IACS UR E27: Cyber resilience of on-board systems and equipment

What a maker of shipboard computer-based systems documents, builds in and tests, tracked as rows a buyer can request and a maker can evidence: the maker documents, the security capabilities and the secure development lifecycle.

What IACS UR E27: Cyber resilience of on-board systems and equipment is

IACS Unified Requirement E27, Rev.1 (September 2023), is the equipment-level partner of UR E26. Where E26 treats the ship as a whole, E27 sets what each computer-based system and its supplier must show. It applies from the same date, ships contracted on or after 1 July 2024.

It has three parts. The first is a set of documents the maker supplies: asset inventory, topology diagrams, a description of how each security capability is met, a test procedure, configuration guidelines, and on request development lifecycle documents, a maintenance and verification plan, information to support the owner's response and recovery plans, a change plan and test reports. The second is a list of security capabilities: a base set every system carries, covering identity and access, audit, integrity, malware, confidentiality, availability and recovery, and a smaller extra set for systems that connect to untrusted networks, such as multi-factor authentication, approval of remote access onboard and input validation. The third is a secure development lifecycle for the maker's own process, covering keys, update documentation, authentic updates, and hardening guidance.

Each capability in the tables cites an IEC 62443 requirement by number. CMDash shows those numbers as references so a maker can line them up with its own IEC 62443 work. It does not reproduce IEC or ISA wording.

Who it applies to

• Makers and suppliers of shipboard computer-based systems and equipment, from engine control and navigation to network and security devices.
• Shipyards and systems integrators who collect and check supplier documents before delivery.
• Shipowners and managers who need maker documents to build the vessel asset inventory and the response and recovery plans.
• Operators using the supplier questionnaire to ask makers for the same documents, alongside the per-system document tracker.

How it is structured in CMDash

CMDash seeds the ten maker documents of section 3.1, every item of Table 1 (ids T1-01 onward) and of Table 2 (ids T2-01 onward, so Table 2 item 31 is T2-01), and the lifecycle requirements of section 5. Control ids are the UR's own numbering; statements and evidence lines are CMDash's paraphrase. IEC 62443 requirement numbers are kept as reference metadata and appear as a "Reference" line at the end of the evidence text. The framework is assessed at the company level, because it binds the maker and integrator.

Scope: Paraphrased in CMDash's own words; the IACS text is not reproduced. IEC 62443 requirement numbers appear as references only; IEC and ISA wording is not included.

The control text

What CMDash does for IACS UR E27: Cyber resilience of on-board systems and equipment

• Each document, capability and lifecycle requirement is a tracked row with an owner, status and dated evidence, grouped as documentation, capabilities for all systems, capabilities for untrusted networks, and lifecycle.
• Crosswalks to NIST CSF 2.0, ISO/IEC 27001 Annex A and NIS2 for the company-level rows. The multi-factor row is the one near one-to-one match to the ISO secure-authentication control, and the Okta multi-factor coverage rule on that control also applies to it, labeled as derived.
• A supplier template and a per-system maker-document tracker in the maritime module, so the documents a maker owes for each system can be requested, received and dated.
• The same rows feed the operator's vessel asset inventory and the hand-over into the E26 plans.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artifact being gathered twice, and they are how a second framework costs a fraction of the first.

Where CMDash stops

Know the boundaries before you plan the work.

• CMDash does not certify a system, issue a type approval or replace the society's plan approval and survey.
• The wording is CMDash's paraphrase of E27. IEC 62443 and ISA texts, titles and requirement wording are not included or reproduced; only the requirement numbers E27 cites are shown.
• A society may accept an equivalent standard for navigation and radio equipment in place of the capabilities; CMDash records the acceptance but does not judge equivalence.
• The UR does not cover ships contracted before 1 July 2024 unless the owner or society chooses to apply it.
• Nothing here is class or legal advice.

Common questions

Also in Maritime & OT

Paid plans cap how many frameworks you run at once, never which ones — IACS UR E27: Cyber resilience of on-board systems and equipment is available on every paid plan.