Mapping legend
| NIST CSF 2.0 | Function | ISM Code mapping | MSC.428(98) / MSC-FAL.1 Circ.3 | On the vessel |
|---|---|---|---|---|
| Loading crosswalk… | ||||
Methodology
Each row is a practitioner interpretation of how a NIST CSF 2.0 subcategory maps to the ISM Code, IMO MSC.428(98), IMO MSC-FAL.1/Circ.3/Rev.3, and BIMCO guidance. Where the relationship is not direct, the row records a partial fit or a gap rather than forcing a false equivalence.
This is not a legal opinion or a substitute for the authoritative text. Use the row as a cross-reference and verify the relevant clause before relying on it in an SMS, DOC audit, class review, or regulatory response.
Primary sources
- NIST Cybersecurity Framework 2.0 (Feb 2024) — nist.gov/cyberframework
- IMO MSC.428(98) — Maritime Cyber Risk Management in Safety Management Systems (adopted June 2017, in force 1 Jan 2021)
- IMO MSC-FAL.1/Circ.3/Rev.3 — Guidelines on Maritime Cyber Risk Management (April 2025) — imo.org
- ISM Code — IMO Resolution A.741(18), as amended
Every mapping in this table is a practitioner interpretation cross-referencing the instruments above. Rows marked gap indicate a subcategory with no strong direct ISM Code equivalent — flagged, not smoothed over. Verify against current primary text before relying on any row for an actual SMS, DOC audit, or class review.