MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

Table 5-1 Remote Control Centre
Table 5-1 Vessel
Domain Sub Domain Threat/Attack Vector Mitigation procedure
CREWED
Access Control policy
Keycards
Domain Sub Domain Threat/Attack Vector Mitigation procedure
Security zoning depending on role
Security patrols during quiet times
Security cameras/recording and
erasing policy
Regular log of events
Personnel
See Domain 1
on page 38
Remote
Control
Centre
Building
security
Equipment
Access Control
Security
Security breach procedure
Reference list of emergency contact
numbers
Duty call out register
Procedures to follow in an emergency
Separate recreation area where staff
can access net for social media for
personal access - not connected to
operational networks
Robust IT/OT policy, encryption,
regular tests
IT and communications equipment,
servers and routers
In secure, access controlled location
Regular security exercises to check
staff responses
Monitor for unusual activity/response
Consider segmenting network to
ensure that staff net access is not
connected to operational systems
Regular checks to ensure no devices
have been added
Regular system scans for run
authorised software
System components specifically
designed to be integrated to ensure
correct functionality
Back-up power supplies
Alternative networks available
Vessel
UNCREWED
Vessel Access
See Building
security in
Domain 2
on page 39
Equipment
See equipment
section on
page 39
Operations
See operations
in Domain 2
on page 39
Shoreside security
Appropriate control for emergency
services, pilots etc
Secure dockside location with
access control
Domain Sub Domain Threat/Attack Vector Mitigation procedure
Equipment security
Control, network, and communications
equipment located in secure, access
controlled compartments
Equipment Specification
Suitable spare equipment level
maintained
Ensure equipment compliance with
appropriate standards for cyber/
communications etc
Ensure adequate cooling
Ensure adequate fire suppression
system
Robust access and security policy
Appropriate training and qualifications
Maintain environment appropriate to
operations
Vessel
As for Crewed
above
Prior to deployment
Full system checks and inspection for
unusual devices
Full IT and communications system
checks for normal operations and
control
Full system checks and inspection for
unusual devices
Operations
Adequate back up control positions
Reserve controllers available in event
of illness etc
Post deployment
Full IT and communications system
checks for normal operations and
control
No unauthorised "Smart" devices in
the operations area
Equipment logs for equipment, serial
no. etc
Analyse all activity logs for anomalies
44
MASS UK Industry Conduct Principles and Code of Practice Version 6
MASS UK Industry Conduct Principles and Code of Practice Version 6
45