IMO MSC.428(98)
IMO MSC.428(98) software. Evidence you attach to the SMS you already run
This is IMO MSC.428(98) compliance software for ISM companies with a Document of Compliance or Safety Management Certificate. You run your Safety Management System here. We do not write it, certify it, or file it. Plain-English controls, hashed write-once evidence, and a one-click packet that is an index and snapshot you attach to your SMS.
Not class. Not a recognized organization. Not a filing service. Modules are pick-and-choose.
The resolution
IMO adopted MSC.428(98) on 16 Jun 2017
IMO MSC.428(98) is the Maritime Cyber Risk Management resolution in Safety Management Systems. It was adopted on 16 June 2017. The first annual DOC verification after 1 January 2021 has passed. If you have a Document of Compliance or Safety Management Certificate under the ISM Code, you address maritime cyber risk as part of your SMS.
Companion guidance is MSC-FAL.1/Circ.3. The guidance references existing frameworks: you pick one, adapt it to your fleet, and demonstrate that cyber risk is managed within your ISM processes.
Who this is for
ISM companies with a DOC or SMC only
VesselMark is for ISM companies with a Document of Compliance or Safety Management Certificate. You already run an ISM Safety Management System. This module breaks down MSC.428(98) obligations into plain-English controls you pick and choose, keeps your evidence tamper-evident, and gives you a packet you attach to your SMS.
This is not for dry inland towing under Subchapter M. This is not a Subpart F Cybersecurity Plan. This is a separate module from USCG cybersecurity. You pick the frameworks your vessels actually answer to.
How it works
You do the work. We keep the record defensible.
VesselMark breaks down MSC.428(98) obligations into plain-English controls. You see what is outstanding, close the gap, and attach evidence. Documents are content-hashed and held in write-once storage, so your evidence trail stands up to scrutiny. When audit time comes, export a one-click packet: your posture and evidence index, defensible and point-in-time, that you attach to your SMS.
Plain-English controls
See what is outstanding without a cybersecurity degree. Every control has a plain-language title and guidance.
Write-once evidence
Documents are content-hashed and held in write-once storage. Your evidence trail is tamper-evident.
One-click inspection packet
Export your posture and evidence index for a PSC or class review. A defensible point-in-time snapshot.
Renewal reminders
Drills, log refreshes, annual reviews. We schedule them, track what is due, and email before anything slips.
Unlimited users
No per-user tax. Add every officer, shore manager, and designated person who touches the system.
Sits beside existing ops
Not a replacement for Helm CONNECT, TBS, Mobile Ops, or ABS NS. ABS NS is fleet software. We still sit beside it.
What this is not
We do not write your SMS. We are not class. We are not an RO.
VesselMark is compliance management software. We are not a class society. We are not a recognized organization. We are not a filing service. You run your Safety Management System here. We do not write it, certify it, or file it with anyone. We give you a workspace where the controls stay current and the evidence trail is defensible.
Related modules
Pick and choose what you need
USCG cybersecurity (33 CFR 101 Subpart F)
USCG cybersecurity under 33 CFR 101 Subpart F. MTSA-scoped regulation. Usually out for dry inland. Coastal and harbor line-haul on tank or CDC barges are usually in. A boat that only shifts at the dock may be out even if the facility is in.
Learn about USCG cybersecurity →Subchapter M TSMS software
Run your TSMS here. Plain-English controls, hashed write-once evidence, one-click inspection packet. Not a TPO. Not a class society. $500/vessel/mo, one module.
Learn about Sub M TSMS →Pricing
$500 per vessel per month, one module.
No per-user tax. 14-day free trial, no card required. Annual billing saves 10%.
IMO MSC.428(98)
$500/vessel/mo
or $5,400/vessel/yr - save 10%
- ✓ Plain-English controls
- ✓ Write-once evidence + append-only audit trail
- ✓ One-click inspection packet you attach to your SMS
- ✓ Renewal reminders before anything lapses
- ✓ Unlimited users
- ✓ Cancel anytime
Each framework module is priced separately. Pick and choose what you need. IMO without USCG cyber is fine. Add other modules if they apply.
Frequently asked questions
MSC.428 questions we hear often
Are you our class society?
No. We are not a class society. We are not a recognized organization. We are not a filing service. You run your SMS here. We do not write it, certify it, or file it. We give you a workspace where the controls stay current and the evidence trail is defensible.
Do you replace our SMS?
No. You run your SMS here. This is compliance management software. You do the work - risk assessments, drills, reviews. We give you a workspace where the controls are plain-English, the evidence is tamper-evident, and the inspection packet is one click.
Is there hardware to install?
No. Documentation-first. No shipboard hardware, no network agents, no sensors. Just a clear, defensible record of where each vessel stands.
Are users unlimited?
Yes. No per-user tax. Add every officer, shore manager, and designated person who touches the system. $500 per vessel per month covers the whole crew.
Can we run MSC.428 without other modules?
Yes. Modules are pick-and-choose. IMO MSC.428(98) is one module. USCG cybersecurity (33 CFR 101 Subpart F) is another. Subchapter M TSMS is another. You can run MSC.428 alone if that is what your fleet owes.
Do you replace Helm CONNECT, TBS, Mobile Ops, or ABS NS?
No. We sit beside them. Helm, TBS, and Mobile Ops are operations and maintenance platforms. ABS NS is fleet software. We still sit beside it. VesselMark is compliance-first. Not a replacement. Compliance-adjacent.