Cyber compliance for cruise ships and the lines that run them
A cruise ship runs operational technology for propulsion, power and navigation beside the hotel, payment and guest networks that connect to it. CMDash tracks the maritime cyber frameworks a cruise line works against, control by control, and keeps the evidence current.
Maritime cyber compliance overview
Regulatory and customer pressure
IACS UR E26 on new ships
If your ship is a passenger ship on international voyages that was contracted for construction on or after 1 July 2024, its classification society applies UR E26 to the computer-based systems that run the ship and to any IP-based interface from them to other systems, passenger-servicing and crew-welfare networks included.
Records duties under the CVSSA
If your ship can carry 250 or more passengers overnight and embarks or disembarks passengers in the United States, the Cruise Vessel Security and Safety Act sets records duties that reach IT: video footage kept at least 20 days, footage the FBI identifies after a reported crime kept at least 4 years, and an electronic record of each crew member’s access to passenger staterooms.
The Coast Guard cyber rule for US-flagged ships
If your ship is US-flagged and required to have a security plan under 33 CFR part 104, the rule requires incident reports to the National Response Center without delay since 16 July 2025, general cybersecurity training from 12 January 2026, and a cybersecurity assessment and plan by 16 July 2027.
IMO guidance and the safety management system
IMO’s cyber guidance is non-mandatory, and MSC 110 agreed that a non-mandatory code should be developed. Resolution MSC.428(98) affirms that an approved safety management system should take cyber risk into account, and flag-state and ISM audits look for it.
Threats that target this industry
Ransomware that reaches shore and hotel systems
Booking, payment and hotel-management systems connect the ship to the shore, so an outage there reaches embarkation and guest services. Recovery readiness is an operating question as well as a compliance one.
Remote-maintenance paths into shipboard systems
Makers and service providers reach propulsion, power and navigation systems over remote links, and each path is a way into the networks that run the ship.
Guest and crew networks near the ship’s own
Passenger Wi-Fi and crew-welfare networks sit close to systems that run the ship, so the separation between them has to be designed, documented and checked.
The frameworks CMDash tracks for you
- IACS UR E26: Cyber resilience of shipsThe class requirement for ship cyber resilience, assessed per vessel, with the documents shown for design approval, commissioning and survey.
- Cruise Vessel Security and Safety ActThe records duties of the Cruise Vessel Security and Safety Act, with the statute text on every row.
- USCG Cybersecurity in the Marine Transportation SystemThe Coast Guard cyber rule for US-flagged vessels and facilities, with the regulation text on every row.
- IMO Maritime Cyber Risk ManagementThe IMO guidance every ship operating company is expected to fold into its safety management system.
- ISO/IEC 27001:2022The management system standard the maritime frameworks are crosswalked to.
- NIST Cybersecurity Framework 2.0A structure the board, the fleet and the shore team share.
Crosswalked, so one piece of evidence counts twice: IACS UR E26: Cyber resilience of ships ↔ ISO/IEC 27001:2022 · IACS UR E26: Cyber resilience of ships ↔ NIST Cybersecurity Framework 2.0 · USCG Cybersecurity in the Marine Transportation System ↔ NIST Cybersecurity Framework 2.0 · Cruise Vessel Security and Safety Act ↔ ISO/IEC 27001:2022
Capabilities that matter most here
Fleet and facility view
One profile and one control status per ship, rolled up so the fleet reads at a glance.
OT inventory and security zones
The inventory and zone documents a class society asks to see, kept per ship.
Framework tracking and crosswalk
Work once against UR E26 and carry the status to the ISO 27001 and NIST CSF 2.0 controls that overlap.
Evidence from your tools
Pull MFA, patching and endpoint evidence from the tools your IT team already runs.
Incident reporting clocks
Put the deadlines of the regimes you choose on the incident record.
Vendor register
Keep the makers and service providers with access to your ships in one register.
Board-pack reports
A board pack with posture, top open risks and loss exposure.
Sources
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.