Port Cyber AlliancePort Cyber Alliance
Maritime Cybersecurity Alliance
Report an Incident
Connect your SIEM
Swagger
Github
Start
ENGINEERING SELF-ASSESSMENT

You are an engineer: take your own test

Twelve questions, two minutes, in your browser, no account, nothing sent. Get a score, weak spots and a PDF.

Start the test
Leading a team? Test your team

The test

Answer Yes, Partly or No. The progress bar fills as you go; the score appears at the end.

Online test · about 2 minutes · runs in your browser

Engineering team self-assessment

Twelve questions, about two minutes. Answer for the systems you look after: TOS, gate, OCR, cranes, network.

0 / 12 answered · Prefer paper? Download the blank sheet (PDF)

Access

1Every remote access (VPN, TOS, vendor support) asks for a second factor (MFA).

2Vendor and remote-maintenance accounts are named, limited in time and logged.

3Default or shared passwords are gone from gate kiosks, OCR, camera and crane HMIs.

Network

4Operational systems (cranes, gates, reefer monitoring) are separated from office IT.

5You keep an up-to-date list of what your site exposes on the internet.

6You know the patch and firmware level of your gate and OCR equipment.

Detection

7TOS, VPN and firewall logs are collected in one place and kept 90 days or more.

8Someone looks at security alerts every day, weekends included.

9A new administrator account on the TOS would be noticed within a day.

Recovery

10The TOS database has an offline or immutable backup, and a restore was tested in the last 12 months.

11A written runbook keeps the gate running in degraded or manual mode.

12You know who to call, and who reports to the authorities, if an incident starts tonight.

You lead the team? Take the managerial assessment →

To help you: our open-source packages

We build open-source tools for port engineers: snippets to send your security events to the alliance, advisories, terminal integration kits. Some are public, the others we send on request. Open a card for the details.

  • Isometric illustration: Open detection rules (Sigma)

    AvailableCyber security

    Open detection rules (Sigma)

    Sigma rules that spot abnormal access to a terminal operating system, convertible for most SIEMs.

    Sigma · Windows Security log · pySigma · sigma-cli

    Details about Open detection rules (Sigma)
  • Isometric illustration: Vendor cyber questionnaire

    AvailableCyber security

    Vendor cyber questionnaire

    The cyber questions a terminal sends a software vendor, with an online form that sends nothing.

    YAML · JSON · PDF · HTML form

    Details about Vendor cyber questionnaire
  • Isometric illustration: Security advisories

    ComingCyber security

    Security advisories

    Advisories on port and container-logistics software, under coordinated disclosure, machine-readable.

    CVE JSON 5 · CVSS · CSAF 2.0 · OSV

    Details about Security advisories
  • Isometric illustration: CVE sync for WordPress

    ComingCyber security

    CVE sync for WordPress

    Mirror the CVE list into a WordPress site, filtered for port and terminal software.

    PHP · WordPress · WP-CLI · NVD API 2.0

    Details about CVE sync for WordPress
  • Isometric illustration: Error reporting

    ComingCyber security

    Error reporting

    Send errors and security events from your own port systems to a receiver you control, without personal data.

    JSON Schema · WordPress agent · HTTP receiver

    Details about Error reporting

See every package and how to get them

Isometric illustration: Maritime cyber toolkit

PublicCyber security

Maritime cyber toolkit

Copy-paste snippets that send your security events to the Port Cyber Alliance API.

For
SIEM, SOC and integration engineers, and their coding agents
Stack
curl · Python · JavaScript · PHP · Go · OpenAPI
Licence
See the repository
State
The code is on our public GitHub. Use it today.

What is in it today

  • One snippet per language reports an incident to POST /incidents and prints 201 on success
  • Generated from the PCA OpenAPI description, never hand-written
  • AGENTS.md: instructions an AI coding agent can follow to wire your SIEM unattended
  • Error table: 401 bad key, 422 bad schema, 429 over quota
View on GitHubTalk to us about itGet an API key
Isometric illustration: Open detection rules (Sigma)

AvailableCyber security

Open detection rules (Sigma)

Sigma rules that spot abnormal access to a terminal operating system, convertible for most SIEMs.

For
SOC teams and security officers of ports and terminals
Stack
Sigma · Windows Security log · pySigma · sigma-cli
Licence
DRL-1.1
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • A remote desktop logon (event 4624, type 10) on a TOS server from outside the approved admin network
  • An account added to the local Administrators group (event 4732) of a TOS server
  • Validated with sigma-cli; sample events that must and must not match, with a test script

What it will never do

  • Carry a real host name, address or customer name: every value is an example you replace
Download the rules (zip)Talk to us about itRead how to deploy them
Isometric illustration: Vendor cyber questionnaire

AvailableCyber security

Vendor cyber questionnaire

The cyber questions a terminal sends a software vendor, with an online form that sends nothing.

For
IT and security teams of ports and terminals, and the software vendors who answer them
Stack
YAML · JSON · PDF · HTML form · JavaScript
Licence
CC-BY-4.0
State
Free to download from this site, with its tests. Use it today.

What is in it today

  • 34 questions in eight families (access, data, logs, backups, incidents, subcontractors, penetration tests, end of contract), one id each
  • An online form that runs in the browser only: answers stay on the device until exported as JSON or CSV
  • The same questionnaire in YAML, JSON and PDF, with the dated public sources behind each family
  • Questionnaire under CC BY 4.0, form script under MIT, README in the zip

What it will never do

  • Send your answers anywhere: the form has no server and blocks every network call
  • Certify a vendor
Download the questionnaire (zip)Talk to us about itRead how to use it
Isometric illustration: Port SIEM rules and cyber governance

ComingCyber security

Port SIEM rules and cyber governance

The Wazuh detection rules and decoders we write, with the written rules behind them.

For
Security officers and SOC teams of ports and terminals
Stack
Wazuh rules · Wazuh decoders · Markdown
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • Wazuh detection rules and decoders
  • Security policy and risk analysis templates
  • Patch delays by severity
  • Incident notification procedure, 24 h and 72 h (NIS2 article 23), and an incident register

What it will never do

  • Carry a secret, an IP address, a host name or a customer name
Get the package and talk to usSIEM and AI agents for ports
Isometric illustration: Security advisories

ComingCyber security

Security advisories

Advisories on port and container-logistics software, under coordinated disclosure, machine-readable.

For
Security teams of ports and terminals, and the software vendors they rely on
Stack
CVE JSON 5 · CVSS · CSAF 2.0 · OSV · RSS / JSON feeds
Licence
CC-BY-4.0
State
Specified, being built. Ask us to be told first.

What it will contain

  • A disclosure policy
  • Advisory ids PCA-YYYY-NNNN, linked to a CVE id when one is assigned
  • Machine-readable records and RSS / JSON feeds

What it will never do

  • Publish a vendor's vulnerability without coordinating with the vendor
Get the package and talk to usRead the advisories
Isometric illustration: CVE sync for WordPress

ComingCyber security

CVE sync for WordPress

Mirror the CVE list into a WordPress site, filtered for port and terminal software.

For
Teams that run a security or community website on WordPress
Stack
PHP · WordPress · WP-CLI · NVD API 2.0 · CVE JSON 5
Licence
GPL-2.0-or-later
State
Specified, being built. Ask us to be told first.

What it will contain

  • Tables for CVEs, products, watchlists, sync log and advisories
  • Full and delta sync run by the system cron, resumable and idempotent
  • Admin filters (vendors, keywords, severity) and public pages with structured data

What it will never do

  • Scan your WordPress for vulnerabilities: other plugins do that
Get the package and talk to us
Isometric illustration: Error reporting

ComingCyber security

Error reporting

Send errors and security events from your own port systems to a receiver you control, without personal data.

For
Engineers who run port web systems, WordPress first
Stack
JSON Schema · WordPress agent · HTTP receiver
Licence
To be decided
State
Specified, being built. Ask us to be told first.

What it will contain

  • An event envelope (JSON Schema)
  • A WordPress agent
  • A receiver: HTTP endpoint, grouping, alerts
  • Scrubbing: no IP address, no secret, no personal data leaves

What it will never do

  • Send personal data
  • Phone home to anyone you did not configure
Get the package and talk to us

Questions about the test

A low score is a starting list, not a verdict.

Launch offer: 10 hours of advice

No. The test runs in your browser. Nothing leaves your screen unless you download the PDF or e-mail it to yourself.

About two minutes: twelve questions, three answers each.

Pick the two weakest questions and start there. If you want a second opinion, contact us in confidence: the launch offer includes ten hours of advice a year.

Get the packages and talk to us

Leave your e-mail to receive the open-source packages and to talk about your site. Each site is different, so we adapt them with you. Everything stays confidential.

Leave your e-mail

Name(Required)

🔒 Your data is never shared with third parties or used for advertising. We use it only to answer you.

Test your team (for managers)

Send this page to a colleague

Someone in your team should read this? Add their e-mail, we send them the page from you.

Your colleagues' addresses are used for this mail only and are not kept.

Contact the alliance

Use our contact form: every message is read by the team.

Contact form
Report an incident

Port operators can report a cyber incident to the alliance at any time.

Incident reporting