MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

17.3.2 The MASS should be provided with a MASS Security Alert System.
17.3.3 The MASS Security Alert System, when activated, should transmit a MASS-to-shore security alert to a competent
authority designated by the Administration, identifying the MASS, its location and indicating that the security of
the MASS has been compromised.
17.5 MASS SECURITY PLAN
17.5.1 The MASS Owner/Operator should ensure that each vessel has a MASS Security Plan approved by the
Administration.
17.3.4 The MASS Security Alert System should be capable of being activated from the control station immediately by
personnel charged with the MASS’s navigation or supervision.
17.5.2 The submission of the MASS Security Plan for approval should be accompanied by the MASS Security
Assessment on the basis of which the plan has been developed.
17.3.5 There should be protection from third-party interference with MASS communications.
17.5.3 The plan should be in the working language of the MASS RCC and should include the following:
17.3.6 There should be a mechanism by which, in the event of third party communications interception, either the
command of the MASS’s shore-based personnel may reassume communications or, alternatively, shut down the
MASS’s operations, where it is thought safe to do so by the Master.
17.3.7 There should also be a mechanism for safely shutting MASS communications down when the security of the
control station centre has been compromised.
17.3.8 The MASS hull/chassis must have a means of indicating:
n That it is certified as compliant with the security requirements of the issuing authority;
n The means by which the MASS’s Remote Control Centre may be contacted;
n Any other practical security-related information.
17.3.9 The MASS Remote Control Station should be secure. Reference should be made to the relevant guidance and
regulations of ensuring the security of land facilities.
17.4 MASS OWNER/OPERATOR OBLIGATIONS
17.4.1 The MASS Owner/Operator should undertake a MASS security assessment. The MASS security assessment
should include a security survey of both the MASS hull itself but also the MASS Control Station. It must include:
n Identification of existing security measures, procedures and operations in respect of both physical and cyber
intrusion;
n Identification and evaluation of critical MASS and shore-based operations that it is important to protect;
n Identification of possible threats, both physical and cyber, to the key MASS operations and the likelihood
of the occurrence in order to prioritise security measures;
n Identification of weakness, including human factors, in the infrastructure, policies and procedures.
17.4.2 The MASS security assessment should be documented, reviewed, accepted and retained by the MASS
Owner/Operating Company.
n Measures to prevent dangerous substances being taken on board the MASS or into its RCC;
n Identification of the restricted areas and measures for the prevention of unauthorised access to those areas,
both on the vessel and in the MASS control station;
n Measures to reduce the risk of compromise of MASS cyber-security;
n Measures to prevent unauthorised access to restricted areas on the vessel or at the control station;
n Procedures for responding to threats of security breaches, including provisions for maintaining critical
operations of the MASS or, as the case may be, shutting them down;
n Procedures for responding to any security instructions made by port authorities;
n Duties of shore-based personnel assigned security responsibilities;
n Procedures for auditing the MASS security activity;
n Procedures for training, drills and exercises associated with the plan;
n Procedures for the interfacing with port facility security activities;
n Procedures for periodic review of the plan;
n Procedures for reporting security incidents;
n Identification of the MASS security officer;
n Identification of the Company security officer, including 24-hour contact details;
n Procedure for ensuring, testing, calibration and maintenance of security equipment on the MASS and that
located in the control station;
n Frequency for testing, calibration and maintenance of security equipment on the MASS and that located in
the control station;
n Procedures, instructions and guidance on the use of the ship security alert system, including the testing,
activation, deactivation and resetting of that system.
17.6 RECORDS
17.6.1 Records of the following activities should be maintained at the control station as follows:
n Training drills and exercises;
n Security threats and incidents;
n Breaches of security;
n Changes in security level set by the Administration;
n Communications relating to the direct security of the MASS such as the specific threats to the MASS
or its RCC;
n Internal audits and reviews of security activities;
n Periodic review of the ship’s security activities;
n Periodic review of the ship security assessment;
n Periodic review of the ship security plan;
n Implementation of any amendments to the plan;
126
MASS UK Industry Conduct Principles and Code of Practice Version 6
MASS UK Industry Conduct Principles and Code of Practice Version 6 127