On-Board Cyber Security Testing for BV Cyber Managed Prepared Notation — HHI Hull 3371

## Overview

UFEED performed the on-board cyber security test for **HHI Hull No. 3371**, a 174,000 CBM Class LNG Carrier (MEGA) — part of a sister-ship series that also includes Hulls 3371, 8188, and 8189 — as part of the vessel's certification for **Bureau Veritas' Cyber Managed Prepared notation**. The test was carried out on board on **March 20, 2025**, following the Cyber Security Test Plan (Dwg. No. 6N-7000-505) developed for the vessel.

The purpose of the notation is to confirm that Level 3 systems — those defined as critical in the vessel's Cyber Handbook — are installed, configured, and operating in a normal and safe state, with test results delivered as formal evidence of compliance.

## Systems Covered

Under the vessel's system classification (ONE/INE/SNE/L3S/OVS), the following Level 3 systems and their associated security network equipment were included in the test scope:

- **No.1 ECDIS / No.2 ECDIS / VDR** — navigation and voyage data recording, including VDR firewall

- **IAS (Integrated Automatic System)** — supplied by Kongsberg, machinery system automation with dedicated firewall

- **ISS (Integrated Smart Ship Solution)** — supplied by HMS, with dedicated firewall

- **VSAT System** — satellite communication, supplied by SK Telink, with dedicated firewall

## On-Site Test Schedule

The on-board test was run as a single-day sequence, moving system by system through the day:

| Time | Activity |

|---|---|

| 09:00–12:00 | IAS (Kongsberg) |

| 12:00–13:00 | Lunch break |

| 13:00–14:00 | VSAT (SK Telink) |

| 14:00–15:30 | Navigation (JRC) |

| 15:30–16:30 | ISS (HMS) |

| 16:30–17:00 | Wrap-up meeting |

Each equipment supplier attended their respective time slot, allowing UFEED to run the required test procedures directly against live systems with the relevant vendor engineer present to confirm results and resolve any findings on the spot.

## Test Procedure Structure

For each system, the test plan applies a consistent set of checks across three categories:

**Monitoring procedures**

- Physical interfaces — confirming the network topology diagram matches actual installed equipment and wiring

- Networks — verifying routes, network services, and equipment security mechanisms where applicable

- Security equipment — checking firewall configuration and connection status

- Remote access — confirming remote access can be properly permitted or blocked, where applicable

- Log events — checking audit log records and firewall event logs

- Accounts — verifying password and account conditions on each system

**Maintenance procedures**

- Updating — confirming current software version

- Antivirus — checking anti-virus solution status, where applicable

- Accounts — verifying password/ID management

**Incident response procedures**

- Backup — confirming the latest backup file version, where applicable

- Restore — confirming the latest installed program version, where applicable

Not every check applies to every system — for example, VSAT is exempt from the backup/restore checks, and remote access checks are not applied to IAS or ISS — reflecting how the test plan is tailored per system rather than applied as a blanket checklist.

## Why It Matters

This on-board test illustrates how cyber resilience verification continues well beyond initial design approval and shipyard delivery. Even after a vessel's Cyber Handbook, inventory, and criticality assessment have been approved, the Cyber Managed Prepared notation requires a coordinated, system-by-system on-site test — run with each equipment supplier present — to confirm the vessel actually operates as documented.

For UFEED, executing this kind of multi-vendor, single-day test schedule across navigation, automation, communication, and smart-ship systems reinforced the operational playbook built through earlier UR E26/E27 assessment work, and reflects the kind of on-site coordination UFEED brings to class-witnessed cyber security testing on complex newbuildings like LNG carriers.