# Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0
## 5 NIST CSF-Based Analysis of Maritime Cybersecurity
### Identify
#### 5.2.3 Improvement  
The Improvement category in NIST CSF V2.0 emphasizes the refinement of an organization's cybersecurity practices. It advocates for continuous identification of improvements through evaluations, security tests and exercises, and reviews of operational processes, often in collaboration with external parties. Furthermore, it underscores the importance of proactive management of incident response plans and other operational contingencies involving cybersecurity. Through such initiatives, organizations can ensure overall resilience, cultivate a culture of continuous learning, and bolster efficiency to address emerging cyber risks. One research item that aligns with this category involves an in-depth exploration of Maritime Autonomous Surface Ship (MASS) technologies, offering potential avenues for improvement in autonomous shipping [62]. This study includes a thorough discussion of the legislative backdrop governing the acceptance of autonomous vessels, accompanied by examinations of decision-making systems and emerging proposals in this space. Additionally, the research delves into strategies for bolstering the communication systems of autonomous ships and tackling issues related to maintenance and repair. It culminates with an analysis of the potential hazards associated with autonomous ships and their respective applications. This study contributes significantly to understanding of the potential and challenges of autonomous maritime technologies and to driving improvements in response strategies in the context of maritime cybersecurity. Several research efforts have proposed autonomous systems and cybersecurity regulations focused on the development and verification of autonomous systems, specifically within the context of STPA (Systems Theoretic Process Analysis) for system security requirements. The mechanisms detailed in this category are crucial for maintaining and utilizing processes and procedures to manage the protection of information systems and assets. [PERSON] et al. [63] demonstrated the verification of autonomous systems through the use of this modelling system. Alongside this, a notable study by [PERSON] et al. [64] presented a computer-assisted investigation into maritime transport based on regulations. This regulatory perspective was echoed by [PERSON] et al. [25], who highlighted the insufficiencies of the current IMO framework in the face of increasingly sophisticated maritime cybersecurity threats. The need for updated and robust protection models in the context of shipping and ports within the \"world 4.0\" was emphasized by [PERSON] et al. [15]. Furthermore, [PERSON] et al. [65] took a comprehensive look at maritime safety regulations and instigated important discussion about the necessity of adopting new regulations. Echoing this sentiment, [PERSON] et al. [66] argued for the swift creation of cybersecurity regulations by the IMO and its members. The theme of technological advancement continues with [PERSON] et al. [67], who discussed the impact of the fourth industrial revolution on shipping, including consideration of automated ships and IoT integration for navigation safety. As demonstrated in these research efforts, identifying and addressing the multifaceted aspects of autonomous systems and cybersecurity regulations is imperative in order to create advanced security requirements, swift cybersecurity regulations, and proactive protection models. Certain articles focus on the various threats and protection processes associated with cyber systems in the maritime industry. This theme is evident in [PERSON] et al. 's [68] work within the open-source MaCySTe project, where emphasis is placed on realistic testing to strengthen information protection processes. Similarly, security issues surrounding data transmission on ships were analyzed by [PERSON] [18], highlighting the potential negative impact on environmental conservation when crucial data cannot be shared. Of notable mention is the work of [PERSON] et al.