XML 581 R38.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We attempt to achieve our cybersecurity goals through:

Practical cybersecurity:
–Implementation of standards-based, cost-effective, repeatable and scalable cybersecurity solutions to secure data and digital infrastructure.

Cyber compliance:
–Employing methods and tools to ensure compliance with cybersecurity best practices and regulatory frameworks.

Vulnerability scans :
–To enhance our cybersecurity posture, we have also incorporated regular vulnerability scans into our cybersecurity strategy.
–These scans play a pivotal role in identifying and addressing potential weaknesses, contributing to the overall resilience of our systems and data protection measures.
–This proactive approach ensures that our cybersecurity initiatives remain adaptive and responsive to the evolving threat landscape.

Centralized management and monitoring:
–Implementing a remote management and monitoring platform to gain a comprehensive overview of the fleet.
–Providing secure, monitored and recorded remote access to all IT infrastructure, including vessel assets, all user endpoint devices and other active network components.
Commitment to cybersecurity audit of the IT landscape by external partner
–On a yearly basis, a cybersecurity audit is planned, including a vulnerability scan on year one and a Penetration testing (better known as PEN testing) on year two.
–We routinely coordinate with auditors and other third-party partners, to help ensure our systems are evaluated and held to the utmost security standards. The outcome of these sessions results in policy and procedure updates to prevent and resolve cybersecurity incidents in a timely manner.

Advanced antivirus and Endpoint Detection and Response ("EDR"):
–We have deployed an EDR solution for continuous monitoring and response to advanced threats on all endpoints in or connecting to the CMB.TECH IT landscape. An escalation matrix to action critical and high impact incidents is put in place to ensure consistent coverage and actioning of these incidents.
–Establishing centralized dashboards for on-shore and off-shore visibility into endpoint security status and alerts.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Together, we are dedicated to securing and fortifying a reliable information security data platform that prioritizes data security. This commitment aligns seamlessly with our enhanced cybersecurity and data protection policy, inclusive of comprehensive mitigation measures and a meticulously incident response plan. We conduct regular risk assessments for both operational technology and information technology ("IT") systems, implementing corresponding mitigating actions.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance on cybersecurity strategy, continuous improvement and incident response
–An overview of cybersecurity incidents, detailing what the criticality is of the incident, who is involved, what is involved, and what is being done to mitigate all risks associated with the incident, is to be provided at our IT Steering Committee meetings. Based on critical incidents reported, plans for measures to avoid these incidents from happening in the future are decided on the IT Steering Committee and follow up on implementation is done in subsequent IT Steering Committees.
–Cybersecurity incidents classified as critical and having financial impact are communicated immediately to all members of the IT Steering Committee by our Chief Information and Security Officer ("CISO").
–Within our IT organization, a monthly meeting is held to review all aspects of cybersecurity. Discussion topics include, but are not limited to, current or recent incidents, upcoming threats, review of software and hardware vulnerabilities, upcoming policy and procedure changes and recommendations from third party partners are a few examples of topics discussed.

Members of the IT Steering Committee include:
–include all members of the Management Board;
–our Internal Audit team;
–Operations Director;
–Technical Director;
–Chief Technology Officer ("CTO");
–our Head of Accounting;
–our Heads of business;
–and our Head of IT.

Our Head of IT is responsible for assessing and managing all risks from cybersecurity threats, assisted by the CISO reporting to the Head of IT. Our CISO is qualified to assess all risks from cybersecurity threats.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Members of the IT Steering Committee include:
–include all members of the Management Board;
–our Internal Audit team;
–Operations Director;
–Technical Director;
–Chief Technology Officer ("CTO");
–our Head of Accounting;
–our Heads of business;
–and our Head of IT.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Cybersecurity incidents classified as critical and having financial impact are communicated immediately to all members of the IT Steering Committee by our Chief Information and Security Officer ("CISO").
Cybersecurity Risk Role of Management [Text Block] Our Head of IT is responsible for assessing and managing all risks from cybersecurity threats, assisted by the CISO reporting to the Head of IT.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Members of the IT Steering Committee include:
–include all members of the Management Board;
–our Internal Audit team;
–Operations Director;
–Technical Director;
–Chief Technology Officer ("CTO");
–our Head of Accounting;
–our Heads of business;
–and our Head of IT.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO is qualified to assess all risks from cybersecurity threats.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] An overview of cybersecurity incidents, detailing what the criticality is of the incident, who is involved, what is involved, and what is being done to mitigate all risks associated with the incident, is to be provided at our IT Steering Committee meetings. Based on critical incidents reported, plans for measures to avoid these incidents from happening in the future are decided on the IT Steering Committee and follow up on implementation is done in subsequent IT Steering Committees.–Cybersecurity incidents classified as critical and having financial impact are communicated immediately to all members of the IT Steering Committee by our Chief Information and Security Officer ("CISO").
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true