XML 47 R26.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management Strategy And Governance [Abstract]  
Cybersecurity Risk Management Processes For Assessing Identifying And Managing Threats [Text Block]
Risk management and strategy
We have
 
security measures
in place
 
to mitigate the
 
risk of cybersecurity
 
threats affecting our
 
technology
environment and
 
our business.
 
Cybersecurity risk
 
management is
 
integrated into
 
our broader
 
enterprise
risk management
 
(ERM) framework
 
to protect
 
shareholder value
 
and ensure
 
business continuity.
 
Cyber
risks are assessed
 
alongside operational,
 
financial, and compliance
 
risks. By integrating
 
cybersecurity into
our broader risk management strategy, we aim to reduce exposure
 
to cyber incidents, safeguard sensitive
data, and maintain
 
investor confidence
 
in our
 
long-term resilience
 
and operational
 
stability. Since 2023, the
Company
 
has maintained
 
ISO
 
27001
 
certification,
 
demonstrating ongoing
 
compliance
 
with
 
the
 
rigorous
requirements of
 
this internationally
 
recognized standard.
The Company's
 
Chief Information
 
Security Officer
(CISO) regularly conducts internal reviews and enhancements to
 
ensure that our cyber risk management
framework remains
 
aligned with
 
ISO 27001
 
and integrated
 
into our
 
broader enterprise
 
risk management
strategy, considering financial, operational, and compliance impacts.
 
Additionally,
 
we
 
have
 
established structured
 
processes
 
for
 
third-party
 
risk
 
management.
 
During
 
vendor
onboarding and
 
ongoing monitoring,
 
information security
 
assessments are
 
conducted, including
 
security
questionnaires, contractual
 
requirements for
 
NDAs and
 
DPAs, and cybersecurity
 
liability clauses
 
to mitigate
supply chain risks.
Cybersecurity training
 
is carried
 
out on
 
a company-wide
 
basis to
 
all employees
 
and seafarers.
 
To help build
cultural
 
awareness
 
of
 
these
 
risks
 
within
 
the
 
Company,
 
additional
 
phishing
 
campaigns
 
have
 
been
implemented within
 
the organization
 
which have
 
motivated the
 
staff to
 
react, helping
 
to enhance
 
awareness
of these risks and mitigate their occurrence. The security team have further
 
enhanced our processes and
increased our defenses by implementing a cybersecurity testing program,
 
carried out on a yearly basis by
external
 
consultants.
 
Penetration
 
testing
 
was
 
also
 
carried
 
out
 
in
 
parallel
 
during
 
2024.
 
A
 
centralized
monitoring
 
system,
 
powered
 
by
 
Microsoft's
 
cloud-based
 
Security
 
Information
 
and
 
Event
 
Management
(SIEM)
 
solution,
 
is
 
in
 
place
 
throughout
 
the
 
year.
 
This
 
system
 
aggregates
 
security
 
data
 
from
 
various
sources, uses built-in artificial
 
intelligence to detect and investigate
 
threats, and enables our security
 
team
to respond to incidents rapidly.
 
We have also created a comprehensive Business Continuity and Disaster
Recovery plan to ensure business resilience and minimize potential
 
disruptions.
 
For the
 
year 2025,
 
the security
 
team has
 
planned a
 
comprehensive
 
collaboration with
 
a
third-party
 
company
to enhance our cybersecurity awareness and training initiatives. This partnership includes the
 
design and
implementation
 
of
 
a
 
multi-faceted
 
approach
 
to
 
staff
 
training,
 
encompassing
 
synchronous
 
and
asynchronous
 
security
 
awareness
 
sessions,
 
custom-tailored
 
phishing
 
campaigns
 
and
 
the
 
creation
 
of
informative cybersecurity awareness
 
newsletters to keep
 
our staff
 
up to date
 
on the latest
 
best practices
and emerging risks. Furthermore, the
 
collaboration will focus on the
 
customization and digitalization of our
vessels' cybersecurity awareness program, ensuring that our seafarers
 
maintain a robust security posture
while at sea.
 
In addition to
 
awareness initiatives, we will
 
continue to acquire
 
relevant tools to
 
support the
identification of
third-party
 
risks and further strengthen our overall security posture.
As
 
part
 
of
 
our
 
continuous
 
efforts
 
to
 
enhance
 
threat
 
detection
 
and
 
incident
 
response,
 
we
 
will
 
leverage
Security Operations
 
Center (SOC)
 
services through
 
a trusted
 
external provider. This
 
partnership will
 
enable
proactive
 
security
 
monitoring,
 
threat
 
intelligence,
 
and
 
rapid
 
incident
 
response,
 
further
 
reinforcing
 
our
cybersecurity resilience across both shore-based operations.
Additionally,
 
we
 
will
 
implement
 
a
 
disaster
 
recovery
 
site
 
to
 
the
 
cloud
 
for
 
critical
 
applications,
 
ensuring
business continuity and operational resilience in the event of
 
disruptions.
In parallel
 
to these security
 
measures, our Company
 
has established a
 
Data Management Platform
 
over
Microsoft
 
Azure
 
Technologies,
 
to
 
act
 
as
 
a
 
centralized
 
and
 
secure
 
source
 
of
 
truth
 
for
 
our
 
operations,
strengthening the quality and integrity
 
of company’s informational assets. The
 
Data Management Platform
was
 
integrated
 
with
 
our
 
core
 
systems
 
and
 
implementation
 
of
 
key
 
reports
 
was
 
initiated
 
within
 
2024,
delivering several
 
new Financial
 
Reports that
 
will enable
 
better,
 
faster and
 
more accurate
 
monitoring of
Company activities
 
and improve decision
 
making and
 
productivity.
 
This transition is
 
further strengthened
with the digital upskilling of relevant personnel, enabling the proper and secure use of information assets.
We
 
are
 
committed
 
to
 
enhance
 
and
 
enrich
 
our
 
operational
 
excellence
 
through
 
our
 
external
 
3rd
 
parties’
inspections and audits (PSC-Vetting inspections Audits). We openly
 
share our results and “lessons
 
learnt”
within the industry and organizations, we compare and
 
benchmark our performance and we continuously
improve our safety footprint.
Cybersecurity Risk Management Processes Integrated Flag true
Cybersecurity Risk Management Processes Integrated [Text Block]
We have
 
security measures
in place
 
to mitigate the
 
risk of cybersecurity
 
threats affecting our
 
technology
environment and
 
our business.
 
Cybersecurity risk
 
management is
 
integrated into
 
our broader
 
enterprise
risk management
 
(ERM) framework
 
to protect
 
shareholder value
 
and ensure
 
business continuity.
 
Cyber
risks are assessed
 
alongside operational,
 
financial, and compliance
 
risks. By integrating
 
cybersecurity into
our broader risk management strategy, we aim to reduce exposure
 
to cyber incidents, safeguard sensitive
data, and maintain
 
investor confidence
 
in our
 
long-term resilience
 
and operational
 
stability. Since 2023, the
Company
 
has maintained
 
ISO
 
27001
 
certification,
 
demonstrating ongoing
 
compliance
 
with
 
the
 
rigorous
requirements of
 
this internationally
 
recognized standard.
The Company's
 
Chief Information
 
Security Officer
(CISO) regularly conducts internal reviews and enhancements to
 
ensure that our cyber risk management
framework remains
 
aligned with
 
ISO 27001
 
and integrated
 
into our
 
broader enterprise
 
risk management
strategy, considering financial, operational, and compliance impacts.
Cybersecurity Risk Management Third Party Engaged Flag true
Cybersecurity Risk Third Party Oversight And Identification Processes Flag true
Cybersecurity Risk Materially Affected Or Reasonably Likely To Materially Affect Registrant Flag false
Cybersecurity Risk Materially Affected Or Reasonably Likely To Materially Affect Registrant [Text Block]
As of
 
the date
 
of this
 
annual report,
 
we have
 
not identifed
 
any cybersecurity threats
 
that have
 
materially
affected or are
 
reasonably likely
 
to materially
 
affect our business
 
strategy, results of operations,
 
or financial
condition. For more information about the cybersecurity risks we face, please see Item 3. Key Information
— D. Risk Factors — “A cyber-attack could materially disrupt our business.”
Cybersecurity Risk Board Of Directors Oversight [Text Block]
Our
 
board
 
of
 
directors
 
oversees
 
the
 
Company’s
 
cybersecurity
 
risk
 
exposures
 
and
 
the
 
steps
 
taken
 
by
management to
 
monitor and
 
mitigate cybersecurity
 
risks. The
 
board of
 
directors ensures
 
allocation and
prioritization of resources and
 
overall strategic direction for
 
cybersecurity and ensures alignment with
 
the
Company’s overall strategy.
Cybersecurity Risk Board Committee Or Subcommittee Responsible For Oversight [Text Block]
Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated
the day-to-day oversight
 
of cybersecurity and
 
other technology risks
 
to the Cyber
 
Security Officer, who has
11 years of specialized information security experience.
Cybersecurity Risk Process For Informing Board Committee Or Subcommittee Responsible For Oversight [Text Block]
This
 
experience
 
includes
 
serving
 
as
 
Cyber
 
Security
 
Officer
 
at
 
Diana
 
Shipping
 
Services,
 
Information
Security
 
Officer
 
at
 
Viva
 
Wallet,
 
Senior
 
IT
 
Auditor
 
at
 
First
 
Data
 
Corporation
 
focusing
 
on
 
EMEA
 
region
security
 
audits,
 
and
 
IT
 
Auditor/Security
 
Consultant
 
at
 
Deloitte's
 
Enterprise
 
Risk
 
Services.
 
The
 
Cyber
Security
 
Officer
 
holds
 
CISA
 
and
 
CDPSE
 
certifications
 
from
 
ISACA,
 
completed
 
Information
 
Security
Management
 
Systems
 
(ISMS)
 
Auditor/Lead
 
Auditor
 
Training
 
in
 
accordance
 
with
 
ISO
 
27001:2013,
 
and
possesses an MSc in Digital Systems Security from the University
 
of Piraeus.
The Cyber
 
Security Officer
 
is
responsible
 
for assessing,
 
managing and
 
mitigating cybersecurity
 
threats and
for
 
reporting
 
cybersecurity
 
updates,
 
including
 
updates
 
on
 
monitoring
 
strategies
 
and
 
efforts
 
to
 
prevent
cybersecurity threats, to the board of directors on a quarterly basis or
 
more often as needed.
Cybersecurity Risk Role Of Management [Text Block]
The
audit committee
 
receives regular
 
reports from
 
management
 
on
 
our cybersecurity
 
risks
.
 
In
 
addition,
management updates the audit committee, as
 
necessary, regarding
 
any material cybersecurity incidents,
as
 
well
 
as
 
any
 
incidents
 
with
 
lesser
 
impact
 
potential.
The
 
audit
 
committee
 
reviews
 
the
 
Company's
cybersecurity
 
risks
 
and
 
assess’
 
the
 
steps
 
that
 
management
 
has
 
taken
 
to
 
protect
 
against
 
threats
 
to
 
the
Company's information systems and security.
Cybersecurity Risk Management Positions Or Committees Responsible Flag true
Cybersecurity Risk Management Positions Or Committees Responsible [Text Block]
The
audit committee
 
receives regular
 
reports from
 
management
 
on
 
our cybersecurity
 
risks
Cybersecurity Risk Management Expertise Of Management Responsible [Text Block]
The Company's
 
Chief Information
 
Security Officer
(CISO) regularly conducts internal reviews and enhancements to
 
ensure that our cyber risk management
framework remains
 
aligned with
 
ISO 27001
 
and integrated
 
into our
 
broader enterprise
 
risk management
strategy, considering financial, operational, and compliance impacts.
Cybersecurity Risk Process For Informing Management Or Committees Responsible [Text Block]
The
 
audit
 
committee
 
reviews
 
the
 
Company's
cybersecurity
 
risks
 
and
 
assess’
 
the
 
steps
 
that
 
management
 
has
 
taken
 
to
 
protect
 
against
 
threats
 
to
 
the
Company's information systems and security.
Cybersecurity Risk Management Positions Or Committees Responsible Report To Board Flag true