Compliance and frameworks

ISPS Code — International Ship and Port Facility Security

What it requires. Based on international agreements, all international shipping and ports are regulated by the ISPS Code, defined by the IMO. The Code sets regulations and directions to protect international shipping from security-related incidents, and because every port is unique, it must be adapted to specific operational requirements. In the EU, large parts of the ISPS Code were made mandatory for port security by directive, implemented in Denmark through the Executive Order on Port Security.

How Honnimar supports it.

• Full support for the Code's three-level security framework (MARSEC levels).
• ISPS documentation created and maintained inside hierarchies — one document can cover several ISPS sites or a single one.
• Granular access control within those hierarchies.
• Access to ISPS documentation from any device, online and offline.
• Data integrity at every level, as a data-first application.

ISM Code — International Safety Management

What it requires. Set by the IMO, the ISM Code provides general principles and objectives for maintaining high standards of safety and environmental protection. As with the ISPS Code, the requirements must be adapted to fit each individual port.

How Honnimar supports it.

• Safety and environmental protocols maintained with seamless integration and version control.
• A dashboard giving full control of all documents.
• A user interface based on the Microsoft 365 infrastructure your organisation already uses.
• Access from PC, tablet and mobile app, so the right information reaches the relevant personnel.

ISO 22301 — Business Continuity Management

What it requires. A management system for business continuity: documented scope and objectives, roles and responsibilities, business impact analysis and risk assessment, continuity strategies and solutions, plans and procedures, an exercise programme, and evaluation and improvement. ISO 22313 provides guidance on applying it.

How Honnimar supports it.

• Emergency and continuity plans as structured, version-controlled documents in one hierarchy.
• Documented role and responsibility assignment attached to actions rather than to individuals.
• Exercise support: table-top and live exercises run on the production configuration, with the logged timeline as the evaluation input.
• Continuous improvement: the after-action record and the plan revision sit in the same system, so the loop actually closes.

IMO maritime cyber risk management — MSC-FAL.1/Circ.3/Rev.3

What it requires. The revised Guidelines on Maritime Cyber Risk Management were approved by the Maritime Safety Committee at its 108th session (May 2024) and issued as MSC-FAL.1/Circ.3/Rev.3 on 4 April 2025. The Guidelines provide high-level recommendations for safeguarding ships from current and emerging cyber threats and vulnerabilities, and set out functional elements to be incorporated into the safety management system.

How Honnimar supports it.

• Cyber incidents are handled as incidents in the same platform.
• Detection and reporting through mobile checklists and forms.
• A documented response path via action cards.
• A timestamped log of actions and decisions, and an evaluation record that feeds back into the safety management system.

Verify the current revision number and date against the IMO document at the time of publishing.

NIS2 — EU Directive on cybersecurity

What it requires. NIS2 raises the cybersecurity baseline across essential and important entities and explicitly includes business continuity, backup management, disaster recovery and crisis management among the risk-management measures. It also addresses supply-chain security and introduces a staged incident-reporting regime: an early warning within 24 hours, a fuller incident notification within 72 hours, and a final report within roughly a month.

How Honnimar supports it.

• The reporting clock starts when the incident is detected, not when the analysis is complete.
• A platform that timestamps detection, actions and decisions gives you the facts you need to file on time.
• The authority's follow-up questions are answered with evidence rather than reconstruction.

Confirm the current Danish implementation instrument and any sector-specific guidance before stating an obligation as applying to a specific customer type.