# Assessing Cyber Challenges of Maritime Navigation
## 3 Findings
### Regulatory Framework and Policy Priorities--EUI  
The 2013 EU cyber strategy aims to safeguard the EU's core values in cyberspace in light of the rapidly increasing growth of cyberspace and the threats to it. A safe cyberspace is essential to the digital single market that the EU sees as a vehicle for increased prosperity. Goals of the 2013 cyber strategy are increased resilience, decimated cybercrime, development of cyber defense policies and capabilities, increased EU autonomy in industrial resources for cybersecurity, and the fostering of a coherent international policy [52]. An EU Directive of 2013 seeks to legally criminalize cyberattacks and cybercrime [53]. The 2016 NIS directive [54; 55] requires that EU Member States are adequately equipped to deal with cyber incidents--e.g., by Computer Security Incident Response Teams (CSIRT)--and that businesses in vital and ICT-dependent sectors that provide essential services take appropriate security measures. Information exchange and operational cooperation are required. The directive specifies operators of essential services for the maritime sector: passenger and freight water transport; ports and their facilities and operating entities; and vessel traffic services. The EU has set up specialized entities such as the European Union Agency for Cybersecurity (ENISA), the European Cyber Crime Centre (EC3) at Europol, and the Computer Emergency Response Team (CERT-EU) [56], as well as launching initiatives to increase cybersecurity in various critical sectors. In particular, the Information Sharing and Analysis Centres (ISAC) are intended to be trusted entities to foster information sharing and good practices about physical and cyber threats and their mitigation [57]. The US also uses ISACs, as well as Information Sharing and Analysis Organizations (ISAO), based on US government regulations, to share cyber threat information between various stakeholders [58], while the maritime sector has three (MPS-ISAO, Maritime ISAC, maritime transportation system (MTS)-ISAC). However, in Europe the maritime sector lags behind in creating ISACs [57]. The European Cyber Security Organisation (ECSO) represents the counterpart to the European Commission for the Implementation of the Cyber Security Contractual Public-Private Partnership (cPPP). Their recent report on the transportation sector [59] aims to take a holistic approach of the implications of cybersecurity on the transport sector as a whole, but also treats the maritime sector separately. It notes that information sharing in the maritime sector falls dramatically short, and recommends the creation of a safe, confidential, and anonymous reporting center for the maritime sector. The 2017 Joint Communication on Resilience, Deterrence and Defence [60] proposes, among other things, greater resilience, strategic autonomy, more skills, and a security by design approach. The 2019 EU Cybersecurity Act [61] sets new objectives and tasks for ENISA as a prime tool to implement cybersecurity in the EU, and provides a framework for the establishment of European cybersecurity certification schemes for digital products, services, and processes. Specifically for maritime, the 2014 European Union Maritime Security Strategy [62] recognizes cyber as one of the risks in the maritime domain. Its 2014 Action Plan [63] contains five actions on cyber, and its 2018 revised Action Plan [64] contains six. Progress reports [65; 66; 67] provide details on the implementation of these actions in the EU maritime sector, including work on risk assessments, response capacity, exercises, workshops, and working groups. ENISA has published studies dedicated to the maritime sector [68; 69]. Most recently, the EU Security Union Strategy for 2020-2025 [70] notes that cyberattacks and cybercrime continue to rise. It calls for a whole-of-society approach to security, with sector-specific initiatives to tackle the specific risks faced by critical infrastructures such as in transport and maritime.