Five regulatory layers, read together for one shipping group
The Study maps cyber, resilience, carbon and US listing obligations for a shipping company listed in New York, and shows where they overlap. Each regime is usually handled by a different team. The Study treats them as one programme with one evidence base.
| Layer | Source | What it asks of the company |
|---|---|---|
| NIS2 | Directive (EU) 2022/2555 · Law 5160/2024 | Cyber risk management, incident reporting and management accountability |
| CER | Directive (EU) 2022/2557 · Law 5236/2025 | Resilience of critical entities, risk assessment and resilience measures |
| EU ETS | Directive 2003/87/EC, maritime phase-in | Monitoring, reporting and surrender of allowances for voyages in scope |
| FuelEU Maritime | Regulation (EU) 2023/1805 | GHG intensity of energy used on board, with penalties and pooling |
| SEC / SOX | Sarbanes-Oxley §302 / §404 · SEC disclosure | Internal control over financial reporting and cybersecurity governance disclosure |
Listings on NYSE and Nasdaq share the same SEC and SOX framework, so the Study applies to companies on either exchange.
What the Study delivers
A main study in Greek with an English executive edition.
Each layer explained for a shipping group: who is in scope, which obligations apply and who in the company owns them.
Where obligations meet, such as a cyber incident that affects MRV data, or a carbon liability that enters financial reporting controls.
The ten main carbon-cyber risks, scored by probability and impact.
An eighteen-month plan in three phases: foundation, implementation and optimisation.
Measures across four domains, so progress can be tracked by management and the audit committee.
Time charter wording for EU ETS pass-through, FuelEU, data sharing and cyber warranties, for review by the company's lawyers.
A hypothetical listed group taken through the full programme, from exposure to plan.
The legal texts, standards and guidance each section relies on.
Carbon layers → MCCS
The EU ETS and FuelEU findings become live figures on the fixture decision desk and in fleet compliance.
Resilience layers → MCRC
The NIS2 and CER measures become controls, clocks and evidence in the console, for every kind of incident: cyber attacks, piracy and armed robbery, pollution, natural hazards and other disruptions to operations.
A standalone Carbon Module covering the carbon and carbon-cyber chapters is also available for companies that start with carbon.