# Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0
## 5 NIST CSF-Based Analysis of Maritime Cybersecurity
### Respond
#### 5.5.1 Incident Management  
According to the NIST CSF v2.0, incident management outlines the systematic process of detecting, triaging, categorizing, escalating, and responding to cybersecurity incidents while coordinating with third parties and initiating incident recovery as needed.  
In alignment with this category, [PERSON] et al. [125] explored the cybersecurity threats faced by the Colombian government. Their research introduced the MS-CSIRT (Management System Computer Security Incident Response Teams) methodology. This unifying approach aligns various CSIRT guidelines towards a consolidated communication command in cybersecurity, effectively surveilling Information Technology (IT), Technological  
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Category** & **References** & **Conclusions** \\ \hline Incident Management & [PERSON] et al. (2021) [125], [PERSON] et al. (2022) [95], [PERSON] et al. (2023) [92] & Incident Management is crucial in cybersecurity, as outlined by NIST CSF v2.0. It’s a methodical approach to manage cyber incidents from detection to recovery, involving third-party coordination. Researchers worldwide apply these principles to sectors like government and maritime. Unified guidelines, detailed response plans, and regular updates are key. This method enhances data security and cyber resilience. & \\ \hline Incident Analysis & [PERSON] et al. (2021) [126], [PERSON] et al. (2021) [127], [PERSON] et al. (2020) [128] & Incident analysis is key for cybersecurity. It shapes response tactics, aids recovery, and improves security practices. Deep analysis clarifies complexities, underscores the need for robust information security, and highlights cyber-physical system safety. Across various domains, detailed analysis is vital for managing and reducing cyber incidents. & \\ \hline \hline \end{tabular}
\end{table}
Table 5: Respond.  
Operations (TO), Internet Connection Sharing (ICS), and Internet of Things (IoT) infrastructures. MS-CSIRT has found applications across various sectors, including ICS, IoT, gas and energy, mining, maritime, agro-industrial, and more. Subsequently, [PERSON] et al. [95] shed light on the struggles caused by lack of understanding of new technologies, particularly on the part of ship personnel. To address this, they introduce a response plan enabling risk identification and assessment, system vulnerability recognition, and enhancing the confidentiality of data. Their study included the development of a data exchange protocol along with an algorithm, named CLion, for detecting encrypted keywords in messages, targeting data secured in Ship Information Systems (SIS) and shipping company information systems within a software environment. On a similar note, [PERSON] et al. [95] offered an elementary response plan aimed at fortifying ship control systems, promoting their continuous updating considering real-time ship system situations, crew performance analysis, and emerging cyber threats. This approach underlines the adaptability of plans in response to changing contexts and establishes a theoretical groundwork for encrypted data search engines, ultimately enhancing data security in ship information networks. Lastly, a study by [PERSON] et al. [92] put forward the importance of all-encompassing response planning, specifically in safeguarding Medium Voltage DC (MVDC) shipboard microgrids from cyber threats. This research emphasizes the essential role that evasion, detection, and deception frameworks play as preemptive defense mechanisms, strengthening the resilience of responses to potential attacks.