The handling of risk has been and is a requirement from the ISM code, what is new is that the IMO in 2017 identified cyber security as a risk and mandated verification of handling through the safety management system starting from the first annual DoC audit after 01.01.2021