The common misread
The mistake ETOs make is treating MSC.428(98) as a standalone cyber regulation — a separate compliance box to tick, distinct from the Safety Management System. It is not. The resolution works entirely through the ISM Code: it does not create a new certificate, a new audit regime, or a new document. It tells flag states and companies that cyber risk must be addressed within the existing SMS framework.
If your vessel's SMS does not reflect how cyber risk is identified, assessed and managed, the SMS is deficient — not some separate cyber policy.
What the resolution actually says
MSC.428(98) was adopted at the 98th session of the Maritime Safety Committee in June 2017. Its operative effect is straightforward: cyber risk management must be incorporated into the Safety Management System. The deadline set was the first annual Document of Compliance (DOC) verification on or after 1 January 2021. DOC verifications are conducted on the company, not the individual ship, so it is the company SMS that must demonstrate compliance.
The resolution does not specify a particular cyber framework or prescribe technical controls. That prescriptive gap is intentional — IMO guidance documents such as MSC-FAL.1/Circ.3 sit alongside the resolution to offer methodology, but the resolution itself is the hook that makes cyber risk an ISM matter.
Why the ISM hook matters for the ETO
Because cyber risk now sits inside the SMS, it is subject to ISM audit findings. A deficiency in cyber risk management is an ISM non-conformity, carrying the same weight as any other SMS failure. The ETO is the officer most likely to be questioned during a Port State Control or company audit about how the vessel identifies and manages risks to navigation, propulsion control, power management and communication systems — all of which may have cyber-relevant components.
Flag state implementation
IMO resolutions are not self-executing; they require flag state implementation. Cayman Islands Maritime Authority, for example, issued Guidance Note 07/2019 Rev 1 directing ISM-certified Cayman-flagged ships to include cyber risk management in the SMS in accordance with MSC.428(98). ETOs serving on flag-state-specific vessels should locate and read their flag's equivalent guidance, since it may carry additional or clarifying requirements beyond the IMO baseline.
Practical consequence
The deadline has passed. Any vessel with an ISM DOC issued after the first 2021 verification should have cyber risk embedded in its SMS. Where the ETO finds it absent or superficial — a generic one-page statement rather than a risk-based process — that is a gap the ETO can, and should, raise through the non-conformity reporting pathway the SMS itself provides.