# Comprehensive Analysis of Maritime Cybersecurity Landscape Based on the NIST CSF v2.0
## 2 Background: NIST CSF in the Maritime Context  
The NIST CSF, first introduced in 2014 and updated to version 1.1 in 2018 [3], serves as a critical guide for organizations to strengthen their cybersecurity measures. This framework, built on a collaborative effort with industry and government input, offers a set of adaptable standards, guidelines, and best practices organized into five core functions: Identify, Protect, Detect, Respond, and Recover. These functions provide a strategic approach to managing cyber risks, allowing for customization to suit the unique needs of various sectors. The framework's flexibility facilitates customization to meet diverse organizational needs, enhancing their capabilities to prevent, detect, and respond to cyber threats. Notably, the United States Coast Guard (USCG) has recognized the CSF's value, advocating for its use within the maritime industry to navigate risks in key operations such as Maritime Bulk Liquids Transfer (MBLT), Offshore Operations, and Passenger Vessel Operations [5]. The NIST CSF v2.0, released in 2023, marks a significant evolution in the approach to cybersecurity risk management across various sectors, including the maritime industry; this updated framework extends beyond critical infrastructure, offering a universal set of guidelines to help organizations of all types mitigate cybersecurity risks [4]. CSF 2.0 introduces a sixth core function, 'Govern', alongside the original five (Identify, Protect, Detect, Respond, and Recover). This addition underscores the importance of integrating cybersecurity practices with overall organizational governance to ensure that cyber risk management aligns with broader business objectives. The 'Govern' function, which encapsulates elements previously included under 'Identify' in CSF 1.1, now stands out as a distinct category, highlighting its essential role in strategic oversight, as shown in Figure 1. In addition, CSF 2.0 offers enhanced resources, including quick start guides, profiles for goal-specific guidance, and informative references or mappings to navigate NIST's extensive cybersecurity resources. These tools are invaluable for organizations, particularly in the maritime sector, as they can help in navigating the complexities of cyber threat management. By adopting CSF 2.0, entities can better identify potential risks, prioritize actions, and communicate cybersecurity concerns effectively, thereby strengthening their defenses against the evolving landscape of cyber threats. The best practices for implementing cyber risk management, as esteemed by the IMO's Interim Guidelines, are significant when coupled with the NIST CSF [6]. IMO's best practices situate cybersecurity as a priority, alongside other safety risks, under the International Safety Management (ISM) Code [7]. By embodying the principles of the NIST CSF and incorporating them into the IMO's industry-specific guidelines, maritime and port operations have the ability to devise robust cybersecurity strategies that counter both general and industry-specific threats. The IMO's endorsement of the NIST CSF further validates its effectiveness and suitability for the maritime sector. In response to the increasing risk of cyber incidents in the maritime industry, the International Association of Classification Societies (IACS) has adopted two new Unified Requirements, UR E26 and UR E27, to bolster the cyber resilience of ships [8]. These requirements, effective for new ships contracted as of 1 January 2024, focus on integrating cybersecurity measures throughout the design, construction, and operational phases of a vessel. UR E26 addresses the secure integration of operational and information technologies, emphasizing a ship's collective cyber resilience. UR E27, on the other hand, ensures the system integrity and security of onboard equipment, emphasizing third-party suppliers' role in cybersecurity. These steps by IACS mark a significant advancement in maritime safety, addressing the evolving digital threats in an increasingly connected maritime world.