What are the Objectives of ISM Code for Shipping Industry?

The ISM Code was created in the 1980s following serious marine accidents that cost lives, damaged ships and polluted the sea. Those accidents were caused by human error on board and management errors on the ground, and the maritime sector needed a comprehensive review to stop such incidents from happening again.

What the Code sets out to do fits in one breath: safety at sea and across the marine industries, no loss of life, no harm to the environment in general or the marine environment in particular. Its main objectives today are to establish international standards and rules for the safe management and operation of ships, and for the prevention and control of pollution.

Those rules are written in broad language and can be applied in various situations. Different levels of management, both on land and at sea, need different levels of experience and understanding of these elements.

What is an Information Security Management System (ISMS)?

An Information Security Management System (ISMS) is a structured approach to handling sensitive company information so that its confidentiality, integrity and availability hold. It gives an organization a framework for identifying, assessing and managing information security risks.

Protecting an organization's information assets from cyberattacks, unauthorized access and security incidents is what it exists for. Run an ISMS and you can ensure that appropriate controls are in place to reduce risk and to meet the security requirements of stakeholders: customers, partners, regulators.

None of it is purely technical. An ISMS runs on technical measures, but also on organizational controls, physical controls and access control policies, and by continually monitoring and improving it, an organization can ensure its security measures stay effective as security threats and business needs evolve.

Confidentiality, integrity and availability fail in different ways

Confidentiality is keeping sensitive information away from unauthorized access and disclosure, personal data and company data alike. It loses to unauthorized access, data breaches and cyberattacks. You hold it with access control policies, with encryption and password protection, and by training employees regularly on data protection practices. Hold it and you keep the trust of customers and partners, stay inside privacy laws, and keep your intellectual property yours.

Integrity covers the accuracy and completeness of information, plus the absence of changes nobody authorized. Data tampering, malicious modifications and unauthorized changes are what it faces. Security controls, data backups, and regular testing and validation of the data are how it is maintained, and what comes back is confidence that the data is accurate, protection against fraud or tampering, and compliance with industry regulations.

Availability means making sure information and systems can be accessed and operated when they are needed. System failures, natural disasters and cyberattacks take it away. Backup systems, redundancy and failover measures, and regular maintenance and updates keep it. The return is business operations that do not stop, customers who stay satisfied, and downtime held to a minimum.

Focus on all three and an organization can create a strong, comprehensive information management system to protect its information assets and reduce the risks of data breaches and other security incidents.

What the Code actually asks of a company

The main objectives of the ISM Code for the shipping industry are to:

• Ensure safety at sea around the world.
• Prevent injury or death to people at sea.
• Avoid negative impacts on the environment.
• Take care of the marine environment and property.

For companies, the safety management objectives it defines get more specific:

• Ensure safe ship operations and working conditions.
• Take measures to counter any identified threats.
• Continuously improve the safety management capabilities of personnel on land and on board, including their ability to prepare for environmental and safety emergencies.

On board, the crew safety and management system has to deliver compliance with all applicable laws and regulations. The rules, principles and standards adopted by organizations, departments, classification societies and marine industry groups must also be followed.

Who must comply with the ISM Code

Every commercially registered yacht over 500 gross tons must comply with the ISM Code. Commercial vessels under 500 gross tons but over 24 meters in length must use the "Mini-ISM System" instead, a safety management system that meets the standards of the flag state.

Building an effective safety management system can be complex, so hiring experienced management software experts is necessary. The relevant flag states where the ship sails accept Divergent Yachting's SMS and provide a compliance document (DOC), and that document is what allows Divergent Yachting to operate the ISM system.

Below 500 GT, an SMS is not mandatory for private vessels, though more and more private yachts now comply voluntarily to lift the overall safety and environmental standards on board. Safety management built on the ISM Code is essential to those boats too, and by the requirements and objectives of the Code, shipowners and shipping companies must all have a sound ship management system.