# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 7 Conclusions  
Increasingly disruptive cyber-attacks in the maritime domain have led to more efforts being focused on enhancing cyber resilience. With the interest in vessels leveraging more automation and the likely adoption of ROCs, the impact of cyber-attacks could grow in the coming years. In response to a regulatory need for timely detection of cyber events, vessel operators have increasingly adopted M-SOCs. Their relative newness led us to develop this study, which sought to better understand both enabling factors and challenges that impact the effectiveness of their operations. Interview data was collected from M-SOC analysts. Informed by grounded theory, we analyzed the interview data of nine M-SOC analysts, which led to the emergence of incident management as the core category. Subsequent discussion of the results focused on the challenges that make M-SOC operations unique from those of other critical infrastructure domains.  
From a connectivity perspective, we saw that bandwidth concerns meant that M-SOCs had to consider prioritizing onboard systems that they felt were critical. This differs from the prioritization seen in other SOCs, which is almost always due to an overload of data. However, significant connectivity improvements will shift prioritization needs towards dealing with alert overload. Dynamic vessel states also meant that geographical positioningwas the most utilized contextual information when it came to filtering out false positives from true positives. The findings are also very relatable to a future with ROCs, which we saw face the same challenges of connectivity and utilization of contextual information for situational awareness.  
This research has been able to show how connectivity and contextual information, as applied in the maritime domain, make M-SOC operations different from other SOCs. We have also been able to show how these relate to ROCs and the synergies that exist between the two entities. In a future where both M-SOC and ROC operations could be converged, the authors recommend that future studies build on these findings.  
Conceptualization, A.N.; methodology, A.N.; validation, A.N.; formal analysis, A.N.; investigation, A.N.; data curation, A.N.; writing--original draft preparation, A.N., G.N. and J.S.; writing--review and editing, A.N.; supervision, M.L., S.M. and J.S. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The Norwegian Center for Research Data granted ethical approval with the assigned project number 241816. Approval date was 16 June 2022.  
Informed Consent Statement: Informed consent was obtained from all subjects involved in the study.  
The data presented in this study is available on request from the corresponding author. The data is not publicly available due to privacy and ethical reasons.  
Publication of this article has been supported by Western Norway University of Applied Sciences (HVL). The authors would also like to thank the participants who took part in the study.  
The authors declare no conflicts of interest.