In this guide · 8 sections
- 01What IMO and MPA expect on maritime cyber risk
- 02Where maritime SMEs are most exposed
- 03Bunker and port invoice fraud: the most common loss
- 04A practical cyber baseline for maritime SMEs
- 05Reporting cyber incidents: MPA, SingCERT and the police
- 06Questions to ask your IT provider or ship systems integrator
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Start with what stops most incidents: MFA on every mailbox, call-back checks on bank detail changes, separate vessel and office networks, managed crew devices and offline backups. Ship operators must also cover cyber risk in their ISM safety management system under IMO resolution MSC.428(98).
What IMO and MPA expect on maritime cyber risk
IMO's maritime cyber security page explains that resolution MSC.428(98), adopted in June 2017, encourages administrations to ensure cyber risks are addressed in safety management systems under the ISM Code no later than the first annual verification of the company's Document of Compliance after 1 January 2021. IMO's current high-level guidance is MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management.
| Business type | What applies | Practical meaning |
|---|---|---|
| Ship owner or ship manager (ISM company) | Cyber risk in the safety management system, checked at DOC and SMC audits | Documented risk assessment, procedures and training, ashore and on board |
| Ship agent, chandler, bunker trader, surveyor | No specific maritime cyber rule; PDPA and contracts apply | Protect email, payments and customer data; meet client and charterer questionnaires |
| Operators of maritime critical systems | Cybersecurity Act duties for designated Critical Information Infrastructure | Usually large operators, not SMEs; CSA designates them |
MPA also announced in March 2025 that it had launched the Maritime Cyber Assurance and Operations Centre (MCAOC), which delivers real-time security monitoring and threat information to participating companies.
Where maritime SMEs are most exposed
Large lines have security teams. A ship manager with 20 office staff, or an agency with five, usually has the same email and payment risks with far less protection.
- Ship-shore email: masters and crew email the office, agents and ports constantly, often from shared vessel accounts with weak passwords and no MFA.
- Satellite and onboard networks: crew internet, bridge and engine systems and the office link sometimes share a network on board, so a crew laptop infection can reach systems it should not.
- Crew devices: personal phones and laptops are plugged into ship systems to transfer files or charge, and USB sticks move between vessels and offices.
- Payments: bunker invoices, port disbursements, crew wages and agency fees involve large sums and frequent bank transfers, which makes them the main fraud target.
- Shared and inherited accounts: former crew and staff often keep access to vessel mailboxes, cloud folders and vendor portals.
Bunker and port invoice fraud: the most common loss
The pattern is the same as other business email compromise: an attacker gets into a supplier's or your own mailbox, watches real invoice threads, then sends a convincing message saying the bank account has changed. Bunker suppliers, port agents and crew manning agencies are typical impersonation targets because payments are large and urgent.
Our guide to freight forwarder invoice fraud walks through the warning signs and a payment verification routine that fits logistics and maritime firms.
A practical cyber baseline for maritime SMEs
You do not need a large programme to cut most of the risk. These steps cover the office and the parts of the vessel you control.
MFA on every mailbox, including vessel accounts
Use an authenticator app or passkey for office staff. For shared vessel mailboxes, use individual accounts where possible, or strong unique passwords with access limited to the ship.
Payment verification rule
Call-back on every bank detail change, dual approval above a set amount, and a list of verified supplier contacts.
Separate networks on board
Keep crew Wi-Fi apart from bridge, engine and business systems. Ask your satellite provider or integrator how the vessel network is segmented.
Managed office devices
Encryption, automatic updates and endpoint protection on office laptops; block or control USB use on PCs that connect to ship systems.
Backups that survive ransomware
Daily backups of key files and systems, with one copy offline or immutable, and a tested restore.
Access reviews when crew and staff change
Remove access for leavers and crew signing off the same day: mailboxes, shared folders, vendor portals.
Train crew and office staff
Short sessions on phishing, fake invoices and USB risks, repeated at crew changes and inductions.
CSA's Cyber Essentials mark covers a similar baseline for the office side and is a recognisable answer to charterer and client security questionnaires. Our Cyber Essentials checklist breaks down what assessors look for.
Reporting cyber incidents: MPA, SingCERT and the police
Know where to report before you need to. Which channel applies depends on what happened.
- Security incidents involving Singapore-registered vessels: MPA's security-related information page asks owners and managers to report marine security incidents using the Security Incident Form in Shipping Circular No. 2 of 2024, by email to ivd@mpa.gov.sg.
- Cyber incidents at a Singapore business: report to SingCERT through CSA's Cyber Aid tool, which covers phishing, ransomware and unauthorised access.
- Money lost to fraud: call your bank immediately to try to stop the transfer, then make a police report.
- Personal data affected: assess whether the breach must be notified to PDPC, for example crew passport or medical data.
- Flag state, class and P&I club: follow your SMS procedures and contracts, which may require notifying them.
Questions to ask your IT provider or ship systems integrator
Maritime cyber questions
Do it yourself or get help?
An office manager can switch on MFA and write a payment verification rule in a week. Network separation on board and SMS documentation usually need your integrator and DPA (designated person ashore) working together.
Our Security Health Check (S$290) reviews your email, accounts, devices and backups and gives a prioritised fix list. Email Threat Protection (S$290) sets up phishing and impersonation protection for supplier and executive names, and Security Awareness Training (S$390) covers fake invoices and phishing for office staff and crew.
Frequently asked questions
For companies covered by the ISM Code, yes in practice. IMO resolution MSC.428(98) expects cyber risks to be addressed in the safety management system no later than the first annual verification of the Document of Compliance after 1 January 2021. Auditors check this at DOC and SMC audits. Other maritime SMEs are covered by the PDPA and client contracts.
The Maritime Cyber Assurance and Operations Centre is a facility launched by the Maritime and Port Authority of Singapore, announced in March 2025. MPA says it delivers real-time security monitoring and disseminates threat information so participating maritime companies can act early on cyber threats, pooling capabilities that would be costly for each company alone.
MPA asks owners and managers to report marine security-related incidents involving Singapore-registered vessels using the Security Incident Form in Shipping Circular No. 2 of 2024, sent to ivd@mpa.gov.sg. Also follow your SMS procedures, report cyber incidents to SingCERT, and make a police report if money was lost.
Treat every change of bank details as suspicious until confirmed by phone using a number you already hold. Require two approvals for large or first-time payments, keep a verified supplier contact list, turn on MFA for all mailboxes and set up email impersonation protection for your key suppliers' names and domains.
Crew personal devices are normal for welfare internet, but they should only connect to a separate crew network, never to bridge, engine or business systems. Avoid plugging personal phones or USB sticks into ship computers. Give crew who handle ship business a managed device or account with MFA.