MASS UK Industry Conduct Principles and Code of Practice 2022 (V6)

“Malware” is a generic term for a variety of malicious software, which can infect computer systems and impact on their
performance.
6 Safety Management
“Operational technology (OT)” includes devices, sensors, software and associated networking that monitor and control
onboard systems.
“Patches” are software designed to update software or supporting data to improve the software or address security
vulnerabilities and other bugs in operating systems or applications.
6.1 OBJECTIVE
“Phishing” refers to the process of deceiving recipients into sharing sensitive information with a third party.
“Principle of least privilege” refers to the restriction of user account privileges only to those with privileges that are
essential to function.
“Producer” is the entity that manufactures the shipboard equipment and associated software.
The objective of this Chapter is to provide guidance on the requirements for Safety Management
systems for MASS operations to meet the provisions of the IMO instruments.
6.2 SCOPE
“Recovery” refers to the activities after an incident required to restore essential services and operations in the short
and medium term and fully restore all capabilities in the longer term.
“Removable media” is a collective term for all methods of storing and transferring data between computers. This
includes laptops, USB memory sticks, CDs, DVDs and diskettes.
“Risk assessment” is the process which collects information and assigns values to risks as a base on which to make
decision on priorities and developing or comparing courses of action.
“Risk management” is the process of identifying, analysing, assessing and communicating risk and accepting, avoiding,
transferring or controlling it to an acceptable level considering associated costs and benefits of any actions taken.
6.2.1 The objectives of this Code are to ensure safety at sea, prevention of human injury or loss of life, and avoidance
of damage to the environment, in particular to the marine environment and to property. This can be successfully
implemented by the use of a Safety Management System (SMS) as part of the management and operation of
MASS.
6.2.2 The purpose of this Chapter is to provide guidance on how to develop and implement an effective SMS for MASS.
6.3 GENERAL
6.3.1 Safety management objectives of the Operator should provide for:
“Sandbox” is an isolated environment, in which a program may be executed without affecting the underlying system
(computer or operating system) and any other applications. A sandbox is often used when executing untrusted software.
“Service provider” is a company or person, who provides and performs software maintenance.
“Social engineering” is a method used to gain access to systems by tricking a person into revealing confidential
information.
n Safe practices in MASS operation and a safe working environment;
n Assess all identified risks to the MASS, personnel and the environment and establish appropriate safeguards;
and
n Continuously improve safety management skills of personnel ashore and aboard MASS, including preparing
for emergencies related both to safety and environmental protection.
6.3.2 The safety management system should ensure:
“Software whitelisting” means specifying the software, which is present and active on an IT or OT system.
“Virtual Local Area Network (VLAN)” is the logical grouping of network nodes. A virtual LAN allows geographically
dispersed network nodes to communicate as if they were physically on the same network.
n Compliance with rules and regulations; and
n That applicable Codes, guidelines and standards mandated or recommended by the International Maritime
Organisation, administrations (e.g. The MCA), Classification Societies (e.g. Lloyds Register) and maritime
industry organisations are taken into account..
“Virtual Private Network (VPN)” enables users to send and receive data across shared or public networks as if their
computing devices were directly connected to the private network, thereby benefiting from the functionality, security and
management policies of the private network.
“Virus” is a hidden, self-replicating section of computer software that maliciously infects and manipulates the operation
of a computer program or system.
“Wi-Fi” is all short-range communications that use some type of electromagnetic spectrum to send and/ or receive
information without wires.
6.3.3 Every Operator should develop, implement and maintain a safety management system, which includes the
following functional requirements:
n A safety and environmental-protection policy;
n Instructions and procedures to ensure safe operation of MASS and protection of the environment in
compliance with relevant international and Flag State legislation;
n Defined levels of authority and lines of communication between, and amongst, shore and MASS personnel;
n Procedures for reporting accidents and non-conformities with the provisions of this Code;
n Procedures to prepare for and respond to emergency situations; and
54
MASS UK Industry Conduct Principles and Code of Practice Version 6
MASS UK Industry Conduct Principles and Code of Practice Version 6 55