Vessels Cybersecurity for IACS UR E26 and UR E27

As of 2026, IACS UR E26 and UR E27 are mandatory international standards for the cyber resilience of newly built vessels. They became fully effective for all ships contracted for construction on or after July 1, 2024. 

Overview of Requirements

These Unified Requirements (URs) mandate that cyber resilience be integrated into a vessel's life cycle, from design and construction to commissioning and operation. 

• UR E26 (Cyber Resilience of Ships): Focuses on the ship as a whole entity. It requires the secure integration of Operational Technology (OT) and Information Technology (IT) systems into the vessel's network.

• UR E27 (Cyber Resilience of On-Board Systems and Equipment): Focuses on individual computer-based systems (CBS) and equipment. It mandates that third-party suppliers and manufacturers harden their systems before installation. 

  
  

Key Compliance Framework

The standards are built around five core functional goals aligned with the NIST Cybersecurity Framework: 

1. Identify: Maintain a full inventory of onboard computer-based systems.

2. Protect: Implement security zones, network segmentation, and access controls.

3. Detect: Monitor network operations to identify potential cyber incidents.

4. Respond: Establish incident response plans and manual override capabilities.

5. Recover: Develop procedures to restore essential services after a cyber event. 

   
   

Implementation Details for 2026

• Applicability: These rules apply to all IACS-classed vessels over 500 Gross Tonnage (GT) engaged in international voyages, including cargo ships, passenger ships, and mobile offshore units.

• Documentation: Shipowners must maintain a Ship Cyber Security and Resilience Program throughout the vessel's life, which is subject to regular verification by classification societies.

• Exclusions: Systems that are completely isolated (no IP connectivity, no physical ports, and no link to external networks) may be exempt from certain requirements.

• Supply Chain Impact: Suppliers now increasingly seek Type Approval (TA) for their equipment to simplify the certification process for shipbuilders.

Onboard documentation & implementation:

• 

*** Do talk to us regarding this IACS E26/E27 matter to find out for more detail