Recommendation on Cyber Resilience: 2020 [paper]

IACS Recommendation on Cyber Resilience (Rec.166): 2020

The IACS Recommendation on Cyber Resilience (Rec.166) provides the technical requirements and guidance needed to design, build, operate, and maintain cyber resilient ships. Published in 2020, it consolidates twelve previous IACS recommendations into a single framework for maritime cybersecurity.

The recommendation supports shipowners, shipbuilders, system integrators, equipment manufacturers, and classification societies in delivering vessels that can withstand, respond to, and recover from cyber incidents throughout their operational life.

Purpose of Rec.166

It provides technical requirements to ensure cyber-resilient ships—systems capable of withstanding and recovering from cyber incidents throughout their service life. It consolidates 12 earlier IACS recommendations into a unified framework for stakeholders.

Why Cyber Resilience Matters

Cyber resilience ensures that ships and crew can effectively respond to cyber incidents affecting onboard computer-based systems, which are critical to safe operations. While prevention is the ultimate goal, this recommendation also prepares ships to cope with incidents if they occur.

Without these measures, cyber incidents could pose risks to:

• Human safety
• Ship safety
• The marine environment

Key Objectives

This recommendation aims to:

• Support the secure design, integration, and maintenance of computer-based systems on ships.
• Protect against unauthorized access, misuse, modification, destruction, or improper disclosure of onboard data and systems.
• Ensure secure operations and data integrity across onboard networks.

What’s Covered?

The recommendation includes technical requirements and guidance on:
✔ Reference guidelines and standards
✔ Terms and definitions
✔ Goals for design and construction
✔ Functional and technical requirements
✔ Verification testing

Alignment with Global Standards

This recommendation supports IMO Resolution MSC.428(98), “Maritime Cyber Risk Management in Safety Management Systems,” ensuring consistency with international maritime cybersecurity best practices.

Recommendation on Cyber Resilience (Rec.166), IACS