and contracts, and staff know to report a suspicious e-mail or call to them.
Why
In a small team, cyber is no one's job until someone is named. ENISA's guide for small businesses starts with culture, training and managing third parties.
Evidence to hold
- The name of the owner and the date of appointment
- The list of providers and contacts, dated
Sources: ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021) · UK NCSC, Small organisations guide to cyber security (backups, devices, accounts, phishing) (read on 11 November 2026)
What to check
Each person has their own login (no shared « office » account) on the computers, e-mail and booking software. Multi-factor authentication is on for e-mail, the booking software, the bank and every remote access. Accounts are removed the day someone leaves.
Why
Stolen or guessed passwords are a frequent way in; the NCSC recommends two-step verification on important accounts, and named accounts tell you who did what.
Evidence to hold
- The list of accounts per system, checked against the staff list, dated
- Screenshots or notes showing multi-factor authentication switched on
Sources: UK NCSC, Small organisations guide to cyber security (backups, devices, accounts, phishing) (read on 11 November 2026) · ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021)
What to check
Automatic updates are on for computers and phones. The booking, accounting and customer data are backed up, one copy is kept offline or in a separate account, and a restore has been tried in the last year.
Why
Ransomware turns a small office into a closed office. A backup that has never been restored is a hope, not a plan. IMO Rev.4 (28 May 2026) asks ports and ships to keep backups that can be restored.
Evidence to hold
- Where the backups are and how often they run
- The date and result of the last restore test
Sources: UK NCSC, Small organisations guide to cyber security (backups, devices, accounts, phishing) (read on 11 November 2026) · ENISA, Cybersecurity guide for SMEs: 12 steps to securing your business (28 June 2021) · IMO, Guidelines on maritime cyber risk management, MSC-FAL.1/Circ.3/Rev.4 (28 May 2026)
Download the checklist
One checklist, two formats. Version 1.0, published 11 November 2026. Generic: no marina, port, client or vendor named, no invented figure.
Marina cyber checklist: questions
Click a question to read the answer.
Attackers rarely pick a marina by name: automated scans look for any camera, router or access controller left with a default password or open to the Internet, and phishing reaches every inbox. CISA, the FBI, the EPA and the DOE (6 May 2025) list the same first steps for this kind of equipment whatever the size of the owner: no exposure to the Internet, no default password, controlled remote access, separate networks, and a manual fallback.
Yes. The PCI Security Standards Council says PCI DSS applies to any business that accepts cards, even when all payment processing is outsourced: many requirements then fall on the provider, but the marina remains responsible for checking that the provider is compliant for the services it gives and for having a written agreement. This page is a general reference to PCI DSS v4.0.1 (11 June 2024), not an assessment; your provider or acquirer tells you which self-assessment applies to you.
In the EU, as long as the purpose needs and no longer (GDPR Article 5). The EDPB guidelines on video devices (version 2.0, 29 January 2020) say footage should in most cases be erased after a few days, and that the longer the period, especially beyond 72 hours, the more it must be justified. Write the period down and set the recorder to it. This page is not legal advice.
It depends on your status, your size and how your country transposed the directive. NIS2 (14 December 2022) names the managing bodies of ports covered by the EU port security rules and, as a rule, applies to medium and large entities: a marina inside such a port or run by its authority may be in scope, a small private marina is often outside. Your national authority or counsel decides. The checklist is useful either way: its points are the basic measures that NIS2 and the national guides expect from any organisation.
Yes. The CSV and PDF are published under the Creative Commons Attribution 4.0 licence (CC BY 4.0): copy and adapt them, including commercially, as long as you credit Port Cyber Alliance and link to this page. The checklist is generic, names no marina or vendor, and is not legal advice.
Related pages
Port engineers can walk the checklist with you, on site or by video, and tell you what to fix first.
Questions about a point of the checklist?