5.04Critical infrastructure

Maritime & Port Cybersecurity

OT and IT security assessment for port authorities, terminal operators and shipowners: port systems and the ship–shore interface, vessel cyber resilience against IACS UR E26 and E27, and the evidence Latvian port-facility inspections now check under the National Cybersecurity Law.

Book a consultation+371 2256 5353

In Latvia a port authority, and every large or medium company operating in a port territory, is an essential or important entity under the National Cybersecurity Law. Since December 2024 the port-facility security inspector checks cyber compliance during the ISPS assessment and reports gaps to CERT.LV (MK 790). The same law reaches shipping companies; the IMO requires cyber risk in the ISM safety management system, and ships contracted since 1 July 2024 must meet IACS UR E26 and E27.

Shore side, we assess terminal operating systems, gate and crane control networks, VTS and AIS feeds, port community systems and the connection to the unified vessel-tracking system Latvian ports introduced in 2026, with the same zone-and-conduit method as any OT site. Ship side, we assess a representative vessel in port within a 48-hour window: navigation and ECDIS, propulsion and power-management networks, cargo control, satellite and Starlink connectivity, crew networks and vendor remote access, mapped to the E26 requirements and the BIMCO cyber security workbook.

Baltic-specific risks are part of the scope: GNSS jamming and AIS spoofing, recorded in Latvian airspace 1,276 times in 2025, and the failure modes they trigger in bridge systems; espionage against maritime organisations reported by ENISA; and insider access, after the 2025 case of a ferry crew member charged with installing remote-control malware on ship systems. Two OffSeq specialists hold the NATO CCDCOE Critical Information Infrastructure Protection qualification.

IACS UR E26/E27
mandatory for ships contracted on or after 1 July 2024
1,276
GNSS interference cases recorded in Latvian airspace in 2025, up from 26 in 2022
Source: LGS, reported by BNN, opens in a new tab

Where we work in the Purdue model

Port systems map onto the Purdue levels like any industrial site, and a vessel’s networks follow the same layers, from the crew and business network down to engine and cargo controllers.

  • Actively tested
  • Passive capture and configuration review
  • Spares, replica lab or bench only
  • Out of scope

Enterprise zone · IT

  1. 5

    Enterprise network

    Corporate IT, identity, email, cloud and internet access

    Actively tested

    Port authority and shipping-company IT, crew networks and internet exposure.

  2. 4

    Site business systems

    ERP, scheduling, logistics and site IT

    Actively tested

    Terminal operating system, port community system and ship–shore data exchange.

Industrial DMZ

  1. 3.5

    Industrial DMZ

    Jump hosts, remote-access gateways, patch servers, historian replicas

    Actively tested

    Vendor remote access and satellite and Starlink links into port and vessel OT.

Industrial zone · OT

  1. 3

    Site operations

    Historians, MES, OT domain controllers, engineering workstations

    Passive capture and configuration review

    Crane, gate and VTS servers ashore; integrated bridge and engine-room networks aboard.

  2. 2

    Supervisory control

    SCADA servers, HMIs, alarm and operator stations

    Passive capture and configuration review

    Crane HMIs, ECDIS, power-management and cargo-control consoles.

  3. 1

    Basic control

    PLCs, RTUs and IEDs; safety systems sit in a zone of their own

    Spares, replica lab or bench only

    Crane, gate and onboard controllers, tested only on spares.

  4. 0

    Physical process

    Sensors, actuators, drives and valves

    Out of scope

    Never touched; propulsion, steering and cargo handling stay with the crew.

How it works

  1. 01

    Scope & regulatory map

    Which entities, vessels and terminals are in scope, and which rules apply to each.

  2. 02

    Port assessment

    Zones and conduits across terminal, gate, crane and traffic systems; exposure and remote access.

  3. 03

    Vessel assessment

    A representative vessel in port, in an agreed window: bridge, engine, cargo and connectivity networks.

  4. 04

    Testing

    Conduit and system testing at the agreed tier; equipment tested on spares where a live system cannot be touched.

  5. 05

    Reporting

    E26 and National Cybersecurity Law gap register, ISPS cyber annex, remediation plan and evidence for inspectors and class.

Packages

Port Facility Assurance
National Cybersecurity Law gap assessment and ISPS cyber annex for one port facility or terminal.
Port OT AssessmentPopular
Full zone-and-conduit assessment and testing of port operational systems.
Fleet Programme
Representative-vessel assessments across a fleet with E26 evidence for class and ISM audits.

Supported by our own threat-intelligence platform

Between assessments, the port and its terminals stay under watch.

Experience this scenario interactively

A hands-on 3D simulation of this threat, followed by an explanation of how we test it in a real engagement.

Red team · PhishingIdentify a phishing emailInspect a suspicious email, including the sender, links and urgency cues, and decide whether to report it or proceed.Open simulationFraud · BECIdentify invoice-redirection fraudA message appearing to come from a known supplier requests new bank details for a genuine invoice. Verify the change before making the payment.Open simulation
All simulationsGet certified at training.offseq.com, opens in a new tab

Frequently asked questions

A port authority and a large company operating in a port territory are essential entities; a medium-sized one is an important entity. Shipping companies are covered in the same way. The first step of every engagement is a written scoping of which of your entities, terminals and vessels the law reaches and what each has to evidence.

Helpful tools

What clients say about working with us

SaaS
“Instead of slowing us down, they seamlessly integrate with our fast-moving engineering team, providing proactive, high-level insights that let us fortify our systems in real time as we grow.”

Karlis Broders

CTO · Trace.Space

Fintech
“Partnering with OffSeq on a red team engagement gave us a genuine adversarial perspective that went well beyond a traditional penetration test.”

Oskars Zīle

CISO · Eleving Group

E-commerce
“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”

Oskars Podziņš

Head of Information Security · Printful

All services

Scope a test

[email protected]+371 2256 5353

Direct access to a senior specialist · Reply within 24 hours · NDA available on request

Scope a testGet in touch