What goes into testing a ship?

This report provides practical guidance for assessing and improving cybersecurity on ships, emphasizing a risk-based approach aligned to industry frameworks and regulations (e.g., MSC.428(98), BIMCO, IACS UR E26/E27, ISO/NIST). It highlights corporate IT compromise as the most significant fleet-wide risk and focuses on oversight, network segmentation between IT and OT, perimeter defenses, and Windows domain security. The document outlines a typical testing engagement—including maturity assessment, network and Wi‑Fi reviews, segmentation validation, IT domain compromise attempts, proportionate OT checks, and external attack surface review—conducted with a risk-averse methodology and ideally scheduled during low-impact periods such as drydock.