IACS UR E26 and E27 Explained: Cyber Resilience for New Ships
What the classification societies' cyber rules require from shipyards, owners and suppliers.
Which ships
IACS Unified Requirements E26 and E27, in their Rev.1 versions, apply to ships contracted for construction on or after 1 July 2024. The original versions, which were scheduled for January 2024, were superseded and did not enter into force.
E26: the whole ship
UR E26 sets minimum cyber resilience requirements for the vessel across design, construction, commissioning and operation. Its 17 requirements fall under five functions: identify, protect, detect, respond and recover. It also requires a Cyber Resilience Test Procedure covering construction, commissioning and annual surveys, so the obligations continue through the ship's life.
E27: systems and equipment
UR E27 is aimed at suppliers of on-board systems and equipment. It sets minimum security capabilities and documentation, including an asset inventory, network topology, security capability and test documents, configuration guidelines, secure development lifecycle documents, maintenance plans, incident response support and a management of change plan.
- Owners: plan cyber resilience into specifications and contracts.
- Yards: integrate and test to the Cyber Resilience Test Procedure.
- Suppliers: provide E27 documentation and secure configurations.
- Operators: keep it working through surveys and changes.
- E26 and E27 Rev.1 apply to ships contracted on or after 1 July 2024.
- E26 covers the whole vessel through its life with 17 requirements.
- E27 sets security capabilities and documents for equipment suppliers.
For a newbuild or recent contract, list which party owns each E26 function (identify, protect, detect, respond, recover) and which suppliers must provide E27 documents.
Check your understanding
1. Which ships do UR E26 and E27 Rev.1 apply to?
2. Who is UR E27 mainly aimed at?
3. How many requirements does UR E26 contain?
From USD 49 or INR 2,999 a month. A person approves every step.