IACS UR E26 and E27 require cyber resilience on ships, but the question crews and ship managers actually ask is 'what do we prepare first?'. This is not a commentary on the rules; it is a practical checklist of the order in which to prepare. For the scope and an overview of the requirements, start with our IACS UR E26 & E27 guide, and confirm applicability and detailed requirements with your classification society and shipyard.
1. Start with the asset inventory
- Identify onboard systems and equipment: list servers, PCs, network and communication equipment and navigation / engine systems by location and purpose. Without an inventory, every later piece of evidence is shaky.
- Software and version control: record operating system, application and firmware versions per device and update them whenever they change.
- Connections: show on the network diagram which device talks to which, and over which link.
- Responsibility: decide for every device whether the owner, shipyard or manufacturer manages it, including outside vendors who are allowed remote access.
2. Organise network segmentation and zones
- Separate the business network, crew welfare network and navigation / engine (OT) zones with VLANs and firewall policy, and allow only the traffic between zones that is actually needed.
- Bring the points that connect to the outside world (satellite links, remote access, shore integration) together so they pass through the firewall. Firewall policy management is covered under vessel firewall (UTM).
- Keep policies on an allow-list basis and review them regularly so that temporary openings do not stay in place.
3. Check the protection measures
- Endpoint protection: confirm malware protection and update status device by device (vessel endpoint security).
- Removable media control: define a USB usage policy and approval procedure, and keep records.
- Accounts and access rights: remove shared accounts and default passwords, and set role-based permissions and an approval procedure for remote access.
- Backup and recovery: define what is backed up, how often and where it is kept, and record tests showing that recovery really works.
4. Prepare detection and response
- Decide where firewall and device logs are kept and for how long, and who checks for anomalies. Response is faster when shore can see the state of the vessel (vessel network monitoring).
- Write an incident response procedure (detect, isolate, recover, report) and set up contact routes on both the vessel and shore.
- Even a single recorded drill is valuable evidence (ship cyber security drill scenarios).
5. Keep the evidence in one place
- Asset inventory, network diagram, firewall policy documents and account / access management rules
- Update and patch history, and backup and recovery test records
- Incident response procedure and drill records
- Approval and termination records for vendor remote access
- Change records: who changed what, and when
Building evidence while operating is far easier than assembling it just before an audit. Set up a routine of leaving a report after every inspection.
6. The order in short
- Step 1: asset inventory and network diagram
- Step 2: network segmentation and firewall policy
- Step 3: endpoint, USB, account and backup checks
- Step 4: logging, monitoring and incident response procedure
- Step 5: evidence storage and a regular inspection cycle
You can read the overall picture in our maritime cyber security guide for ships. Ocean Connect supports vessel IT asset inventories, network segmentation and firewall configuration, endpoint and remote monitoring operations, and inspection reports. To see the scope of preparation, visit vessel cyber security solutions, and contact us via the online inquiry form or our emergency 24-hour helpdesk (+82-70-7588-0611~0612).