IACS UR E26: Cyber resilience of ships

The class requirement for ship cyber resilience: identify, protect, detect, respond and recover requirements for the computer-based systems that run a vessel, plus the documents shown for design approval, commissioning and survey. Assessed per vessel.

What IACS UR E26: Cyber resilience of ships is

IACS Unified Requirement E26, Rev.1 (November 2023), is a technical rule that the member classification societies apply on the same terms. It covers the operational technology that keeps a ship safe, such as propulsion, steering, power, fire detection, ballast and bilge, watertight integrity, navigation and the communications equipment that regulations require. It also covers any IP connection from those systems to other networks, which is how passenger, administrative and crew-welfare networks come into scope on a ship such as a cruise liner.

It is organized as five functions: identify, protect, detect, respond and recover. The protect function is the longest. It asks for security zones with only explicitly permitted traffic between them, protection of zone boundaries, malware defenses, physical and logical access control, tightly governed wireless, remote access that the ship must approve, and control of mobile and portable devices. The respond and recover functions ask for an incident response plan and a recovery plan kept aboard, independent local control, the ability to isolate a zone, a safe fallback state, backups, and controlled shutdown, reset, rollback and restart.

Compliance is shown in stages. The shipyard or systems integrator submits a zones and conduit diagram, a cyber security design description and the asset inventory, then tests to a ship cyber resilience test procedure witnessed by the society before delivery. The owner then submits a cyber security and resilience program before the first annual survey and shows records of it at survey. If a system is left out of the requirements, a risk assessment has to justify that.

Who it applies to

• Ships contracted for construction on or after 1 July 2024 that the classification societies treat as mandatory: passenger ships on international voyages, and cargo ships and high-speed craft of 500 gross tonnage or more on international voyages, plus mobile offshore drilling units and self-propelled offshore construction units.
• Shipowners, ISM companies and ship managers who inherit the ship and then run the program, drills, updates and surveys.
• Shipyards and systems integrators who own the design-phase documents and the commissioning tests.
• Owners of older ships who choose to use it as guidance, which the UR allows.

How it is structured in CMDash

CMDash seeds the requirement clauses of sections 4.1 to 4.5 at the level a surveyor would mark pass or fail, the design-phase documents of 5.1.1 to 5.1.5, one row each for commissioning and for survey readiness, and the exclusion risk assessment. Control ids are the UR's own clause numbers; where a clause lists several separate duties each one is its own row with a letter suffix, such as 4.2.6.3.2(e). Statements and evidence lines are CMDash's paraphrase. Because the UR is surveyed ship by ship, the framework is assessed per vessel.

Scope: Paraphrased in CMDash's own words; the IACS text is not reproduced. The requirement clauses of section 4 and the documentation, commissioning and survey steps. The classification society decides what it accepts.

The control text

What CMDash does for IACS UR E26: Cyber resilience of ships

• Each requirement is a tracked row with an owner, status, reviewer notes and dated evidence, grouped by the five functions plus demonstration of compliance, and scored per vessel.
• A seeded crosswalk to NIST CSF 2.0 and ISO/IEC 27001 Annex A, so a company program already tracked against either shows which ship-level rows it partly covers. Most edges are partial; only the multi-factor authentication row is a near one-to-one match.
• One connector rule reaches the multi-factor authentication row (4.2.6.3.2(e)) through that crosswalk: the Okta multi-factor coverage rule on ISO 27001 A.8.5 also applies to it, and is labeled as derived.
• The vessel asset inventory, zones and conduits and maker documents sit next to these rows in the maritime module, so the evidence comes from the records the crew and shore team keep.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artifact being gathered twice, and they are how a second framework costs a fraction of the first.

Where CMDash stops

Know the boundaries before you plan the work.

• CMDash does not issue class certificates or approve documents. The classification society decides what it accepts, including equivalent standards and compensating measures.
• The wording is a paraphrase, not the IACS text. The definitions, goals and appendix summaries are not seeded.
• The security capabilities that each system must carry are in the sister framework for UR E27, which binds the maker. IEC 62443 identifiers appear there as references only.
• The UR does not cover ships contracted before 1 July 2024 unless the owner or society chooses to apply it.
• CMDash does not connect to shipboard OT networks to test them. It records the results of the tests people run.
• Nothing here is class or legal advice.

Common questions

Also in Maritime & OT

Paid plans cap how many frameworks you run at once, never which ones — IACS UR E26: Cyber resilience of ships is available on every paid plan.