What Maintenance Information Should Be Public and What Should Stay Private?
Public maintenance information should help a buyer understand the service, system and evidence available. It should not expose live defects, security arrangements, crew details, access routes or technical information that increases operational risk.
Classify the source before writing the website page.
Which maintenance information can be public?
Public content can include service scope, supported asset types, planning and quality process, facilities, general competency approach, current certifications with scope, approved projects and the documents available during qualification. Detailed maintenance history, live defects, security data, personal records and controlled manuals should remain restricted.
| Class | Examples | Website treatment |
|---|---|---|
| Public | Service scope, facility, approved case study | Visible and searchable |
| Qualification | Selected certificates, performance records, insurance | Supplied through controlled review |
| Operational | Work orders, defects, parts, tests and manuals | Kept in maintenance system |
| Restricted | Security systems, access, vulnerabilities, personal data | Limited to authorised roles |
Marine maintenance information classification matrix for public, qualification, controlled and restricted records.
Start with purpose and harm
Ask why a field is being published and what harm could follow from disclosure, combination or staleness. Vessel name plus location, defect and sailing schedule can be more sensitive together than separately.
Include the asset owner, operations, security, legal or privacy, technical and marketing roles in classification.
Publish process, not the live record
A public page can explain how maintenance is planned, authorised, executed, tested and closed. It can state that controlled records are available during approved qualification.
It usually does not need work-order screenshots, open defect lists or detailed access instructions.
Protect people and customers
Do not publish crew qualifications, signatures, phone numbers, medical data or shift patterns. Explain competency requirements and verification instead.
Remove customer, vessel and location information unless approved. Anonymisation must account for what can be inferred from images, dates, equipment and other public sources.
Treat technical documents by function
General product data and approved service manuals may be public from their owner. Vessel-specific drawings, settings, passwords, network diagrams, security plans and emergency details should be controlled.
Record document owner, classification, recipients, revision, permitted use and expiry. A public URL is not a document-control system.
Use a qualification route
Give procurement a named contact and explain how evidence is released. Use appropriate confidentiality and identity checks. Send the smallest relevant set rather than an uncontrolled archive.
AMSA's safety management system guidance emphasises an operational system based on vessel risk. A website should explain that system at a high level while leaving working records where crews use them.
Review images and metadata
Images can reveal serial numbers, screens, access points, keys, badges, location and unsafe conditions. Review crops and high-resolution files. Remove unnecessary metadata and use only approved images.
Do not stage a maintenance activity that conflicts with real safety practice for the sake of a photograph.
Create a publication record
For every technical claim, image and document, store source, classification, approving owner, permitted wording and next review. Withdraw content when the source changes or permission expires.
Plan for requests and incidents
A buyer may ask for controlled records during urgent work or prequalification. Define who can approve release, the identity check, the secure transfer route and the log kept. Staff should not send a whole maintenance folder because one certificate was requested.
If public content is found to expose sensitive information, have a removal and notification process. Preserve the internal record of what was published, when it was removed and who must assess further action.
Review information in combination
Several harmless pages can create a sensitive picture when combined. A fleet list, staff profile, live vacancy, project date and workshop photograph may reveal capability or absence at a location. Review the website as a whole, not document by document.
Search engines and web archives may retain old copies. Do not rely on later deletion as the primary control. Publish the minimum needed from the beginning.
Train content owners
Give marketing, operations and external agencies examples of each classification. Require technical review before posting maintenance imagery, manuals or performance data. The rule should follow the source record even when content is reused in a proposal or social post.
Classification checklist
- Business purpose for publication stated
- Asset owner and security reviewer involved
- Public, qualification, operational and restricted classes defined
- Personal and client information removed or approved
- Live defects and schedules remain controlled
- Drawings and manuals reviewed for sensitivity
- Images checked for visual disclosure
- Qualification requests have an owner
- Public claims link to current source records
- Review and withdrawal triggers recorded
Decide with a four-question test
For each proposed item, ask: Who needs this information? What decision will it support? What harm could follow from disclosure or combination with other facts? Can a less detailed version meet the same purpose? Record the answer and approving owner.
Use the result to select the channel. Public pages can explain services, controls and approved outcomes. A qualification pack can hold deeper evidence for a known buyer. Operational portals can carry current work records for authorised users. Restricted systems should hold live defects, access information, detailed drawings and security-sensitive data. Review the classification when the asset, customer agreement, threat context or business purpose changes. Publication is not permanent permission. A withdrawal route and source record should remain available so the team can correct or remove a page quickly when circumstances change.
Creatif Work designs marine websites that make capability visible without turning operational records into marketing assets. Through our website service, firms can create public and controlled evidence routes, while our guide to Australian marine safety pages applies the same separation to safety and welfare information.