Shipboard IT, Bridge, Engine and Satellite Systems
See Which Shore Links Can Reach the Bridge
Bridge, engine, cargo and crew networks often meet at a satellite terminal, a crew wireless network or a vendor's remote support connection. GDF assesses vessel IT and OT, from ECDIS and radar to engine control and satellite links, and shows which paths an attacker could use. U.S. flagged operators receive assessment and penetration test evidence organized for the Coast Guard cyber rule.
Scope the vessel
One Vessel, Many Owners, One Agreed Scope
On a ship, the operator, the class society, the charterer and several equipment makers can each control part of the same network, and the master answers for all of it at sea. We settle who authorizes work on each system before anything is tested, then plan around port calls, yard periods and the watch schedule so the assessment never competes with safe operation. For the shore side, ports, terminals and the facilities ships call at, our maritime OT cybersecurity assessment for ports and terminals covers the work.
Bridge and Navigation Systems
ECDIS, radar, AIS, GNSS receivers, integrated bridge and voyage data recorder networks, and the chart and software update paths that reach them from shore.
Engine, Power and Cargo Control
Engine and propulsion control, power management, ballast, cargo and alarm monitoring systems, and the engineering workstations and vendor laptops that connect to them.
Satellite Links and Shipboard IT
Satellite communications terminals, crew and business networks, email and remote support services, and the firewall rules meant to keep that traffic away from operational technology.
Methodology
Our Shipboard Method, Gangway to Retest
-
Shipboard Inventory: Critical IT and OT
We build the inventory of critical IT and OT systems the rule expects from vessel documentation, passive network capture and a walk through the bridge, engine control room and server spaces.
-
Shore Links: Satellite, Vendor and Media
We test the routes in from shore: satellite and cellular links, remote support tools, email, chart and software update channels, and the removable media and laptops technicians bring aboard.
-
Network Separation: Crew Away From Control
We verify that crew and business networks are separated from navigation, propulsion and cargo control, and that unused physical ports are blocked, disabled or removed as the Coast Guard measures require.
-
In Port: Approved Active Tests
Active steps run in port, during a yard period or on a shore test bench, under conditions the master and your Cybersecurity Officer approve, with stop conditions written down first.
-
Plan Evidence: Assessment Inputs and Retest
Findings are organized for the Cybersecurity Assessment and Cybersecurity Plan, known exploited vulnerabilities are flagged for immediate action, and penetration test results are recorded for the certifying letter in the Vessel Security Assessment.
Have a plan renewal or a July 2027 date in view? Tell us the vessels and the dates and we will sequence the fleet.
The Coast Guard Rule and IMO Guidance
The Coast Guard's cybersecurity rule, 33 CFR part 101, subpart F, Cybersecurity, applies to owners and operators of U.S. flagged vessels, facilities and Outer Continental Shelf facilities that must hold a security plan, and not to foreign flagged vessels. Personnel had to complete the rule's core cybersecurity training by January 12, 2026. The Cybersecurity Assessment is due by July 16, 2027 and annually after that, Cybersecurity Plans go to the Coast Guard for approval by the same date, and a penetration test is required in conjunction with each plan renewal, with a letter certifying the test and its findings included in the Vessel Security Assessment.
For foreign flagged ships and international fleets, the expectations come from the IMO's maritime cyber risk management guidance. Resolution MSC.428(98) asks that cyber risks be addressed in safety management systems under the ISM Code, and the Guidelines on maritime cyber risk management, revised again as MSC-FAL.1/Circ.3/Rev.4 in May 2026, set out functional elements from identifying critical systems to recovering them after an incident. A shipboard assessment tests whether those elements exist aboard, not only on paper ashore.
Bring your vessel list and plan dates to a scoping conversation, or call (800) 868-8189.
Three Engagements for Fleets and Single Ships
We suggest starting with the assessment the rule requires and adding testing as plan renewals approach.
Cybersecurity Assessment for the Plan
The assessment the rule requires for each vessel: analysis of all networks, the critical system inventory, vulnerabilities in critical IT and OT systems and recommendations, delivered so your Cybersecurity Officer can build or update the plan from it.
Shipboard Penetration Test
An authorized test from shore, satellite and crew network positions toward bridge, engine and cargo systems, with the certifying letter and findings your Vessel Security Assessment needs at plan renewal.
Fleet Sampling and Newbuild Review
For sister ships, one representative vessel sets the depth of testing while every covered vessel still receives its own assessment, checked for configuration differences. For newbuilds, we review the cyber resilience documentation classification societies require under IACS UR E26 and E27 for ships contracted on or after July 1, 2024.
Planning a fleet program across several flags? Scope Your Assessment
Forensic Discipline Behind Every Vessel Finding
Since 1992 GDF has examined systems for counsel and security teams, and our examiners have testified in federal and state courts, which is why a vessel finding arrives with the evidence trail a Coast Guard inspector, a P&I club or a court would expect to see.
Robert Knudsen, our computer forensics and cybersecurity specialist, holds the CISSP, CCE and CHFI with CompTIA Security+ and Network+, and has conducted hundreds of computer and mobile device examinations for matters in federal and state courts. Veronica Perez, a Senior Computer Forensic Specialist, is trained in JTAG, chip off, in system programming, microsoldering and embedded hardware analysis, which matters when a controller or navigation unit has to be examined below its software. Founder Joseph Caruso holds the CISSP and has worked in technology since 1980, including cybersecurity incident response.
Frequently asked
Vessel Cybersecurity Questions From Ship Operators
Does the Coast Guard rule apply to our vessels?
Subpart F applies to owners and operators of U.S. flagged vessels required to hold a vessel security plan under 33 CFR part 104, and not to foreign flagged vessels. We confirm applicability with you during scoping and plan the technical work around it.
Can you assess a ship while it is in service?
Yes. Passive collection and interviews can happen during a port call or a voyage leg, and active steps are scheduled in port, in a yard period or on a shore bench, at times the master and your Cybersecurity Officer approve.
What does the penetration test letter need to cover?
The rule requires a letter certifying that the penetration test was conducted, together with all identified vulnerabilities, included in the Vessel Security Assessment in conjunction with plan renewal. Our report supplies both.
Do you assess new satellite connectivity such as low earth orbit terminals?
Yes. We examine the terminal configuration, its management interface, the firewall and routing between the terminal and shipboard networks, and the remote access it enables, because a new high bandwidth link often arrives before the rules that should govern it.
How does this relate to your port and terminal work?
Shore facilities, terminals and port operators are covered by our maritime OT cybersecurity assessment. Operators whose vessels connect to terminal or shore services often combine the two.
Scope your assessment
Bring Your Fleet List to a Scoping Call
The first call covers which vessels fall under the Coast Guard rule, your assessment and plan dates, the systems aboard each class of ship and when they can be reached, and ends with a proposed approach and schedule. The call costs nothing.
Include each vessel's flag and the plan or renewal date ahead.
GDF has examined systems since 1992. Call the 24/7 hotline, (800) 868-8189, when a problem is live.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .