KPI-Based Evaluation Framework for Cyber Resilience of Ships

Advancements in information and communication technologies have improved operational efficiency in the maritime industry through the integration of operational technology and information technology systems. However, this integration increases external network interfaces, exposing ships to greater cyber threats. Operating in isolated environments far from ports, ships face challenges in responding to cyberattacks and securing timely technical support. As a result, cyber resilience has become a critical concept in the maritime domain. To address these challenges, organizations like the International Maritime Organization and classification societies have issued guidelines. The International Association of Classification Societies introduced Unified Requirements E26, specifying minimum technical requirements to enhance ship cyber resilience. However, Unified Requirements E26 falls short of adequately reflecting the operational environment of ships and does not sufficiently address managerial and operational factors, limiting its effectiveness in evaluating ship cyber resilience. This paper proposes a KPI-based framework to evaluate ship cyber resilience. Seven evaluation domains—Govern, Identify, Protect, Detect, Respond, Recover, and Adapt—were identified to encompass technical, managerial, and operational aspects. Using the SMART methodology, 18 measurable Key Performance Indicators were developed to enable comprehensive resilience evaluation. The proposed framework addresses existing guidelines’ limitations and provides a systematic tool for assessing and improving maritime cyber resilience. This contribution enhances the safety and security of the maritime industry by aligning resilience evaluation with ship-specific operational characteristics.