IACS UR E26 and E27 for Ship Cyber Resilience
Shipping is becoming more digital and more connected. This brings many benefits, but also new risks. To address them, important cybersecurity rules have been introduced in recent years. Two central documents are the Unified Requirements E26 “Cyber resilience of ships” and E27 “Cyber resilience of on-board systems and equipment” of the International Association of Classification Societies (IACS). IACS member societies apply Revision 1 of both to ships contracted for construction on or after July 1, 2024.
Contents
Legal framework in the European Union
Maritime cybersecurity law in the EU rests on a combination of international rules and EU directives. For ships in international waters, the requirements of the International Maritime Organization (IMO) apply first. They set requirements for different ship types and their equipment.
Within the EU, the Marine Equipment Directive (MED), Directive 2014/90/EU, plays a central role. It harmonizes the testing standards and certification procedures for marine equipment in the EU and brings the IMO standards into the EU legal framework. Flag states are responsible for implementing and enforcing these rules, while specialized notified bodies carry out the conformity assessments.
The MED is updated regularly to take account of new technologies and safety standards, including aspects of cybersecurity. Other EU directives, such as the NIS2 Directive, also play a role in maritime cybersecurity.
This legal framework is the basis for applying cybersecurity standards such as IACS UR E26 and E27 in the EU. It ensures that ships flying an EU flag and marine equipment used in the EU meet both international and EU requirements. This contributes to a more resilient and secure maritime infrastructure.
Requirements and objectives of the new rules
The IACS Unified Requirements E26 and E27 mark a turning point in maritime cybersecurity. They are more than technical guidelines. They cover the whole cycle from design through operation to maintenance.
The requirements combine proven industry standards with the specific challenges of shipping and set a new benchmark for cybersecurity at sea. The following sections describe their main requirements and objectives.
IACS UR E26: cyber resilience of ships
IACS UR E26 sets requirements for the cyber resilience of ships. It applies to passenger ships (including passenger high-speed craft), cargo ships of 500 GT and upwards, and high-speed craft of 500 GT and upwards, each engaged in international voyages. It also applies to mobile offshore drilling units of 500 GT and upwards and to self-propelled mobile offshore units engaged in construction.
The core areas of E26 are:
- Identify: building a thorough understanding of cybersecurity risks on board
- Protect: implementing proactive safeguards against potential cyber incidents
- Detect: setting up advanced systems for the early detection of cyber incidents
- Respond: developing detailed and effective response plans for different cyber incident scenarios
- Recover: preparing plans for fast recovery after cyber incidents
E26 does not only define these areas. It also specifies how compliance with the requirements must be demonstrated. This includes regular audits, documentation, and training for the crew.
IACS UR E27: cyber resilience of on-board systems and equipment
IACS UR E27 complements E26 and specifies requirements for the cyber resilience of systems and equipment on board. It applies to the same ship types as E26. UR E27 focuses on the security of individual on-board systems and devices. Its main requirements cover:
- identification and authentication of users
- access control and management of permissions
- protection against tampering and malicious code
- secure communication
- logging of security-relevant events
- backup and recovery functions
E27 also sets requirements for the secure development lifecycle of the systems. In addition, it specifies which documentation manufacturers must provide and how compliance with the requirements is demonstrated.
How E26 and E27 relate to each other
IACS UR E26 and UR E27 complement each other:
- E26 defines overarching requirements for the cyber resilience of the ship as a whole and is aimed mainly at shipowners and ship operators.
- E27 specifies concrete technical requirements for individual systems and devices and is aimed mainly at manufacturers of ship systems.
Together, they form a framework that covers both the organizational and the technical side of maritime cybersecurity.
Find out whether IACS UR E27 affects you
For manufacturers of marine equipment, it is often not obvious which requirements of E26 and E27 actually apply and which evidence shipyards, operators, or classification societies will ask for. In a short call, we check whether and how your systems are affected and which next steps make sense.
Links to IEC 62443 and the NIST CSF
IACS UR E26 “Cyber resilience of ships” focuses on the operation of ships. It is based on the Cybersecurity Framework (CSF) of the US National Institute of Standards and Technology (NIST). This framework has proven effective in many industries for improving cybersecurity.
NIST CSF and IACS UR E26
E26 adopts the five core functions of the NIST framework (Identify, Protect, Detect, Respond, and Recover) and adapts them to the context of shipping. This risk-based approach lets shipowners and ship operators design their cybersecurity measures in a flexible and scalable way.
E26 also takes over a central principle of the NIST framework: continuous improvement. Cyber threats keep changing, so security measures in ship operation must be reviewed and adjusted regularly.
IEC 62443 and IACS UR E27
E26 concentrates on the overarching organizational side of cybersecurity in ship operation. IACS UR E27, by contrast, addresses the technical side of on-board systems and equipment. E27 closely follows the international IEC 62443 series on security for industrial automation and control systems. IEC 62443 is widely regarded as the reference standard for cybersecurity in industrial control systems and provides a full framework for securing connected systems.
Specifically, E27 takes detailed technical requirements for the security capabilities of on-board systems and devices from IEC 62443-3-3. These include access control, secure communication, and event logging for specific components on board. E27 also includes concepts from IEC 62443-4-1 on the secure product development lifecycle. This ensures that cybersecurity is considered not only in operation but already during the development and manufacture of maritime systems and equipment.
Zones and conduits in the IACS URs
One central concept that both E26 and E27 take from IEC 62443 is “zones and conduits.” This network segmentation concept is particularly relevant for the complex, connected systems of modern ships. It allows fine-grained control of data traffic between different on-board systems. This raises the overall level of security, both in ship operation and in the individual on-board systems.
Combining the operational approach of the NIST framework (E26) with the technical specifications from IEC 62443 (in both E26 and E27) creates a consistent framework for maritime cybersecurity. It addresses both the management level of ship operation and the technical implementation in on-board systems. It gives the shipping industry a solid guide for current and future cybersecurity challenges.
What the new rules mean for the industry
These rules mark a fundamental shift in the shipping industry. They show that cybersecurity matters and that proactive measures are needed to protect maritime infrastructure against increasingly complex and potentially devastating cyber threats. With IACS UR E26 and E27 in place, the shipping industry becomes more secure and more resilient.
At the same time, E26 and E27 pose considerable challenges for an industry that must adapt to new digital realities. The rules make clear that cybersecurity can no longer be ignored and that proactive measures are needed to protect the integrity and security of global trade.
Turn IACS UR E27 into concrete measures
Manufacturers of marine equipment increasingly have to demonstrate that their products meet cybersecurity requirements. We help you assess IACS UR E27, map it against IEC 62443, and prepare the required technical documentation.
