KYA 1689/2025, ISM, BIMCO and TMSA crosswalk

Updated 24 October 2026

A Greek ship manager answers the National Cybersecurity Authority, the ISM auditor, the class society and the charterer. Much of their evidence overlaps. This table sets each requirement article of KYA 1689/2025 against the IMO's functional elements, the chapters of the BIMCO guidelines and the stages of TMSA 3 Element 13. It names the evidence that serves all of them.

The IMO functions are those of MSC-FAL.1/Circ.3/Rev.3, paragraph 3.5. The BIMCO references are chapters and sections of version 5. The TMSA stages follow DNV's summary of Element 13: stage 1 is documented threat identification, stage 2 mitigation in procedures and good practice among personnel, stage 3 regular updates and stage 4 innovative methods. Change management sits in TMSA Element 7.

KYA article	IMO function^[2]	BIMCO v5^[3]	TMSA 3 E13 stage^[4]	Same evidence
4 Obligations and accountability of the management bodies	Govern	1.2		Board approval of the measures
5 Risk management framework	Govern, Identify	4, 5, 6	Stage 1	The risk assessment and its method
6 Information security policies and procedures	Govern	1.5	Stage 2	The approved policy set
7 Roles, responsibilities and authorities	Govern	1.3		The security officer's appointment and the roles
8 Independent review of information security	Govern	6.3	Stage 3	The latest independent audit report
9 Compliance monitoring procedures	Govern	1.5	Stage 3	The record of compliance checks
10 Human resources security	Protect	7.3	Stage 2	Joiner, mover and leaver records
11 Hardware and software asset management	Identify	3.2	Stage 1	The asset register, shore and ship
12 Risk management of relationships with suppliers and ICT service providers	Govern, Identify	1.6, 1.7, 1.8		The supplier register and its assessments
13 Account management and access control	Protect	7.2, 7.3	Stage 2	The access policy and MFA settings
14 Secure configuration of hardware, software, services and networks	Protect	7.2	Stage 2	Configuration baselines and their checks
15 Secure application development principles	Protect	None of its own		The development procedure, where software is built
16 Change management	Protect	3.7, 7.3	Element 7	Change records, onboard software included
17 Vulnerability handling and disclosure	Identify	3, 7.2	Stage 1	Scan results and fix times
18 Assessment of the effectiveness of cybersecurity risk-management measures	Govern, Identify	6.2	Stage 3	Tests, the penetration test and the review of results
19 Network security	Protect	7.1, 7.2	Stage 2	The network diagram and the segmentation of IT and OT
20 Protection against malicious software	Protect, Detect	7.3, 8.2	Stage 2	Malware protection reports
21 Cybersecurity training and awareness	Protect	7.3	Stage 2	Training records, crew and shore
22 Use of cryptography	Protect	None of its own		The cryptography policy and TLS and certificate checks
23 Physical and environmental security	Protect	7.2, 7.3		Physical access and removable media controls
24 Cybersecurity incident management	Detect, Respond	8, 10		The incident register and the reports sent
25 Business continuity and crisis management	Govern, Recover	9, 10.3, 10.4		The impact analysis, recovery plans and their tests

For the scope questions behind the table, read NIS2 for Greek ship managers.

Sources

The same evidence for every audience

See the KYA assessment, the asset register and the incident register in Vardion, with sample data.

Book a demo

Read the guide