IACS UR E26 and E27: what a ship operator and a maker each have to produce

IACS Unified Requirements E26 and E27 are the class societies' common rules for cyber resilience on new ships. They are written as a pair on purpose: E26 is about the ship as a whole, E27 is about the on-board systems and equipment that go into it. Checked against the IACS resolution pages and the Rev.1 documents on 1 November 2026: E26 is Rev.1 (November 2023) and E27 is Rev.1 (September 2023). We found no Rev.2 of either. The IACS E27 resolution page returned an error when we checked, so confirm the revision with your class society before you plan around it.

This post paraphrases. The requirements themselves are IACS's, and you should read them from IACS.

Who is in scope, and from when

Both URs apply to ships contracted for construction on or after 1 July 2024. "Contracted" means the date the construction contract was signed, so a ship delivered in 2027 can still be outside the requirements if its contract is older.

For E26, the mandatory scope is:

• passenger ships, including passenger high-speed craft, on international voyages;
• cargo ships of 500 GT or more on international voyages;
• high-speed craft of 500 GT or more on international voyages;
• mobile offshore drilling units of 500 GT or more;
• self-propelled mobile offshore units engaged in construction.

Warships and troopships, cargo ships under 500 GT, unpropelled vessels, yachts carrying 12 passengers or fewer, pleasure yachts, fishing vessels and floating production units are not in the mandatory scope, although a society may apply the requirements if asked. If your ship is near one of these lines, the answer comes from your class society, not from a checklist.

What the ship side produces under E26

E26 covers the operational technology computer-based systems on board: propulsion, steering, anchoring and mooring, power generation and distribution, fire detection and extinguishing, bilge and ballast, loading computers, watertight integrity, lighting, required safety systems, and navigation and communication. It also pulls in any IP-based interface from those systems to something else. The text names passenger-servicing, administrative and crew-welfare networks as examples, which is how a cruise ship's hotel IT can end up inside an OT standard wherever it touches an in-scope system.

The goals are organized under five functional elements (identify, protect, detect, respond, recover). The part that becomes a paper trail is the demonstration of compliance. For design and construction, the documents are:

1. a zones and conduits diagram;
2. a cyber security design description;
3. a vessel asset inventory;
4. a risk assessment for excluding a computer-based system, where one is excluded;
5. a description of compensating countermeasures, where they are used.

After delivery, compliance is demonstrated through commissioning and then through the first annual, annual and special surveys. The zone rules also give you something concrete to check: navigation and communication systems are kept apart from machinery systems, safety-function systems sit in separate and physically segmented zones, and wireless devices sit in dedicated zones.

What the maker side produces under E27

E27 binds the supplier of a system or piece of equipment, working with the system integrator (the shipyard until delivery). Its documentation list has ten items:

1. an asset inventory of the system's hardware and software, with manufacturer, model, function, interfaces, operating system or firmware and version, and protocols;
2. physical and logical topology diagrams;
3. a description of the security capabilities, including compensating countermeasures;
4. test procedures;
5. security configuration guidelines, with the defaults;
6. secure development lifecycle documents, on request;
7. a maintenance and verification plan;
8. information to support the owner's incident response and recovery;
9. a management of change plan;
10. test reports.

E27 also sets out security capabilities the system has to have, with a larger set for systems that connect to untrusted networks, and a development lifecycle section. Navigation and radio equipment may, with the society's acceptance, follow a different standard in place of the capability list provided E26 is still met.

Why the split matters in practice

The operator's inventory (E26) is built from the makers' inventories (E27). A yard or owner who has asked every supplier for the same ten documents can assemble the ship-level file; one who has not will be chasing PDFs at commissioning. If you are a maker, the useful question is not "are we compliant?" but "can we hand over all ten, per system, in a form the yard can merge?"

A quick screen

The free maritime cyber applicability check runs the scope test above in your browser, from the vessel type, tonnage, voyages and contract date you enter, and shows the source beside each result. It is a screening aid, not legal advice, and it says "needs review" where the answer depends on your class society.

Dated 1 November 2026. Primary sources: the IACS resolution pages for UR E26 and UR E27.