## 6 Discussion
### Governance
#### 6.3.1 International Governance of Cybersecurity in Ships  
In 2017, the IMO Maritime Safety Committee (MSC) issued Resolution MSC.428(98) Maritime Cyber Risk Management in Safety Management Systems [71]. This was the first attempt of the international governing body to address maritime cybersecurity in a formal way. It is a brief one-page document which issues \"high level guidance\" under the framework of the International Safety Management (ISM) Code, affirming that cyber risk management should be taken into account as part of a ship's overall safety management systems. It also \"encourages\" administrations to ensure that cyber risks are \"appropriately addressed in safety management systems\" no later than the ship's first annual inspection of documents after January 2021 [71]. In June 2022, the IMO Facilitation (FAL) committee issued MSC-FAL.1-Circ.3 Guidelines on Maritime Cyber Risk Management [72], again a brief document at four pages, but one that provides further guidance, insofar as it lists potential vulnerable systems, specifically identifies that a \"distinction between information technology and operational technology\" should be considered, identifies malware, outdated software, weak passwords, network segregation, ineffectual firewalls, and others as vulnerabilities that can be exploited. The document identifies five \"functional elements\" of cybersecurity and directs users to further guidance from shipping organisations like BIMCO, the International Standards Organization (ISO), International Electrotechnical Commission (IEC), and the NIST framework. Key to understanding the impact of these regulations is paragraph 2.2.2 of [72] which states the following:  
Recognizing that no two organizations in the shipping industry are the same, these Guidelines are expressed in broad terms in order to have a widespread application. Ships with limited cyber-related systems may find a simple application of these Guidelines to be sufficient; however, ships with complex cyber-related systems may require a greater level of care and should seek additional resources through reputable industry and Government partners. [72]  
As one source confirmed in interview:  
This is very high level signpost guidance. And one of the reasons it was done in that way is because there's a huge amount of guidance out there that's been developed by industry and various national governments. So it was felt that the IMO provides the high level guidance and of course it is up to member states then to read through the detailed guidance and adopt what they want to, to implement effective cybersecurity. [73]  
These passages underline two important aspects of international maritime cyber regulation: First, some flexibility is needed as not all ships (or shipping companies) are the same. Second, states will implement these requirements in their own way, according to their own needs and practices. In practice, in most jurisdictions this means that ships and ports, must be able to show that cyber risk has been included as part of an overall risk assessment, and that a minimum level of cybersecurity is in place. As MSC 428(98) [71] points out, as part of the ship's safety inspection and documentation, cybersecurity must be included in the risk management plan--to some extent. Classification societies, which have the task of certifying ship safety, must incorporate cyber risk into their inspections. As a representative of the Dutch ship-owners association put it when asked about cybersecurity regulation in ships:  
There are guidelines, but straight forward rules about how to implement cybersecurity are actually not there. It's like you need to be aware, you need to have thought through all the elements onboard where your risks are and you need to have written it down in your SMS [Safety Management System]. How you handle them, what your judgment is on those risks, but there's no regulations, as such.