Cyber risk became part of ship safety management when IMO expected it to be addressed by the first annual Document of Compliance verification after 1 January 2021. Since then, IACS Unified Requirements E26 and E27 have added class rules for ships contracted for construction on or after 1 July 2024. Transportation was also among India's costliest sectors for data breaches in 2025, at INR 288 million on average. This guide explains who must do what.
Two layers of maritime cyber rules
Maritime cyber rules work in two layers. IMO sets the expectation that companies manage cyber risk inside the safety management system required by the ISM Code. The classification societies, through IACS, set technical requirements for new ships and the equipment installed on them. Flag administrations and class societies then verify both.
IMO: cyber risk inside the SMS
IMO Resolution MSC.428(98) encourages administrations to ensure cyber risks are appropriately addressed in safety management systems no later than the first annual verification of the company's Document of Compliance after 1 January 2021. The Guidelines on Maritime Cyber Risk Management, MSC-FAL.1/Circ.3, give the recommended approach.
In practice auditors look for a cyber risk assessment covering ship and shore systems, procedures for incidents, training records and evidence that the plan is reviewed.
IACS UR E26: the whole ship
UR E26 sets minimum cyber resilience requirements for the vessel over its life. It contains 17 requirements grouped under five functions: identify, protect, detect, respond and recover. It also requires a Cyber Resilience Test Procedure, verified during construction, commissioning and annual surveys.
The Rev.1 versions apply to ships contracted for construction on or after 1 July 2024. The original versions planned for January 2024 were replaced before they took effect.
IACS UR E27: systems and equipment
UR E27 applies to suppliers of computer-based systems installed on board. Suppliers must show minimum security capabilities and provide documentation such as asset inventories, network topology, security capability and test documents, secure configuration guidelines, secure development lifecycle evidence and plans for maintenance and management of change.
| Party | Main duty | Rule |
|---|---|---|
| Ship operator | Cyber risk in the SMS, verified at DOC audit | MSC.428(98) |
| Owner and yard | Plan, build and test cyber resilience | UR E26 |
| Equipment supplier | Security capabilities and documents | UR E27 |
| Class society | Verify at construction and surveys | UR E26 and E27 |
Shore systems are part of the risk
Many incidents start ashore, through email, booking platforms or a vendor's remote access, and then reach operations. Ship managers should include office IT, crewing systems, remote support tools and agents in the same risk assessment as vessel systems. Indian companies must also report specified cyber incidents to CERT-In within six hours.
A practical checklist
The checklist below suits a ship manager or owner preparing for the next DOC audit or a newbuild contract.
- Inventory of IT and OT systems on each vessel and ashore.
- Named owner for each system and its remote access route.
- Cyber section in the SMS with incident procedures and drills.
- Contract clauses requiring E27 documentation from suppliers.
- Cyber Resilience Test Procedure agreed with the yard and class.
- Access review of vendor and former staff accounts every quarter.
Where to learn more
XDQ Labs publishes a free course on cyber risk, data and AI operations for maritime and supply chain teams, covering these rules, GST e-invoicing for logistics businesses and safe first uses of AI agents.
Frequently asked questions
Which ships must comply with IACS UR E26 and E27?
The Rev.1 versions of UR E26 and E27 apply to ships contracted for construction on or after 1 July 2024. Existing ships are not required to retrofit under these unified requirements, though IMO's cyber risk expectations still apply to their operators.
What does IMO MSC.428(98) require?
It encourages administrations to ensure cyber risks are addressed in the ISM safety management system no later than the first annual verification of the company's Document of Compliance after 1 January 2021, following the MSC-FAL.1/Circ.3 guidelines.
What documents does UR E27 require from suppliers?
Suppliers provide documents such as an asset inventory, network topology, security capability and test documents, secure configuration guidelines, secure development lifecycle evidence, maintenance plans and a management of change plan.
Do shore offices fall under maritime cyber risk management?
They should be included. Many incidents start ashore through email or remote access and then affect vessels, so a credible cyber risk assessment in the safety management system covers shore and ship systems together.
Sources
- Maritime cyber risk management incorporated into the ISM Code, Norwegian Maritime Authority, 2020
- IACS UR E26 and E27 (Regulatory News), ABS, 2023
- India Records Highest Average Cost of a Data Breach, IBM India Newsroom, 2025
- 6 Hours To Report Cyber Incidents To CERT-In, Mondaq, 2022
- CBIC lowers turnover threshold for e-invoicing to INR 5 crores, EY India, 2023
- India's Digital Personal Data Protection Act 2023 brought into force, Hogan Lovells, 2025
