Cyber security for ISPS port facilities
Since 1 November 2026 the Ministry of Infrastructure and Transport (MIT) circular “Sicurezza della Navigazione” SG no. 177/2025 has been in force: cyber risk becomes part of the PFSA and the PFSP. We help port facilities integrate it without redoing from scratch what they already have, especially if they are NIS2 entities or included in the National Cyber Security Perimeter.
One incident, several obligations
In a port facility, the tools used by security staff are also networked digital systems: access control, CCTV, intrusion detection, radio. A successful attack can leave a gap open without anyone noticing.
For a facility that is a NIS2 entity and included in the PSNC, the same event is both a maritime security incident and a cyber incident, to be notified under the PSNC if it involves an ICT asset of the Perimeter, or under NIS2 in other cases. The circular considers compliance with Legislative Decree 138/2024 suitable to satisfy Regulation (EC) 725/2004 and the ISPS Code, but requires the PFSA and PFSP to refer expressly to the NIS2 assessment and measures.
- IT systems: email, ERP, supplier portals, PFSP documents
- Process OT: DCS, ESD/F&G, loading and unloading systems and ship-shore link systems
- Security systems: badges and turnstiles, CCTV/VMS, perimeter intrusion detection, communications with ships, tugs and the Coast Guard
What we do
We work with the PFSO and with the facility’s cyber manager. We start from the risk assessment and the NIS2 measures already approved and carry them over into the ISPS documents, so that the same control is not described and checked twice.
The circular introduces the CyPFSO, responsible for the cyber protection of the facility: the CyPFSO works with the PFSO and does not replace them. From 26 November 2026 we can take on the CyPFSO role for the facility directly, with the training required by §7 of the circular: ISO/IEC 27001 Lead Auditor qualification and the Duties course (IMO Model Course 3.24). Alternatively, we support the in-house CyPFSO with the appointment, the training and the work.
- Cyber annex to the PFSA (§5.5): systems linked to physical vulnerabilities, mitigation and recovery plan, reference to the NIS2 risk methodology
- Cyber procedures in the PFSP: switch to manual measures, access to IT/OT rooms, supplier technicians, measures at security levels 2 and 3
- CyPFSO role entrusted to us from 26 November 2026, or support for the in-house CyPFSO
- Cyber training for facility personnel (§7)
- Joint PFSO–CyPFSO cyber drill or exercise (§8)
- Cyber checks within ISPS audits (§9)
- Incident reporting flow (§10)
The supplementary module for personnel with security duties
In the ISPS courses for personnel with specific security duties (IMO Model Course 3.24) that we have examined, the cyber part describes who may attack and what the targets on board are, but does not cover the OT systems of a port facility, NIS2, PSNC and IMO guidelines, nor how to recognise a cyber incident, whom to report it to and how quickly. Our module covers this part.
Audience: access control, surveillance and security control room staff identified in the PFSP, the PFSO and deputies. A 1-hour version can be used for the cyber familiarisation of the rest of the personnel, which the circular requires to be specific to the facility and completed within 7 days of taking up the post.
| Block | Content | Minutes |
|---|---|---|
| 1 | Why cyber matters for ISPS security: SG 177/2025, NIS2, PSNC; real cases | 30 |
| 2 | The facility’s IT, OT and security systems; roles of PFSO, CyPFSO and CISO | 30 |
| 3 | Scenarios and warning signs: phishing, unannounced technicians, unknown devices, abnormal CCTV, GNSS/AIS interference, ransomware | 45 |
| 4 | Ten operating rules for the shift and measures by security level | 30 |
| 5 | Reporting: what to say, to whom, how quickly; switch to manual procedures | 30 |
| 6 | Tabletop: CCTV blacked out during a berthing | 45 |
| 7 | Learning assessment and course evaluation | 30 |
The full module lasts 4 hours and ends with a multiple-choice test on scenarios and the reporting flow. Attendance sheet, test, certificate and training material are handed over for filing with the PFSP training records.
The circular provides for the cyber training of personnel to be delivered by the CyPFSO: when the role is entrusted to us we deliver it directly; otherwise we design it and deliver it together with the facility’s CyPFSO. The test pass mark, the measures for levels 2 and 3 and the block durations are our proposal, to be validated with the facility and with the Designated Authority.
One internal report, then the external notifications
Staff are not asked to diagnose the incident, but to recognise it and report it immediately to the PFSO and the CISO or the incident response service. External notifications are handled by the CISO and the CSIRT contact person, in coordination with the PFSO.
For the facility’s cyber incidents the circular refers to Legislative Decree 138/2024 and requires them to be reported without delay also to MIT – Office 3 Maritime Security and to the port’s Designated Authority.
- CSIRT Italia – PSNC: 6 hours or 1 hour for incidents on ICT assets of the Perimeter, according to the table in DPCM 81/2021; this notification also counts as the NIS2 notification (Art. 33 of Legislative Decree 138/2024)
- CSIRT Italia – NIS2: for significant incidents on other systems, early warning within 24 hours, notification within 72 hours, final report within one month
- MIT Maritime Security and the port’s Designated Authority: without delay
How we work
The work is carried out by the 823 Consulting staff, coordinated by Giacomo Pesce, CISO and CSIRT contact person at a NIS2 essential entity included in the Perimeter, ISO/IEC 27001 Lead Auditor. Exercises are based on the War Room format, which can be used for the PFSP cyber exercise if the scenario comes from the facility’s risk assessment, if the PFSO and CyPFSO take part and if it is recorded like the others; its use must be confirmed with the Designated Authority.
- Survey: PFSA, PFSP, NIS2 assessment and measures already in place
- Addendum: cyber annex to the PFSA and cyber procedures in the PFSP
- Training: 4-hour module and 1-hour familiarisation
- Exercise: a quarterly drill dedicated to a cyber scenario
- Review: after incidents, exercises and audits
The PFSA and PFSP need updating
For facilities not subject to NIS2, the addenda must be prepared and approved by 31 December 2026; for those subject to it, the NIS2 deadlines apply, with the express reference to the assessment and measures. Tell us where you stand: we will tell you what is missing and what can be reused.