This article is shown in English. Encyclopedia articles are currently written in English and Persian.
What is the board’s problem?
Port operations depend more and more on terminal operating systems, ship arrival notification, traffic control and data exchange. A cyber incident can affect confidentiality of information, availability of service and safety of physical operations at the same time. Cyber risk is therefore not simply a question of buying software or a firewall; managers must set responsibility and the level of acceptable risk.
Separating IT and OT
IT usually covers administrative, communication and data systems; OT includes technologies that control the physical processes of equipment and facilities. A disruption in OT can directly affect cranes, power, gates or other equipment. The business continuity plan must assess the dependencies between the two areas and the possibility of safe fallback operations.
Data governance in the MSW
Every data item should have an organisational owner, a shared definition, a basis for access, a rule for correction and a retention period. Agreement between agencies on service levels and incident reporting is a precondition of lasting cooperation. Role-based access and logging of sensitive events must become everyday processes, not just clauses in an information security policy.
Decisions to put to senior management
A security budget request should be presented with a threat scenario, relative likelihood, tolerable level of disruption, the person responsible for response and a recovery indicator. Tabletop incident exercises, review of supplier dependencies and regular monitoring of access rights are examples of management actions. The details of penetration testing and technical design should be left to qualified specialists.
Practical checklist
- Build a list of critical services and their IT/OT dependencies
- Name the data owner and the authority to grant access
- Rehearse service continuity and recovery scenarios
- Define suppliers' roles and who is responsible for incidents
Frequently asked questions
Is cyber risk only the IT manager's responsibility?
No. The technical team implements, but senior management must set the level of risk and the line of accountability.
Editorial note: this article is written for awareness and management decision-making. Applying any rule depends on the authentic current text, the legal position of the State concerned and the facts of the case. The content is independent and implies no endorsement by, or affiliation with, IMO.