Maritime and ports
Remote access logging for ships and ports.
Security built for ships and ports
Ships and ports depend on remote access, outside specialists and connections that are not always available. A retained activity history helps operators investigate across those relationships and coordinate a response.
Rules
| Rule | Clause | Security support |
|---|---|---|
| 33 CFR 101.650(c) | Protected logs, privileged access only. | Role-based access and signed logs. → |
| 33 CFR 101.650(h) | IT-to-OT connections logged and monitored. | Firewall, flow and jump host logs. → |
| 33 CFR 101.650(i) | No unauthorized media. | DLP device control. → |
| IACS UR E26 | Remote access events logged for review. | Remote access logs. → |
| IMO MSC-FAL.1/Circ.3/Rev.4 | Collect and securely store logs. | Signed logs with a standalone verifier. → |
33 CFR 101.650
Remote-session, identity and network records help establish who connected to a vessel’s systems and what followed. Protecting access to those logs and checking their integrity makes the history more useful in review.
IACS E26
IACS UR E26 addresses cyber resilience within its applicable ship scope. Remote-access and monitoring records can contribute evidence, alongside the vessel’s wider design and operating controls.
Vessel connectivity
Buffering allows records to be held during interrupted connectivity and forwarded when the link returns. The team should be able to see the delay and distinguish it from a failed source.
By rule
IMO MSC-FAL.1/Circ.3/Rev.4
Collect and securely store logs. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Questions
Can visitors plug in a USB drive?
DLP device policies can limit use to approved media, people and periods. A reviewable exception gives visiting specialists a route to complete authorized work.
Who approves an action?
The authorized operator, onboard or ashore, makes decisions under the vessel’s procedure. SOAR workflows can present the evidence and retain the approval and result.
What stays with the operator?
The operator retains responsibility for bridge and engine systems, the cybersecurity plan and required reporting. Security monitoring supports the systems and records included in its scope.
Guide
What is the USCG cyber rule?
33 CFR 101 subpart F requires a Cybersecurity Officer, a cyber plan and logs only privileged users can access.
What is IACS UR E26?
An IACS unified requirement for ship cyber resilience. Its scope includes capabilities for identifying, protecting, detecting, responding and recovering, with applicability determined through the relevant class rules.
How do ships log over satellite links?
A SIEM agent holds logs while offline and sends them when the link returns.
How ARRTECH takes care of maritime and port security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
