ORGANIZATION AND RESPONSIBILITIES FOR CYBER SECTION

Revision of 21 September 2026

PURPOSE

Purpose

The purpose of the present procedure is to introduce CYBER section missions and responsibilities within Recognised Organisation (RO) Marine and Offshore Head Office as well as in the network.

DEFINITIONS AND ABBREVIATIONS

Definitions and abbreviations

  • IMO: International Marine Organization

  • IACS: International Association of Classification Societies,

  • Recognised Organisation (RO): Recognised Organisation (RO),

  • M&O: Recognised Organisation (RO) Marine & Offshore Division

  • HO: Recognised Organisation (RO) Head Office,

  • MO_FM: Recognised Organisation (RO) Marine Operation-Fleet management department for ships in service

  • EMC: Recognised Organisation (RO) Equipment Material Certification department

  • DV: Recognised Organisation (RO) Development department

  • DR: Recognised Organisation (RO) Research department

  • DA: Design Assessment Department for Marine and Offshore Units

  • Admin: Design assessment administration,

  • HR: Human resources

  • PMO: Project management section for Marine & Offshore Units

  • RO: Recognised Organisation (RO) Surveyor center for material equipment certification

  • NC: Recognised Organisation (RO) Surveyor center for new construction projects

  • NS: Recognised Organisation (RO) Surveyor center for Ship in service

  • RO: Recognised Organisation (RO) Solution company

  • VPM-MPA : Veristar Project Managment – Marine Product Approval

  • VE : Veristar equipment

  • FTP: File-transfer protocol

  • TC: Recognised Organisation (RO) Technical center for offshore design assessment (non-class projects)

  • HOCT: Recognised Organisation (RO) Market Segments Marine

  • DCO: Recognised Organisation (RO) Offshore (classification project) commercial section

  • TAC: Recognised Organisation (RO) Type Approval certificate

  • CBS:Computer-Based systems

  • OT: Operational Technologyl

  • IT: Information Technology

  • IP: Internet Protocol

MISSION AND SCOPE

Main missions

Cyber section ensures the following tasks, within its scope of work:

  • Design review, to ensure compliance with IMO, Recognised Organisation (RO) Rules or IACS cybersecurity requirements

  • Redaction and issuance of Type Approval Certificate,

  • Assistance to Recognised Organisation (RO) Network: FM, NC, RO,, LPO, Communication

  • Update and development of Recognised Organisation (RO) rules, in cooperation with DV,

  • Management (including training) of the LPO surveyors delegations related to Cyber scope,

  • Audits of the LPO having an activity related to Cyber security approval,

  • Training for NC/NS/RO surveyors,

  • Participation of M&O division to IACS Cyber security works.

Technical scope of activity

Cyber section scope of work refers to the following activities:

  1. Operational Technology (OT) systems onboard ships, i.e. those computer-based systems (CBS) using data to control or monitor physical processes that can be vulnerable to cyber incidents and, if compromised, could lead to dangerous situations for human safety, safety of the vessel and/or threat to the environment.

    For instance, the CBSs used for the operations of the following ship functions and systems (reference is made to scope included in updated versions of UR E26 and UR E 27), if present onboard, could be typically considered (non exhaustive):

    • Propulsion,

    • steering,

    • Anchoring and mooring,

    • Electrical power generation and distribution,

    • Fire detection and extinguishing systems,

    • Cargo handling system (limited to safety-related elements),

    • Bilge and ballast systems, loading/unloading control systems, loading computer,

    • Boiler control system,

    • Scrubber control system and other systems needed for compliance with class or international regulations to prevent pollution to the environment,

    • Watertight integrity and flooding detection,

    • Lighting (e.g. emergency lighting, low locations, navigation lights, etc.),

    • Any other OT system whose disruption or functional impairing may pose risks to ship operations (e.g. LNG monitoring and control system, relevant gas detection system etc.),

    • Navigational systems required by statutory regulations,

    • Internal and external communication systems required by class rules and statutory regulations;

  2. Any Internet Protocol (IP)-based communication interface from CBSs in the scope of IACS UR E26 and UR E27 to other systems. Examples of such systems are, but not limited to, the following:

    • passenger or visitor servicing and management systems,

    • passenger-facing networks,

    • administrative networks,

    • crew welfare systems,

    • any other systems connected to OT systems, either permanently or temporarily (e.g. during maintenance).

  3. Any system which can consist of group of hardware and software enabling safe, secure and reliable operation of a process. Typical example could be Engine control system, DP system, etc.

  4. Any equipment among the following:

    • Network devices (i.e. routers, managed switches),

    • Security devices (i.e. firewall, Intrusion Prevention System),

    • Computers (i.e. workstation, servers),

    • Automation devices (i.e. Programmable Logic Controllers),

    • Virtual machine cloud-hosted.

ADMINISTRATIVE PROCESSES

Generic e-mail address

4.1 Generic e-mail addressFor external contacts, all correspondences and jobs requests are to be sent & received at least via section generic mailbox:

MoCyberMail@bureauveritas.com

Then jobs can be assigned to each expert accordingly.

Information management

Internal procedures

Everytime a project is initiated with a Client, this project receives a reference tag, TCxmm_nn where:

  • “x” defines the year when reference is created – A corresponds to 2020 or before 2020, B is for 2021, C for 2022, D for 2023 and so on;

  • “mm” defines month of project creation;

  • “nn” defines project number during the year.

For example, TCC06_24 is the 24th project created in 2022 during the month of June.

This reference tag is communicated to Client and used at the beginning of all e-mail correspondence subject to facilitate the sorting and storage of emails.

All important mails are transferred to dedicated folders in MoCyberMail mailbox, so that every Cyber team member is in the capacity to take over a case that he did not follow from the beginning.

When the project starts to materialize, an internal dedicated file is created in Recognised Organisation (RO) M&O Cyber – OPS Sharepoint Business. This “backup” Sharepoint file will host all the documents considered as important in the exchanges with the Client. Once again, it will allow any member of the Cyber team to take over a case that he did not follow from the beginning.

External procedures

Reference tags are communicated to Clients, and explicitly mentioned (between square brackets) at the beginning of all e-mail correspondence subject to facilitate the sorting and storage of emails, if e-mail exchange becomes necessary while performing design review.

Cybersecurity working files and comments are considered sensitive and are not attached to any e-mail correspondence with Clients by Recognised Organisation (RO) M&O team (to the exclusion cases where clients would favour such type of communication under its own initiative). Documents received are filtered, sorted and hosted in FTP for design review process [submission by Client, comments by designated Surveyor (if any), stamping].

ORGANIZATION

Generic Chart

The section organization chart may be found at: G/DAMagement/DA/4-Chart DA.

ROLES AND RESPONSIBILITIES

Head of section responsibilities

The head of section is in charge of:

  • the correct functioning of the section in accordance with its mission and its budget,

  • the organization of the section, the budget, the training and recruitment plan,

  • the definition of the procedures and instructions needed for the Cybersecurity section activities,

  • the definition, coordination and support to key strategic initiatives in order to develop Recognised Organisation (RO) M&O Cyber security activity,

  • the validation of commercial offers addressed to the Recognised Organisation (RO) M&O network, and the invoicing of the projects to the local Recognised Organisation (RO) offices in charge,

  • the assignment of the projects,

  • the management of the section to ensure optimized work planification and operational efficiency,

  • the validation of business travel expenses of any Cybersecurity section personnel reporting to him,

  • the support and animation of the worldwide network to promote cyber offer and latest development of the sector related to maritime and offshore industry,

  • the drawing-up and validation with the Marketing & Communication Department of communication and marketing material such as leaflets, press releases…

  • the follow up and the coordination of the projects,

  • the assignment of the projects,

  • the validation (as supervisor) of the design review & comments submitted to its review in VPM/MPA,

  • the management of the cyber security personnel reporting to him in accordance with Recognised Organisation (RO) M&O HR procedures,

  • the correct implementation of the department quality procedures,

  • the qualification and training of personnel part of the Cybersecurity section,

  • the support provided to LPOs and NC/NS/RO network of surveyors to ensure they are properly qualified and trained,

  • the quality of the technical and commercial offers presentations made by any cyber section personnel to clients and prospects,

  • the participation of Recognised Organisation (RO) M&O division to the IACS Cybersecurity dedicated panel or any other groups found relevant in relation with the scope of activity of the section (EMSA, IACS, IMO, ISO, MED…),

  • the evaluation and decision to carry out any specific missions requested by a clients considered as part of Cyber Security scope, in line with Recognised Organisation (RO) M&O procedures and guidelines,

  • the follow-up of complaints escalated to HO level related Recognised Organisation (RO) M&O Cybersecurity activities if any.

He reports to the head of Advanced Services Department.

Absence of the Head of Section and delegation

In case of absence of the head section, some of the aforementioned responsibilities may be delegated on a case by case basis, depending on urgency, to the Senior Cybersecurity Analyst, or among the people being qualified with minimum Level 2.

The person appointed by the head of section will be entitled in particular to review and validate some of the design appraisal & comments submitted to him, assign the new projects during the period of application, if any (within the scope of his delegations and according to the principles of the local plan approval office procedure).

Head of department is to be consulted where complaint or legal claim is involved or judged as probable.

The delegation rights will stop automatically on the day of the return of the Head of section.

Analyst Tasks

The Analysts carry out the following actions:

  • Ensure cyber plans exchanged with Clients are recorded in secure VPM environment,

  • Examine the documents submitted for approval in relation with NC, NS, RO within the scope of their delegation,

  • Issue the relevant comments,

  • Carry out the follow up of their comments.

In addition, as members of the Head Office, they carry out the following functional tasks:

  • Update the Recognised Organisation (RO) rules (in coordination with DV),

  • Watch the evolution of cyber threats and solutions worldwide, share this watch and update rules and trainings accordingly,

  • Support the global Recognised Organisation (RO) M&O network,

  • Support the maritime industry network, by being involved in the cybersecurity ecosystem and by attending events or representing the Section in particular events,

  • Perform any mission that M&O division would have assigned to itself upon decision of the Recognised Organisation (RO) M&O head of section in link with Cyber security topics of Maritime and Offshore industry,

  • Participate to different meetings and events as representative of Recognised Organisation (RO) M&O,

  • Discuss new commercial offers and develop technical tools for Recognised Organisation (RO) M&O local offices, in coordination with HOCT,

  • Present Recognised Organisation (RO) M&O cyber offers to clients and prospects,

  • Build and deliver dedicated training kits/tools/exams to train LPOs, NC/NS surveyors, RO surveyors,

  • Deliver methodology work sessions to ensure Clients are able to comply with cybersecurity regulations.

QUALITY ASSURANCE

Quality Assurance

Following Recognised Organisation (RO) Marine quality procedures.

HEALTH, SAFETY AND ENVIRONMENT

Health, Safety and Environment

Following Recognised Organisation (RO) Marine quality procedures such HSE procedures and circulars.