IACS UR E26 and E27 Ship Cyber Resilience Guide

A new ship contracted for construction since 1 July 2024 cannot be delivered with its class certificate unless its operational technology systems have been designed, built, tested and documented for cyber resilience under IACS Unified Requirements E26 and E27. E26 sets requirements at the level of the whole vessel and E27 at the level of each computer-based system and its equipment, and together they turn the IMO's voluntary cyber risk guidance into survey items that a classification society checks at design, construction and every annual survey. This guide explains what each requirement covers, who does what among shipowner, shipyard, system suppliers and class, how E26's five functional elements translate into concrete controls, what evidence surveyors expect, and where accounts, passwords and remote access cause most findings. It is written for shipowner technical superintendents, newbuild site teams, OT system suppliers and fleet cyber leads. For the broader maritime picture see the Maritime Cybersecurity Guide.

Status checked 27 October 2026: E27 Rev.1 (September 2023) and E26 Rev.1 (November 2023), both in force from 1 July 2024 for new ships contracted on or after that date. Individual classification societies may apply stricter rules and publish their own notations, and IACS can revise the URs, so confirm the revision your class society applies.

Key takeaways

Contract date decides applicability. The revised URs apply to new ships contracted for construction on or after 1 July 2024; ships in service are not retrospectively bound by E26 and E27, though owners may adopt them voluntarily.
E26 is the ship, E27 is the system. E26 covers the vessel-level programme across identify, protect, detect, respond and recover; E27 covers security capabilities and secure development of each computer-based system (CBS) supplied on board.
Four parties share the evidence. The shipowner, the systems integrator (usually the shipyard), the suppliers and the classification society each have defined deliverables, and gaps between them are the most common reason for late findings.
Zones and conduits are the backbone. E26 requires systems to be grouped into security zones with controlled conduits between them, and navigation and communication systems cannot share a zone with other systems.
Accounts and remote access are the usual findings. Shared or written-down passwords, unmanaged remote connections and missing physical disconnection are what surveyors and testers find most often.

Where E26 and E27 sit in maritime cyber regulation

IACS states that its member classification societies' rules cover more than 90 percent of the world's cargo-carrying tonnage, so a Unified Requirement becomes, in practice, a global rule for newbuilds. URs are minimum requirements: each member society may add more stringent ones.

Instrument	Issued by	Status	What it does
Resolution MSC.428(98)	IMO Maritime Safety Committee, June 2017	Resolution; makes cyber risk part of the ISM Code safety management system	Expected cyber risks to be addressed no later than the first annual verification of the company's Document of Compliance after 1 January 2021
MSC-FAL.1/Circ.3 Guidelines on maritime cyber risk management	IMO	Guidance; IMO's cyber page lists Rev.2, and ABS reports Rev.3 published 4 April 2025, aligned with NIST CSF 2.0 (adding Govern) and referencing E26 and E27	Functional elements for company-level cyber risk management
UR E26 Cyber resilience of ships	IACS	Mandatory class requirement, Rev.1, new ships contracted from 1 July 2024	Vessel-level design, construction, commissioning and operational requirements
UR E27 Cyber resilience of on-board systems and equipment	IACS	Mandatory class requirement, Rev.1, same applicability; CBS type approval available through class societies	System-level security capabilities and supplier secure development
Class notations (for example ABS CR, DNV Cyber secure)	Individual classification societies	Society rules; some mandatory for in-scope newbuilds	Implement and sometimes extend E26 and E27

The original E26 and E27, published in 2022 for application from 1 January 2024, were withdrawn and replaced by the Rev.1 versions before they took effect, after industry feedback on survey requirements and applicability. Anyone working from 2022 versions of the text is working from the wrong document.

Which ships and which systems are in scope

ABS lists the vessel types in scope as passenger ships, cargo ships of 500 GT and above, high-speed craft of 500 GT and above, mobile offshore drilling units of 500 GT and above, and self-propelled mobile offshore units engaged in construction. Mandatory or non-mandatory application depends on vessel type and size, which IACS introduced to ease the burden on smaller and non-conventional vessels; other vessel types can apply the URs on a voluntary basis.

Within a ship, the URs focus on operational technology: computer-based systems whose failure or compromise could affect safety of the vessel, crew or environment. Typical in-scope CBS include propulsion and steering control, power management, navigation and integrated bridge systems, ballast and cargo control, fire detection, and any system connected to them. Business IT, crew welfare networks and passenger Wi-Fi are not the subject of E26 and E27 unless they connect into those systems, at which point the conduit between them is in scope. E26 allows a CBS to be excluded from its requirements only on the basis of a documented risk assessment accepted by the classification society.

Who does what: roles across the ship lifecycle

Stakeholder	Main phase	Responsibilities
System supplier	Design and manufacture	Meet E27 security capabilities, run a secure development lifecycle, supply documentation (asset inventory, topology, security capability description, configuration guidelines, test procedure, maintenance and verification plan) and provide security updates
Systems integrator (usually the shipyard)	Design, construction, commissioning	Collect supplier evidence, design zones and conduits, build the vessel asset inventory, run the ship cyber resilience tests, hand over documentation
Shipowner	Operation	Maintain the inventory and configuration, manage changes, accounts and remote access, run incident response and recovery, support annual surveys
Classification society	All phases	Review documentation, witness tests, survey at delivery and annually, optionally type-approve CBS under E27

Whether E27 type approval of a CBS is required depends on the class society's rules, and a type-approved system shortens vessel-level certification because fewer vessel-specific documents are needed. Owners specifying a newbuild should write E27 type approval, or at least full E27 documentation, into the purchase specification for every in-scope system.

E26: the five functional elements in practice

Element	What E26 asks for	Concrete controls and evidence
Identify	Vessel asset inventory	Hardware and software inventory for every in-scope CBS, versions, network connections, responsible supplier, kept current through the ship's life. See the Asset Inventory and CMDB Security Guide.
Protect	Security zones and segmentation; network protection safeguards; anti-malware; access control; wireless; remote access and communication with untrusted networks; mobile and portable devices	Zone and conduit diagram, firewall rules per conduit, malware protection or application control, user accounts per role, removable media rules, disabled unused ports and services
Detect	Network operation monitoring; verification and diagnostic functions	Alarm on abnormal traffic or loss of communication, logs of security events, periodic verification of security functions
Respond	Incident response plan; local, independent or manual operation; network isolation; fallback to a minimal risk condition	Documented crew actions, ability to isolate a zone, manual control positions tested at sea trials
Recover	Recovery plan; backup and restore; controlled shutdown, reset, roll-back and restart	Backups of configuration and software for each CBS, restore procedures tested, known-good images held on board

Zones and conduits

Zone membership: each CBS belongs to a zone, and every system in a zone must meet the zone's security requirements.
Separation of navigation and communication: these systems cannot share a zone with other systems.
Isolation without loss of function: a zone should be capable of being isolated without affecting its primary functions, which is what makes the Respond element workable.
Conduits: every communication channel crossing a zone boundary is a conduit and needs defined, enforced rules. See the Network Segmentation Guide.

Documents a surveyor will ask for

Class societies list the deliverables slightly differently, but the vessel-level set normally includes the zones and conduit diagram, a cyber security design description, the vessel asset inventory, any risk assessment used to exclude a CBS, descriptions of compensating countermeasures, the ship cyber resilience test procedure, and the owner's ship cyber security and resilience programme and management of change procedure for the operational phase. E26 requires the test procedure to cover construction, commissioning and annual surveys, so it is a living document rather than a one-off.

E27: system security capabilities and secure development

E27 sets a required list of security capabilities for every in-scope CBS and an additional list for systems that communicate with untrusted networks, and requires suppliers to evidence a secure development lifecycle. The capabilities follow the IEC 62443 family, which is why IEC 62443 component and system certifications are closely aligned with E27 type approval. See the IEC 62443-3-3 and 4-2 System and Component Security Levels Guide.

Capability area	What a compliant CBS provides	What to check on delivery
Identification and authentication	Human user identification and authentication, account management, authenticator management; stronger authentication for access from untrusted networks	No shared generic logins where roles differ, default passwords changed, no passwords on labels
Use control	Authorisation by role, session lock, control of wireless and portable devices	Role matrix, USB ports disabled or controlled
System integrity	Malware protection, input validation, software and information integrity	Anti-malware or allowlisting in place, signed updates
Data confidentiality	Protection of information at rest and in transit where required	Encryption on conduits to untrusted networks
Restricted data flow	Network segmentation and zone boundary protection	Conduit rules match the design
Timely response to events	Audit records, protection of audit information	Logs exist and survive restart
Resource availability	Denial of service protection, backup, recovery and reconstitution, emergency power behaviour	Restore tested from backup

Where a system cannot meet a capability, the supplier or integrator may propose a compensating countermeasure. It must protect against the same threats, give equivalent protection, not be a control already required elsewhere in the UR, and not introduce a higher risk. Some bridge and safety systems need immediate access in an emergency and may be exempted from user authentication; the exemption must be documented and paired with physical access control.

Where identity fits: accounts, remote access and machine credentials

Most E26 and E27 findings come down to who, or what, can log in. Surveyors look for passwords written on labels, and shared administrator accounts used by both crew and supplier engineers are a common weakness.

Human accounts: separate roles for operators, officers and maintenance, with supplier engineer accounts disabled when not in use. See the OT and ICS Identity and Access Guide.
Remote access: the intended actions (diagnostics, firmware and configuration updates, command execution, interactive sessions) should be listed and enforced, because attackers exploit what a connection can do, not what it was meant for. Provide a physical means of disconnection for each system, labelled, and enforce session timeouts. See the OT Remote Access Guide.
Machine credentials: data links between engine monitoring, ship-to-shore gateways and shore analytics platforms use certificates, API keys or service accounts. Inventory them alongside the CBS, record who on shore holds them, and rotate them at change of management or supplier.
Portable devices: service laptops and USB media are the most common way malware crosses into OT on board (ATT&CK for ICS T0847 Replication Through Removable Media). See the Removable Media and USB Control Guide.
AI and analytics agents: shore-based optimisation tools and AI agents that read, and sometimes write, set points through the ship-to-shore conduit are an untrusted network connection for E27 purposes. Restrict them to read-only unless a documented risk assessment justifies write access.

Implementing E26 and E27 on a newbuild

Specify at contract. Put E26 and E27 compliance, deliverables, and supplier security update obligations for the expected service life into the shipbuilding contract and every maker's list item.
Agree the CBS list early. Shipyard, owner and class agree which systems are in scope and any risk-assessed exclusions before detailed design.
Design zones and conduits. Produce the zone and conduit diagram and cyber security design description, and review them with class at design approval.
Collect supplier evidence. Track E27 documentation or type approval certificates per CBS; chase gaps before equipment is installed, not at sea trials.
Harden on installation. Change default credentials, disable unused ports and services, apply the supplier's security configuration guideline, and record the baseline.
Test and witness. Run the ship cyber resilience test procedure with class witnessing, including isolation of zones, fallback to manual operation and restore from backup.
Hand over to operations. Transfer the inventory, credentials (through a secure process, never a spreadsheet), backups and the cyber security and resilience programme to the owner.
Run the operational phase. Manage changes, patches and accounts under the management of change procedure, and prepare evidence for each annual survey.

Rollback matters: every change to a CBS during commissioning or operation should have a tested roll-back, which E26 lists explicitly under Recover. Keep the previous known-good software and configuration on board.

Metrics for the fleet

Inventory accuracy: share of in-scope CBS whose recorded software versions match the installed versions at survey.
Default credential removal: share of CBS with no default or shared administrator accounts.
Remote access control: share of remote sessions brokered, logged and time-limited.
Restore readiness: share of CBS with a backup restore tested in the last 12 months.
Survey findings: number of cyber findings per annual survey, trending down.

Framework mapping

E26 or E27 element	NIST CSF 2.0	IEC 62443	ATT&CK for ICS threat addressed
Asset inventory	ID.AM-01, ID.AM-02	62443-2-1 programme	All
Zones and conduits	PR.IR-01	62443-3-2, 62443-3-3	T0866 Exploitation of Remote Services
Access control and authentication	PR.AA-01, PR.AA-05	62443-3-3, 62443-4-2	T0859 Valid Accounts
Remote access and untrusted networks	PR.IR-01	62443-3-3	T0822 External Remote Services, T0883 Internet Accessible Device
Mobile and portable devices	PR.PS-01	62443-3-3	T0847 Replication Through Removable Media
Network monitoring	DE.CM-01	62443-3-3	Detection of all of the above
Respond and recover	RS.MA-01, RC.RP-01, PR.DS-11	62443-3-3	Recovery from destructive impact

Common failure patterns

Evidence collected too late: supplier documentation is requested after installation, so missing capabilities need compensating countermeasures that could have been designed out.
Diagram does not match the ship: the zone and conduit diagram reflects the design, but undocumented links (a vendor modem, a crew laptop bridge) exist on board.
Passwords on labels and shared admin accounts: convenient for crew and engineers, and a straightforward survey finding.
Remote access without a kill switch: unlabelled or missing physical disconnection and no session timeout for supplier connections.
Handover without credentials management: the yard hands over admin passwords in a document, and the owner never rotates them.
Supplier exits: a system supplier stops issuing security updates or goes out of business, and the owner has no plan to replace the system.

Practitioner checklist

Confirm the contract date and the classification society rules (and notation) that apply to each newbuild.
Agree the in-scope CBS list and any risk-assessed exclusions with yard and class at design stage.
Require E27 type approval or full E27 documentation in every maker's list purchase.
Keep the zone and conduit diagram, asset inventory and design description in step with the built ship.
Remove default and shared administrator accounts and passwords on labels before delivery.
Broker, log and time-limit all remote access; label physical disconnection points.
Inventory ship-to-shore certificates, API keys and service accounts and rotate them at handover.
Test zone isolation, manual fallback and restore from backup with class witnessing.
Run management of change and annual survey evidence through the cyber security and resilience programme.

IACS UR E26 and E27 Ship Cyber Resilience Guide: Requirements for Shipyards and Equipment Suppliers