The first report can preserve the next choice
A useful first response limits further interaction, protects safe operation and preserves observations for the responsible team.
In 30 seconds
- Stop the suspicious interaction and report through the ship’s established procedure.
- Record time, asset, observed symptoms and recent actions; keep sensitive evidence within approved channels.
- Isolation or shutdown of operational equipment needs a safety assessment and appropriate authority. Do not improvise a power-off or reinstall.
Make it concrete
At 14:20 a shared PC shows a ransom message after an attachment was opened. Practise a report stating facts, avoiding an unverified claim about who caused it.
- 01Stop / safeguard
- 02Record
- 03Report
Check your understanding
Should the first report distinguish observations from assumptions?
- Stop the suspicious interaction and report through the ship’s established procedure.
- Record time, asset, observed symptoms and recent actions; keep sensitive evidence within approved channels.
- Isolation or shutdown of operational equipment needs a safety assessment and appropriate authority. Do not improvise a power-off or reinstall.
Go to the source
- Course notes · ThS. Nguyễn Duy Hiếu · An ninh mạng trên tàu biển cho thuyền viên ↗
- IMO · Maritime cyber risk ↗
Sources reviewed: 13.09.2026