A Marine Cyber Capability Page That Separates IT From OT

Marine cyber pages often combine email security, cloud monitoring, navigation equipment and propulsion controls under one broad claim. That makes the supplier sound comprehensive while making the operational boundary impossible to understand.

A stronger page separates corporate IT from shipboard OT, then explains the interfaces where risk and responsibility cross.

What is the clearest page structure?

Start with three columns: corporate IT, shipboard OT and ship-to-shore interfaces. For each, name the systems covered, the service delivered, the operational constraints, the evidence produced and the party that retains decision authority. Use a scenario to show how the three areas work together during an incident.

MPA's SRS Cyber Notation identifies communication, propulsion and power control, navigation and cargo management as important shipboard OT groups. CSA's OT Cybersecurity Competency Framework also recognises that OT roles need greater specificity than general ICT roles.

Use official groupings where they help, but describe only systems and services the company actually covers.

Marine cyber capability architecture separating corporate IT, shipboard OT and controlled connection points.

Show the boundary at a glance

Area	Typical systems	Main concern	Evidence to present
Corporate IT	Identity, email, endpoints, business applications	Confidentiality and business continuity	Scope, monitoring, access and response records
Shipboard OT	Navigation, propulsion, power and cargo control	Safe and available operation	Asset boundary, safe access, test and recovery evidence
Interface	Remote support, data transfer, vendor access, satellite link	Trust crossing between environments	Connection owner, approval, logging and fallback

Do not imply that this table is a network design. Its job is to orient a buyer before the detailed technical exchange.

Describe the service as actions and outputs

“End-to-end cybersecurity” tells the reader very little. Replace it with the work performed and the record delivered.

For example:

• inventory critical connections and responsible owners;
• review remote-access routes and approval controls;
• map safe isolation constraints with vessel engineers;
• run a scenario involving shore and crew teams;
• record findings, priorities and accepted residual risks;
• retest the changed control.

For each action, state whether it is assessment, implementation, monitoring, training or incident support. Buyers need to know where the supplier's responsibility stops.

Make operational constraints visible

OT work cannot always follow the same response as office IT. Disconnecting a device may affect safe navigation, machinery control or cargo operations. Patching may depend on vendor approval, class requirements, port conditions or a maintenance window.

Add a short “how we work safely” section covering:

1. operational authority and permit route;
2. system owner and vendor involvement;
3. test environment or simulation where available;
4. fallback and recovery criteria;
5. evidence captured before and after a change.

MPA's MariOT facility illustrates the value of testing shipboard scenarios in a controlled environment. If a supplier uses a lab, simulator or digital twin, explain which systems and conditions it represents. Do not call a generic cyber range a vessel testbed.

Use one scenario instead of ten claims

Build a compact scenario panel: an unauthorised remote session is detected during port approach. The panel should show detection, operational assessment, command decision, containment, evidence preservation and safe recovery.

Label who acts at each step. If the provider advises while the vessel's responsible officers decide, say so. This demonstrates collaboration without overstating authority.

Add one result only if it can be supported. Useful results include a tested response time, a closed access route, a completed exercise or an accepted remediation plan. Avoid claims about preventing every incident.

Give procurement a sensible next step

Offer a route matched to the buyer's stage:

• request a capability statement;
• discuss a defined fleet or system scope;
• arrange a controlled technical workshop;
• request evidence under confidentiality terms.

Do not ask a prospect to upload network diagrams through a public form. The public page should establish fit, then move sensitive information into an appropriate exchange.

Check every claim against a deliverable

Before publishing, make a two-column list of claims and evidence. “We assess remote access” should point to an assessment scope and output. “We support incident response” should name availability, role, constraints and the record produced. Remove any claim that the delivery team cannot connect to a current method.

Then ask an operations representative to read the page. They should be able to identify who retains authority over safe operation. Ask a corporate IT representative to identify the handoff at the ship-to-shore boundary. If either person interprets the supplier's control differently, revise the copy or resolve the underlying responsibility gap.

Finally, add a review owner and date. Cyber services, vessel systems and vendor relationships change. A page that accurately described the service last year can misstate it after a platform, partner or response arrangement changes.

A short publication checklist

• IT, OT and interface scopes are separate.
• Each service has an action and deliverable.
• Operational authority is explicit.
• Examples are approved and bounded.
• Sensitive diagrams remain off the public site.
• The technical and commercial contacts are current.
• A named owner will review the page again.

Our Singapore maritime OT skills guide can help align the people section with the operating model. The Singapore marine vendor cyber checklist covers the evidence buyers may request next.

Creatif Work designs marine websites around real technical boundaries. Our website service can turn approved cyber material into a clear capability page while keeping fleet-specific diagrams and security records outside the public site.