Overview
IEC 63154:2021 is an international standard developed by the International Electrotechnical Commission (IEC) that addresses cybersecurity for maritime navigation and radiocommunication equipment and systems. It establishes general requirements, testing methods, and the necessary test results to ensure a basic level of protection against cyber incidents. Cyber incidents include any malicious attempts causing or potentially causing adverse impacts on maritime equipment, networks, or the information they handle.
This standard applies primarily to:
- Shipborne radio equipment that forms part of the Global Maritime Distress and Safety System (GMDSS) as defined by the Safety of Life at Sea (SOLAS) Convention and the Torremolinos International Convention for Safety of Fishing Vessels.
- Shipborne navigational equipment governed by SOLAS and the Torremolinos conventions.
- Other shipborne navigational aids and Aids to Navigation (AtoN), where applicable.
IEC 63154:2021 aims to enhance cybersecurity resilience in maritime systems vital for safety, navigation, and radiocommunication by defining comprehensive security requirements and robust testing protocols.
Key Topics
The standard covers a wide range of cybersecurity aspects for maritime equipment, structured into modular sections addressing specific areas of protection and testing:
- Data Integrity and Authentication: Ensures data files maintain transport integrity and authentic origin to prevent tampering or unauthorized modifications.
- Execution Controls: Manages safe execution of software executables, preventing malicious code execution.
- User Authentication: Establishes secure user identification and access control mechanisms.
- System Defense Measures: Incorporates malware protection and denial of service (DoS) attack mitigations.
- Network Access Controls: Regulates equipment connections to various network types, ensuring secure communication pathways.
- Operating System Protection: Specifies requirements for access to OS features to minimize vulnerabilities.
- Booting Environment Security: Defines safeguards for the startup processes of maritime equipment.
- Maintenance and Software Updates: Sets protocols for secure software maintenance, semi-automatic software updates by vessel crews, and remote maintenance activities.
- Interface Controls: Addresses secure use of interfaces including USB and those defined by IEC 61162 standards for maritime navigation.
- Removable Device Security: Covers physical and operational protection for removable storage devices.
- Documentation and Compliance: Includes comprehensive requirements for cybersecurity documentation and guidelines.
Supplementary annexes provide guidance on virus and malware protection implementation, file authentication methods including digital signatures and cryptography, USB class codes, and cybersecurity configuration documentation.
Applications
IEC 63154:2021 is essential for manufacturers, shipbuilders, system integrators, and owners/operators of maritime vessels and equipment, ensuring that:
- Shipborne communication and navigation systems comply with international safety and cybersecurity regulations.
- Cybersecurity risk management is embedded during design, manufacturing, testing, and maintenance phases.
- Continuous protection is maintained against cyber threats that could disrupt navigation safety, distress signaling, or communication systems on vessels.
- Maintenance procedures and software updates are performed securely to prevent introducing vulnerabilities.
- Compliance with SOLAS and Torremolinos conventions is achieved, supporting both commercial and fishing fleets.
By following this standard, maritime stakeholders can safeguard critical systems from cyber threats, reduce operational downtime, and enhance overall maritime safety and security.
Related Standards
IEC 63154:2021 works in conjunction with related international standards to provide a holistic cybersecurity framework for maritime systems:
- IEC 61162 series: Defines communication protocols for shipborne navigational equipment, which IEC 63154 integrates for cybersecurity controls.
- SOLAS Convention: International maritime treaty that establishes safety standards, including radiocommunication requirements supported by IEC 63154.
- Torremolinos International Convention for Safety of Fishing Vessels: Sets safety protocols for fishing vessels, emphasizing adherence to cybersecurity measures.
- IEC 62507 series: Guidelines on software and data integrity in safety-critical systems, relevant to maritime equipment software.
- ISO/IEC 27000 series: General standards for information security management systems applicable to maritime cybersecurity governance.
Using these standards in synergy with IEC 63154:2021 enables maritime operators to implement comprehensive, interoperable, and internationally recognized cybersecurity strategies tailored to maritime navigation and radiocommunication environments.
Keywords: IEC 63154, maritime cybersecurity, shipborne navigation equipment, GMDSS, SOLAS cybersecurity, radiocommunication security, maritime equipment testing, cyber incident protection, maritime network security, maritime cyber standard.