UR E26 and UR E27 split the work between the ship and the equipment supplier. Who is in scope, from which contract date, and which documents each side hands over, read from the IACS resolution pages.
A cruise ship is a vessel, a hotel, a casino, a clinic and a retailer at once. A map of the regimes that touch its IT, from class rules and the CVSSA to payments, guest data, manifests and the EU, with the primary source for each.
What 33 CFR part 101, subpart F requires, who it covers, and the dates in the regulatory text: incident reporting since 2025-07-16, training from 2026-01-12, and the assessment and plan by 2027-07-16.
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.