Kalmar outlines cybersecurity responsibility frameworks for terminal operators
Kalmar emphasizes the necessity of clearly defined roles between technology providers and operators to secure critical port infrastructure.
As port automation increases, the division of responsibility for cybersecurity between vendors and terminal operators has become a critical operational issue. According to Kalmar, while the general principle dictates that providers secure their software and customers maintain their IT infrastructure, real-world deployment often involves complex overlaps that require explicit contractual alignment.
Cybersecurity professionals at Kalmar identify undocumented third-party changes to production systems as a significant risk. When an IT partner modifies network hardware, such as routers, it may inadvertently introduce vulnerabilities that are not covered by the original software provider's security scope. To mitigate this, agreements must specifically delineate responsibilities for remote support, VPN access, and server-level security.
While regulations like the EU's Cyber Resiliency Act establish baseline requirements, Kalmar asserts that compliance is merely a minimum standard. Sustained security requires an ongoing, detailed dialogue between vendor cybersecurity teams and internal operational staff to ensure that every system update or feature deployment is vetted for potential security implications.