Home / Cyber resilience
IACS Unified Requirements
Cyber resilience, built in.
UR E26 & E27 without the guesswork.
Since 1 July 2024 the major class societies expect new ships, and the systems on board them, to prove they can withstand, detect and recover from cyber incidents. We turn that requirement into a clear, documented and maintainable architecture.
How we got here
From guidance to class rule.
IMO sets the direction
Resolution MSC.428(98) requires cyber risk to be handled in the Safety Management System from 2021.
IACS publishes E26 & E27
Cyber resilience becomes a Unified Requirement for ships and for onboard systems and equipment.
Revision 1
Requirements are refined after industry feedback and the entry into force is set for mid-2024.
Mandatory
Applies to ships contracted for construction on or after 1 July 2024. The first E26/E27 ships are now in service and under survey.
Two rules, one goal
The ship, and everything on it.
E26 looks at the vessel as a whole. E27 looks at each system that goes on board. Both have to fit together, and that's where most projects stall.
Cyber resilience of ships · shipyard, integrator & owner
- Inventory of all computer-based systems (CBS) on board
- Security zones, conduits and network architecture
- Risk assessment and cyber security design description
- Ship-level test programme and survey evidence
- Kept up to date through the ship's life via management of change
Onboard systems & equipment · makers & suppliers
- Required security capabilities built into each system
- Extra controls for systems that touch untrusted networks
- Secure development and product lifecycle
- Documentation: asset list, configuration guide, test procedures
- Type approval and demonstration to the class society
Interactive · zones & conduits
Explore a segmented vessel.
Select a security zone to see the systems in it, their typical category and the controls we put in place. Then try to break in from the crew network.
Bridge & navigation
Risk-based · CBS categories
Not every system carries the same risk.
E26 and E27 sort computer-based systems by what happens if they fail. The category drives how much protection, testing and evidence you need.
Category I
Failure won't lead to dangerous situations for human safety, the ship or the environment.
e.g. crew entertainment, admin tools
Category II
Failure could eventually lead to dangerous situations, but not immediately.
e.g. monitoring, cargo support systems
Category III
Failure could immediately lead to dangerous situations for human safety, the ship or the environment.
e.g. propulsion, steering, navigation
Inside UR E27
The security capabilities, decoded.
E27 groups its required capabilities along the seven foundational requirements of IEC 62443. Here's what each one means for a system going on board.
FR1 · WHO IS ON THE SYSTEM?
Identification & authentication control
Every person, process and device must be identified before it can touch the system, with no shared default logins left over from commissioning.
- Human user identification & authentication
- Account management
- Identifier management
- Authenticator management
- Wireless access management
- Strength of password-based authentication
- Authenticator feedback
- Multifactor authentication for access from untrusted networks
FR2 · WHAT ARE THEY ALLOWED TO DO?
Use control
Authenticated users only get the rights they need, and every security-relevant action leaves a trustworthy trail.
- Authorization enforcement
- Wireless use control
- Use control for portable & mobile devices
- Mobile code
- Session lock
- Auditable events
- Audit storage capacity
- Response to audit processing failures
- Timestamps
- Remote session termination
FR3 · CAN WE TRUST WHAT IT DOES?
System integrity
Protect software and data against manipulation, keep malware out and make sure outputs stay predictable even under attack.
- Communication integrity
- Malicious code protection
- Security functionality verification
- Deterministic output
- Cryptographic integrity protection
- Input validation
- Session integrity
- Invalidation of session IDs after termination
FR4 · WHO CAN READ IT?
Data confidentiality
Sensitive information stays confidential in storage and in transit, using recognised cryptography rather than home-grown tricks.
- Information confidentiality
- Use of cryptography
FR5 · WHERE CAN TRAFFIC GO?
Restricted data flow
Split the network into zones and only allow the traffic that's needed. This is where the ship-level E26 architecture and each E27 system have to meet.
- Network segmentation
- Zone boundary protection at the ship level (E26)
- Controlled conduits between zones
- Defined interfaces to untrusted networks
FR6 · WILL WE NOTICE?
Timely response to events
Security events must be visible and retrievable, so the crew and shore can detect an incident and investigate it.
- Audit log accessibility
- Feeding events into ship-level monitoring
FR7 · WILL IT KEEP RUNNING?
Resource availability
Essential functions keep working under pressure and can be restored to a known-good state after an incident.
- Denial-of-service protection
- Resource management
- System backup
- System recovery & reconstitution
- Alternative power source
- Network & security configuration settings
- Least functionality
Additional requirement for systems connected to untrusted networks. Summary for orientation only; the current IACS text and your class society's rules apply.
Our E26 / E27 pathway
Six steps from "where do we start?" to survey-ready.
Discovery call
Free first session to understand the vessel, contract date, class society and who owns which part of the scope.
→ Scope & applicability note
CBS inventory
On-board or remote survey of every computer-based system, its software, interfaces and network connections.
→ Asset inventory · categories I–III
Zones & conduits
Ship-level architecture separating navigation, machinery, cargo, business and crew networks, with controlled boundaries.
→ Network & zone design description
Gap assessment
Every system checked against the E27 security capabilities and the E26 functional requirements. No vague findings.
→ Prioritised gap register
Remediation & hardening
Firewalls, secure remote access, accounts, malware protection, logging and backups, installed around your schedule.
→ Hardened, documented configuration
Evidence & lifecycle
Test procedures, evidence packs and support during class demonstration, then change management for the life of the ship.
→ Class documentation · 24/7 monitoring
Free self-assessment · 2 minutes
How ready is your vessel?
Answer ten quick questions for an indicative readiness score. Nothing is sent anywhere unless you choose to share the result with us.
Who we work with
Wherever you sit in the chain.
Shipyards & integrators
E26 ship-level design, zone architecture, supplier coordination and test programmes for new builds.
Owners & managers
Keep E26 ships compliant in service and bring older fleets up to the same standard ahead of charterer and insurer audits.
Equipment makers
E27 gap analysis of your product, security configuration guides, test procedures and type approval preparation.
FAQ
Common questions
Does E26 / E27 apply to my existing ships?
The URs are mandatory for ships contracted for construction on or after 1 July 2024. Existing ships are not formally in scope, but charterers, insurers and flag states increasingly expect a comparable level of protection, and IMO already requires cyber risk to be managed in your SMS. Many owners use E26 as the benchmark for retrofits.
What's the difference between E26 and E27 in practice?
E26 is about the ship as a whole: inventory, architecture, risk, monitoring and recovery, mostly in the hands of the shipyard and owner. E27 is about each system and piece of equipment: the security capabilities it must have and how the maker proves them. A ship can only meet E26 if its systems meet E27.
Can you certify our vessel or product?
No, and nobody except the class society can. Approval and certification are issued by your classification society. We prepare the architecture, configuration, documentation and evidence, and support you during the demonstration and survey.
Do we need to replace our equipment?
Usually not everything. Many gaps are closed with configuration, segmentation, account hygiene and a proper remote-access path. Where a system can't meet the requirements, we document compensating measures or plan a replacement around your dry-dock schedule.
How long does an assessment take?
A remote discovery takes days. A full on-board CBS inventory and gap assessment for a typical merchant vessel usually fits within a port call or a short voyage leg, followed by the written report.
CT Marine Global supports compliance work. Interpretation of IACS Unified Requirements and final approval rest with the relevant classification society. Content on this page is a simplified summary for orientation.
Next port of call
Tell us about your fleet. We'll take it from there.
Free discovery call, a clear scope and one accountable team, from the first survey to the final report.