# Bridging the Gap: Enhancing Maritime Vessel Cyber Resilience through Security Operation Centers
## 4 Results  
Following the conclusion of the selective coding phase of data analysis, incident management emerged as the core category. This means that the discussions with the M-SOC analysts all pointed toward how they conduct incident management and the factors that influence it. This core category was supported by four other categories, namely incident analysis, cyber onboarding, the operational domain, and incident communication. Tables 2-5 provide a summary description of each category and the respective sub-categories. Additionally, Figure 2 visualizes the categories and sub-categories. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Organization** & **Operating Model** & **Staff Count** & **Fleet Size** & **Fleet Type** & **Interview Participants** \\ \hline M-SOC 1 & MSSP & 10 & 500 & Tankers, Floating Production Storage and Offloading (FPSO) & P1, P2, P3 \\ M-SOC 2 & MSSP & 15 & 200 & Superyachts, cruise ships, container vessels & P4 \\ M-SOC 3 & MSSP & 10 & 300 & Superyachts, passenger, and container vessels & P5, P6 \\ M-SOC 4 & MSSP & 9 & 150 & Container and passenger vessels & P7, P8 \\ M-SOC 5 & In-house & 4 & 60 & Tankers & P9 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: M-SOC Organizational Profile. Discussion of the findings will center on the factors that make M-SOC monitoring different from what is experienced in other critical infrastructure sectors. As highlighted in the literature review, connectivity, and varying vessel states are the standout differences that make monitoring in the maritime domain vastly different from other domains. The cyber-onboarding category, constituting connectivity and domain knowledge, aptly captures the concerns around these differences. \begin{table}
\begin{tabular}{p{113.8 pt} p{227.6 pt}} \hline \hline
**Category** & **Description** \\ \hline Cyber Onboarding & Ensures client monitoring requirements are fully captured and incorporated into the M-SOC monitoring platform. \\ _Subcategory_ & _Description_ \\ Connectivity & The degree to which the vessel has sufficient internet access and bandwidth to facilitate real-time monitoring. \\ Domain Knowledge & Contextual knowledge regarding vessel operations such as key onboard systems and sailing routes. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Cyber Onboarding Category and Sub-Categories. \begin{table}
\begin{tabular}{p{113.8 pt} p{227.6 pt}} \hline \hline
**Category** & **Description** \\ \hline Incident Analysis _Subcategory_ & Process of investigating the root cause of the alert. _Description_ \\ Personal Shortages & Relates to the impact of M-SOC staff shortages on the incident analysis process. \\ Incident Prioritization & How M-SOC analysts rank the criticality of incoming alerts. \\ Intelligence Gathering & The process of obtaining additional information related to the alert that would assist with its analysis. \\ Information Sharing & The ease with which cyber threat information is disseminated within the maritime domain which would assist in timely incident analysis. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Incident Analysis Category and Sub-Categories. \begin{table}
\begin{tabular}{p{113.8 pt} p{227.6 pt}} \hline \hline
**Category** & **Description** \\ \hline Operational Domain _Subcategory_ & The industry within which the M-SOC operates, maritime in our case. _Description_ \\ _Subcategory_ & Maritime stakeholders’ investment in cyber security preparedness, recovery, and business continuity \\ Cyber Awareness & Cyber awareness levels of crew onboard the vessel and shoreside personnel. \\ Regulation & Existing maritime cybersecurity regulation. \\ Digitalization & The level of technological adoption in the maritime domain. \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Operational Domain Category and Sub-Categories.