Marine Software Security Due Diligence Checklist for Owners
When a fleet moves inspections, maintenance and record books onto a vendor's platform, it also moves its evidence, its crew data and a new connection between ship and shore. The vendor's security becomes part of your own cyber risk, and increasingly part of what flag, class, charterers and insurers expect you to have assessed. Since 2021, IMO resolution MSC.428(98) has expected cyber risk to be managed within the Safety Management System, and the IMO guidelines revised in April 2025 now frame that work around governance as well as protection. Industry guidance goes further, telling owners to evaluate the cyber risk processes of their suppliers and write the expectations into contracts. This checklist turns that into questions you can put to any maritime software vendor, the evidence to ask for, and the answers that should stop a deal, all before your data moves. If Marine Inspection is on your list, book a demo and put these questions to us directly.
Check the vendor before the data moves
Six areas, one set of questions for every vendor, and evidence on paper rather than assurances on a call. The chart shows how one example vendor compares with a sensible minimum.
None of these instruments names your inspection software. Together, though, they make supplier cyber risk something an auditor, charterer or insurer can reasonably ask about. Our maritime cyber compliance explainer covers each in more depth.
Jan 2021
IMO resolution MSC.428(98)Cyber risk to be addressed in the SMS, verified from the first DOC audit after 1 January 2021.
Jul 2024
IACS UR E26 and E27Cyber resilience requirements for ships, and for onboard systems and equipment, contracted for construction from 1 July 2024.
Nov 2024
Industry guidelines, version 5BIMCO and partners' Guidelines on Cyber Security Onboard Ships, including third-party and supplier risk assessment.
Apr 2025
IMO MSC-FAL.1/Circ.3/Rev.3Revised IMO guidelines, now aligned with NIST CSF 2.0 and adding a Govern function to Identify, Protect, Detect, Respond and Recover.
Jul 2025
US Coast Guard final ruleCybersecurity requirements for US-flagged vessels and regulated facilities took effect, with phased deadlines.
Follow your data from ship to shore
Due diligence is easier when you trace where records actually go. Each point below is a place data can be exposed, and each has two questions to ask. A vendor that cannot draw this path for you probably has not drawn it for itself.
On board
Crew phones and tablets, offline cache
Is data stored on the device encrypted?
What happens if a device is lost?
Ship to shore link
Satellite, 4G in port, shore Wi-Fi
Is every sync encrypted in transit?
What does the app open on the ship's network?
Vendor cloud
Hosting, backups, vendor staff
Which provider and region hold the data?
Who at the vendor can see it, and is that logged?
Shore users and links
Office logins, integrations, exports
Is multi-factor sign-in available?
How are integration keys issued and revoked?
The checklist: six areas, what to ask, what to collect
The six areas follow the functions in the IMO guidelines, so the answers slot straight into your own cyber risk assessment. For each question, ask for the evidence in the middle column, in writing. Treat anything in the right-hand column as a reason to pause.
Govern1. Security governance
AskEvidence to collectRed flag
Who owns security at the vendor?Named role and contact"Our developers handle it"
Is security independently assessed?Current certificate or audit report, such as ISO/IEC 27001 or SOC 2, with its scopeCertificate that does not cover the product you are buying
Is the product tested by outsiders?Date and summary of the latest penetration testNo test in the last year
Identify2. Hosting and data ownership
AskEvidence to collectRed flag
Where is our data hosted?Cloud provider, region and backup locations"In the cloud," with no region
Who else processes it?List of sub-processorsNo list available
Who owns the data?Contract clause confirming your ownershipVendor rights to reuse your data
Protect3. Encryption
AskEvidence to collectRed flag
Is data encrypted in transit?Confirmation that all syncs and logins use current TLSAny unencrypted sync path
Is data encrypted at rest?Description for the database, file storage and backupsBackups excluded
Is the offline cache on board protected?How device data is stored, and remote wipe or sign-outPlain-text files on the device
Protect4. Access control
AskEvidence to collectRed flag
Can every user have their own login?Role-based permissions shown in the demoShared ship logins recommended
Is multi-factor sign-in available?MFA or single sign-on options for shore usersPasswords only, with no plan
How is crew access removed at sign-off?Deactivation process and who can do itOnly the vendor can remove users
Ask us the first four areas on a call. We will walk your IT lead through hosting, encryption, device storage on board and role-based access, and follow up in writing.
Detect / Respond5. Monitoring and incident response
AskEvidence to collectRed flag
Are logins and changes logged?Audit trail shown live, and log retention periodNo user-level history
How fast will you tell us about a breach?Notification deadline written into the contract"We would let you know"
Who do we call during an incident?Incident contact and hours, and the response plan outlineOffice-hours email only
Recover6. Resilience and exit
AskEvidence to collectRed flag
What if your service is down?Uptime commitment and whether crews can keep working offlineApp stops without the server
How much data could be lost?Backup frequency and restore time targetsNo tested restore
How do we leave?Full export in open formats and deletion confirmationExport only at extra cost
Match the depth to your fleet
The IMO guidelines note that ships with limited digital systems may need only a simple application, while complex setups need more care. The same logic applies to vendor checks. Scale the effort to how much you depend on the platform.
Basic
A few vessels, inspections only
Questionnaire covering the six areas
Hosting region and export terms in writing
Role-based logins confirmed
Standard
Fleet PMS, record books, integrations
All of Basic
Certificate or audit report and latest pen test summary
Breach notice and support hours in the contract
Enhanced
Large fleets, tankers, newbuilds under E26/E27
All of Standard
IT review call with the vendor's security owner
App network footprint mapped into your asset inventory
Write it into the contract
A questionnaire records what the vendor said. The contract records what it must do. BIMCO recommends a cyber security clause in commercial shipping contracts for the same reason. Put these terms in writing before you sign, and use our RFP template to collect them consistently from every bidder.
§1
Data ownership. All data entered by the company and its crews belongs to the company.
§2
Hosting location. Data is hosted in named regions, and changes need notice.
§3
Breach notification. The vendor notifies the company of any incident affecting its data within a stated number of hours.
§4
Security evidence. The vendor provides updated certificates or audit reports and pen test summaries each year on request.
§5
Exit. Full export in open formats at no charge, followed by written confirmation of deletion.
Frequently asked questions
Security questions about Marine Inspection?
Our team will answer the checklist for your IT lead and follow up in writing.
The guidelines themselves are recommendations. Addressing cyber risk in the SMS is expected under resolution MSC.428(98), and flag states and auditors verify it.
Do IACS UR E26 and E27 apply to inspection software?
They apply to ships, and onboard systems and equipment, contracted from 1 July 2024. Ask how an app used on board fits your asset inventory and network segregation for those ships.
Is a certification enough on its own?
No. Check that its scope covers the product and hosting you are buying, and still ask the questions on device storage, exit and breach notice.
How often should we repeat the check?
At renewal, and whenever the vendor changes hosting or adds integrations. Industry guidance stresses updating risk assessments whenever systems or connections change.
Put Marine Inspection through your security review
Bring this checklist to a demo. We will cover hosting, encryption, device storage on board, access control and exit terms, then confirm our answers in writing.
