A yacht's Safety Management System must treat cyber risk the same way it treats fire or flooding: with an identified owner, a documented inventory of systems, and a five-step risk process covering identify, protect, detect, respond, and recover. IMO Resolution MSC.428(98) requires this for vessels already inside ISM Code scope — commercial vessels, those carrying more than 12 passengers, vessels of 500 GT and over, and any vessel with individual flag-state requirements. Private superyachts outside that scope have no mandatory obligation, but insurers are increasingly asking for the same evidence at renewal. Captains and DPAs should settle what the SMS documents before assuming the network design is someone else's problem.
Does the IMO cyber rule actually apply to my yacht?
It depends on how the vessel is operated. SuperyachtNews on cyber security in the superyacht industry confirms that SOLAS defines ISM Code applicability as commercial vessels, those carrying more than 12 passengers, vessels of 500 GT and over, plus any additional flag-state requirements — and that while not every yacht is captured, cyber risk is relevant across the whole sector regardless of formal applicability. For vessels operating commercially and visiting US ports, Boat International's report on the IMO cyber security requirements notes that the US Coast Guard began enforcing the requirement for all commercial yachts and ships over 500 GT from January 1, 2021, regardless of flag, with authority to spot-check vessels and detain those with an inadequate or missing cyber security plan.
For privately registered yachts that sit outside ISM scope, the obligation is not written into class or flag paperwork — but that does not make the question irrelevant. A private yacht's management company may still choose to build an SMS-aligned cyber risk posture voluntarily, particularly because marine cyber insurance underwriters are now asking for evidence of a reasonable cyber risk posture at renewal, independent of whether ISM formally applies to that hull.
What does the SMS actually need to document?
Boat International's coverage of the IMO resolution lays out the five required steps plainly: identify the systems, assets, data, and capabilities that pose risk if disrupted, and assign roles and responsibilities; protect against human and technological threats with contingency planning; detect a cyber event in a timely manner; respond with plans that restore propulsion, navigation, networked onboard systems, or AV and communications; and recover by backing up and restoring affected systems. That last point matters for a yacht's technology stack specifically — AV entertainment and communications systems are named explicitly as part of what a response plan must address, not just navigation and propulsion.
This is a documentation exercise before it is a technical one. A yacht's technical manager or DPA should be able to point to a written inventory of onboard systems and a risk assessment that ranks them by consequence, not just a vendor's list of installed hardware. Ask your management company which document plays that role on your vessel, and who is named as responsible for keeping it current.
How should the onboard network be segmented to support that SMS?
Network segmentation is one of the concrete mitigations cyber risk assessments call for. On a DNV GL-hosted webinar covered by SuperyachtNews on cyber security in the superyacht industry, the example used was an Azipod propulsion and steering system: the consequence of compromise could be grounding or collision, the likelihood is elevated by high connectivity, USB ports, Ethernet connections, and routine software updates, and the recommended mitigation is logical network segregation alongside supplier requirements and crew drills.
That same logic applies to the AV and control network a yacht runs day to day. Crestron's own network design guidance is specific on this point: Crestron devices should be isolated on their own dedicated VLAN separate from other traffic, because Crestron control communication is latency-sensitive and relies on heartbeat packets to confirm connectivity — unrelated network traffic can disrupt that and degrade the user experience. Where a vessel also runs DM NVX for AV-over-IP distribution, Crestron's AV-over-IP network design guidance calls for its own isolated segment again, built with IGMP snooping and querier functions enabled, 802.1X device authentication, and Active Directory-managed administrative access, specifically to prevent unauthorized devices from joining the network or monitoring control traffic.
Segmentation at the WAN layer is a separate but related question. Peplink's defense-in-depth documentation describes guest network isolation that keeps guest users from reaching the router's administrative interface or other onboard devices, VLAN-based trust boundary separation between crew, guest, and administrative traffic, and centralized firewall and VLAN policy management across multiple devices through InControl. On a vessel running Starlink Maritime with Peplink cellular failover, these are the same controls a cyber risk assessment would expect to see documented as mitigations, not just configured and left unrecorded.
What should go in the inventory for remote access and logging?
A cyber risk assessment needs to identify which systems allow remote access and who holds the credentials. Crestron's control-system guidance lists the specific network ports a 4-Series control system listens on and connects to, and recommends security scans performed both with and without a running program loaded, to confirm whether a program introduces new exposure. That is the kind of concrete, testable item an SMS inventory should capture by name rather than by category. For connectivity, document who manages Peplink InControl access, how often the admin password rotates, and whether guest and crew VLANs are actually isolated from the control and camera networks — not assumed to be.
None of this replaces an independent cyber risk assessment calibrated to the vessel, which the SuperyachtNews piece on cyber risk in the SMS argues should remain separate from the connectivity provider's own commercial interest in the outcome. But a captain or DPA who can produce a written network diagram, a VLAN segmentation plan, and a remote-access log is already most of the way toward what the SMS process is designed to produce.
Cave Group designs and documents Crestron control and connectivity systems for yachts in build and refit, including the VLAN segmentation, Peplink multi-WAN configuration, and remote-access logging that a vessel's cyber risk documentation needs to reference. For vessels carrying forward an existing Crestron system, this is also a natural point to review during a scheduled refit.
Frequently asked questions
Does every superyacht need a documented cyber risk plan under IMO rules?
No. The ISM Code, and with it MSC.428(98)'s cyber risk requirement, applies to vessels used for commercial operations, those carrying more than 12 passengers, vessels of 500 GT and over, and vessels subject to individual flag-state requirements. A privately registered yacht outside that scope has no mandatory obligation, though insurers may still request evidence of a cyber risk posture.
What five steps does an IMO-aligned cyber risk plan need to cover?
Identify the systems and roles at risk, protect against human and technical threats with contingency planning, detect a cyber event in a timely manner, respond with plans covering propulsion, navigation, and networked systems including AV and communications, and recover by backing up and restoring affected systems.
Why does Crestron recommend a dedicated VLAN for control systems?
Crestron control communication relies on latency-sensitive heartbeat packets to confirm device connectivity, and unrelated network traffic can interfere with that signaling. Crestron's network design guidance recommends placing all Crestron devices on their own dedicated VLAN to prevent this interference and add a layer of network access control.
Can a US port authority detain a yacht over cyber security compliance?
Yes, for vessels within scope. The US Coast Guard has stated it will enforce the cyber security plan requirement for commercial yachts and ships over 500 GT visiting US ports from January 1, 2021 regardless of flag, with authority to detain vessels found to have an inadequate or missing cyber security plan.
Does segmenting guest Wi-Fi from the control network actually reduce risk?
Network segmentation is one of the mitigations cited in DNV GL's cyber risk assessment methodology for addressing elevated-likelihood threats from connected onboard systems. Peplink's documented guest network isolation and VLAN-based trust boundaries are designed to prevent guest or crew traffic from reaching administrative interfaces or other onboard devices.