Trust, Resilience and Cyber Security: Why SMI Chose Cyber Essentials Plus

The Society of Maritime Industries (SMI) is delighted to announce that it has successfully achieved CyberEssentials Plus certification. We were pleased to work with SMI member company Templar International Group on the Cyber Essentials Plus assessment. The process was rigorous, constructive and ultimately valuable in helping us strengthen our overall cyber posture and provide additional assurance to members, partners and stakeholders.

For many organisations, Cyber Essentials Plus is seen as a technical accreditation. For us, it was a strategic decision driven by governance, risk management and our responsibility to the members we serve.

The decision followed discussions with the SMI Board of Directors as part of a wider review of organisational risk. The Board recognised that cyber threats facing the maritime and defence sectors are becoming more frequent, more targeted and increasingly sophisticated. Alongside other areas of organisational resilience, cyber security was identified as an area where SMI should continue to strengthen its approach. Increased attention to cyber risk was specifically discussed as part of the Board's ongoing risk management work.

As a trade association, SMI is not a major defence contractor or critical infrastructure operator. However, we work closely with organisations that are.

Our membership includes many companies operating in defence, national security and critical supply chains. We regularly bring together industry leaders, government stakeholders and technology providers. Those trusted relationships are one of our greatest strengths, but they also bring responsibilities.

Cyber attackers are increasingly looking for indirect routes into organisations through trusted partners and supply chains. We believe organisations like SMI have a duty to demonstrate that the systems, processes and controls supporting those relationships are robust and regularly reviewed.

This was not our first step on that journey.

SMI has maintained Cyber Essentials certification for the past three years. Working with our IT provider, Axia, we renewed our Cyber Essentials certification before progressing to Cyber Essentials Plus.

Cyber Essentials Plus takes assurance a step further. While Cyber Essentials focuses on demonstrating that appropriate controls are in place, Cyber Essentials Plus independently tests those controls in practice through technical verification of systems, devices and configurations. The standard provides independent verification of controls relating to secure configuration, access management, malware protection, patching and network security.

To achieve certification, a representative sample of SMI devices underwent detailed technical assessment. Findings were reviewed and addressed before certification was awarded.

Importantly, the exercise reinforced an important lesson: cyber security is not a destination.

No organisation can ever claim to be completely immune from cyber threats. Technology evolves, attack methods evolve and business operations evolve. Effective cyber security is therefore about continuous improvement, regular challenge and maintaining good habits across an organisation.

That message is particularly relevant for the maritime sector. As maritime systems become increasingly connected, software-driven and data-enabled, cyber resilience is becoming as important as physical resilience. Recent SMI policy work has highlighted the growing importance of cyber security across defence and maritime supply chains, particularly as more innovative SMEs and technology companies become involved in delivering future capabilities.

For SMI, achieving Cyber Essentials Plus is a practical demonstration of our commitment to the standards we encourage across the wider industry. It gives our team greater confidence in the tools and systems we use every day. It gives members confidence that we take our responsibilities seriously. And it demonstrates our commitment to maintaining the trust that sits at the heart of the relationships we have built across the maritime sector.

SMI is grateful to Templar International Group for supporting our Cyber Essentials Plus assessment and to all members who continue to share expertise and good practice across the maritime sector.

Tom Chant MBE, Chief Executive, Society of Maritime Industries

"Good governance is about looking ahead and managing risks before they become problems. Our Board recognised that cyber security is increasingly a leadership issue, not simply an IT issue. Cyber Essentials Plus has helped us review our systems, strengthen our processes and provide additional assurance to members, partners and stakeholders that we take cyber security seriously."

Anu Khurmi, MD Global Services, Templar International Group

"Cyber security is often seen as a technical issue, but the organisations that are most resilient recognise that it is ultimately about people, processes, culture as well as technology. SMI approached Cyber Essentials Plus with a clear commitment to strengthening its overall security posture and providing reassurance to members and stakeholders. We were pleased to support them on that journey and congratulate the team on achieving certification."

Cyber security may not always be visible, but in an increasingly connected world it is one of the foundations on which trust is built. For SMI, achieving Cyber Essentials Plus is an important step in ensuring we remain a trusted partner for our members and a resilient organisation for the future. We encourage organisations of all sizes to review their cyber security arrangements and take advantage of the expertise available across the SMI membership community.

Looking for Support?

Cyber Essentials and Cyber Essentials Plus are increasingly common requirements across defence, government and critical infrastructure supply chains. For organisations considering certification or looking to strengthen their cyber resilience, expertise is available across the SMI membership.

Templar International Group - Global cyber security, risk management, technology, training and assurance services. Learn more about Templar International Group

NCC Group - Global cyber assurance, safety and risk management specialists. Learn more about NCC Group

Redbay - Cyber security consultancy helping organisations improve cyber resilience and security assurance. Learn more about Redbay