Three Pages for an Entire Ship: Why I Rejected a Shipyard's E26 Vessel Asset Inventory
First : Vessel Asset Inventory [E26, 5.1.3]
※ The shipyard and SI company names are anonymized (H*, M*).
I want to share some of the problems I have experienced with cyber security documents for ships being built in China. The first document I want to talk about is the Vessel Asset Inventory under E26, Section 5.1.3.
I have a strong message for Chinese shipyards and shipowners: Hire a competent cyber security SI company of Korea.
I am writing this as a ship superintendent, not to blame any particular shipyard or company. The owner's side will live with these documents for the entire service life of the vessel, long after the shipyard has delivered it. What I want to see is not perfect paperwork on the first submission, but a shipyard that takes ownership of the problem and works with us to solve it.
1What the Shipyard Submitted
A vessel is currently under construction at H*, one of the largest shipyards in China. M* is responsible for the cyber security SI work. They are known as one of the most technically advanced SI companies in China.
So, what did shipyard submit for approval?
Just three pages, with around 50 entries with so many pending.
Yes, only three pages for the Vessel Asset Inventory. Surprised.
Of course, fewer pages do not always mean a bad document. But the assets on board must be properly identified, and the important information about each system and its connections must be included.
However, the document I received was little more than a list of system names. In my view, it was nowhere near sufficient to provide a proper understanding of the vessel's cyber-related assets or to support the subsequent risk assessment and selection of appropriate security measures.
A modern ocean-going vessel carries a large number of computer-based systems: integrated automation, power management, navigation, communication, fire detection, cargo and ballast control, and the network switches, gateways, and workstations that connect them. For a reviewer, each entry in the inventory should answer at least the following:
- What the system or device is, and what function it serves on board
- Manufacturer, model, and supplier
- Physical location on the vessel
- Hardware, operating system, firmware, and software versions
- Network connections, interfaces, and communication protocols
- Which security zone it belongs to, and how critical it is to the safety of the ship
- Whether it has any remote access, wireless, or external connection
An inventory with "TBD" in most of these fields is not yet an inventory. It is a placeholder.
2"What Is the Problem?"
I raised the following question with the shipyard:
"Do you really consider this a reliable document that adequately identifies the cyber-related assets on board? Is this why you submitted it for approval?"
The shipyard's answer was quite straightforward:
"This document was prepared by M*, one of the leading cyber security SI companies in China. We simply submitted what they provided. What is the problem?"
OMG. Really? Is that supposed to be enough?
Just because a company is well known, does that mean its documents are always good? Is that really a reason to approve them?
Outsourcing the work does not outsource the responsibility. The shipyard, as the party submitting the document and integrating the systems on board, is still accountable for what it submits. A reputable SI company is a reason to expect a good document, not a reason to skip checking one.
My decision was clear.
What is even more surprising is that the shipyard did not seem to understand what was wrong with the document. They simply forwarded the material they had received from the SI company to the shipowner without any proper review.
To make matters worse, some of my fellow colleagues on the owner's side also seem unsure whether the document is acceptable or completely inadequate, or whether they should approve it as submitted or raise comments.
3A Vessel Asset Inventory Is Not Just a List of System Names
A Vessel Asset Inventory is not just a list of system names. It should help us understand what assets are installed on board, how they are connected, and which assets need to be considered from a cyber security perspective. It is one of the basic documents needed to support the risk assessment and the development of appropriate security measures.
Every other cyber security document for the vessel is built on top of it:
If the inventory itself is incomplete or unreliable, how can we have confidence in the risk assessment and other cyber security documents built on top of it?
4What I Expect from Shipyards: A Problem-Solving Attitude
Chinese shipyards build some of the largest and most advanced vessels in the world. Their cyber security documentation should meet the same standard as their steel and machinery. From the superintendent's side, this is what I would like to see when a document is rejected:
- 1 Own the document, even when an SI prepares itAssign a responsible engineer at the shipyard who reviews every SI deliverable against the actual vessel before it is submitted, and who can answer technical questions about it.
- 2 Answer comments with substance, not with a company nameA reply such as "M* prepared it" does not resolve a comment. A revised document with the missing information does.
- 3 Collect equipment data from makers earlyVersions, interfaces, ports, and protocols come from the equipment makers. Request them at the purchase-specification stage, not one month before delivery.
- 4 Check the inventory against the real shipCompare the document with the as-built configuration on board. Anything marked "pending" should have an owner and a date.
- 5 Keep all cyber documents consistentThe inventory, Zones and Conduit Diagram, and test procedures must describe the same ship. When one changes, the others must be updated.
- 6 Treat comments as joint work, not as an obstacleRegular technical meetings among the shipyard, SI company, owner, and class society will close issues faster than exchanging rejected documents.
- 7 Hand over a document we can maintainAfter delivery, the owner must keep the inventory up to date for the life of the vessel. Deliver it in a form that can actually be maintained.
5What Will Happen If We Let It Pass
A weak inventory rarely causes a problem on the day it is approved. The problems appear later, when they are more expensive and harder to fix:
- ! Risk assessment and security zones built on the wrong baselineAssets that are missing from the inventory are missing from the risk assessment too, so they receive no protection.
- ! Late findings at commissioning, sea trials, or class surveyEquipment that was never documented is discovered during testing. That means rework, retesting, and pressure on the delivery schedule.
- ! Repeated across sister vesselsIn a series project, the same incomplete document is copied to every ship in the series, and so is every gap.
- ! No baseline for vulnerability and patch managementWhen a vulnerability is announced for a particular firmware version, the owner cannot tell which ships or systems are affected.
- ! Slower incident responseDuring a cyber incident, the crew cannot isolate devices or connections that nobody knew were there.
- ! Hidden remote access and external connectionsUndocumented remote-maintenance links or vendor connections remain open as attack paths into the ship's systems.
- ! Responsibility disputes after deliveryWhen an issue appears in operation, nobody can say whether it was in the scope of the original approval, and the cost moves to the owner.
By then, fixing the problem means work on a ship in service, not a revision on paper.
6To Shipowners and Classification Societies
To shipowners and classification societies involved in newbuilding projects in China, I would like to make one point very clear.
Do not approve cyber security documents simply because they have been submitted by the shipyard or prepared by a well-known SI company.
Check whether the documents properly reflect the actual vessel, whether the required technical information is included, and whether the contents are consistent with the other cyber security documents. If something is missing or inadequate, raise your comments and ask for proper revisions.
You may also receive a Vessel Asset Inventory that is only three pages long.
If such a document is approved without a proper technical review, important asset information may remain unidentified or undocumented. This can create serious problems later when assessing cyber risks and determining the security measures needed to protect the vessel.
Approval should not be just a formality. Someone needs to check the document properly and make sure it meets the actual requirements.
Our responsibility does not end when we put an approval stamp on a document. If the document has not been properly reviewed, its shortcomings may only become apparent later, when the vessel is in operation.
Raising comments is not about being difficult. A clear, early comment costs the shipyard a revision; a missed issue costs everyone much more after delivery.
This is the first issue I have encountered while reviewing cyber security documentation for ships being built in China.
My hope is simple: when a document comes back with comments, the shipyard asks "what is missing, and how do we fix it?" instead of "what is the problem?" Cyber security requirements for newbuildings are only getting stricter, and the shipyards that build this capability now will be the ones owners trust with their next projects. If that capability is not yet available in-house or locally, bring in people who have it.
I have a strong message for Chinese shipyards and shipowners: Hire a competent cyber security SI company of Korea.
More to come.
I'm going absolutely crazy dealing with the cyber security issues between Chinese shipyards and Chinese SI companies. It's driving me insane!
If the class society approves this document without raising a single comment, I'm seriously going to lose my mind!
Related Reading:
- OT Asset Management for Ships
- Zones and Conduit Diagram: Establishing the Vessel's Security-Zone Architecture (IACS UR E26 Compliance Series · Article 2 of 7)
- IACS UR E26/E27: Two Years of Survey Practice — A Class Surveyor's Inside View
- Why Most Ship ZCDs Fail — Seven Common Mistakes in IACS UR E26/E27 Projects
⚓ Join the ShipPaulJobs Community
Join →
When you took delivery, did the asset inventory match what was actually on board?
ReplyDeleteI would like to hear what you found during your first onboard verification. Your experience is exactly what shipyards and SIs need to hear.
The vessel has not been delivered yet, and I am about to start the onboard verification.
DeleteHowever, I rejected the document back in March, and it is now October, but I still have not received the revised version. This leads me to believe that the Chinese SI still has not properly identified the assets actually installed on board.