IACS Unified Requirements UR E26 (cyber resilience of ships) and UR E27 (cyber resilience of on-board systems and equipment) apply to ships contracted for construction on or after 1 July 2024, and IMO Resolution MSC.428(98) has required cyber risk management in the Safety Management System since 2021. Here is what this means in practice for the people who run vessel IT.
What IACS UR E26 / E27 require
- E26 sets ship-level requirements: identify (asset inventory, network diagram), protect (network segmentation, access control, malware protection), detect (security monitoring), respond and recover (incident procedures, backup and recovery) — all with evidence.
- E27 applies to on-board systems and equipment, obliging suppliers to provide security capabilities such as account management, logging and integrity protection. Owners and managers should verify these at delivery.
- Existing ships are not retroactively covered, but class, charterer and insurer cyber audits follow the same framework, so the preparation is effectively the same.
The most common audit findings
- PCs and equipment connected directly to the satellite router with no firewall; business and crew Wi-Fi networks not separated. A firewall that allows all traffic is little better (see why a loose firewall policy exposes vessels to security incidents).
- Shared accounts, accounts of signed-off crew not removed, network devices still on default passwords.
- PCs without (or with outdated) antivirus, uncontrolled USB use — the number-one malware entry path.
- Servers and navigation PCs with no backup, or backups never tested for restore.
- No evidence: no asset inventory, network diagram or inspection history.
How Ocean Connect addresses them
- Fleet-wide UTM firewalls and OT/IT segmentation (VLAN) for the network protection requirements — see our ship cyber security solutions.
- Endpoint security and USB security to control malware entry, managed from a central console across the fleet.
- Our Ocean-Spider™ network monitoring platform watches the onboard network in real time and produces inspection-style evidence.
- Regular backups plus PE-USB remote recovery keep the 'recover' requirement actually working.
- Per-vessel IT asset inventories, network diagrams and visit records are maintained centrally, ready for class or charterer audits.
Cyber resilience is an operating system, not a one-off project. Contact us for a status assessment of your managed vessels — we propose a phased plan that makes the most of existing equipment.