Cyber compliance for makers of shipboard systems
Shipyards and owners now ask makers of shipboard computer-based systems for security documentation in a set shape. CMDash tracks IACS UR E27 per system, with owners, status and evidence, so the package is ready when the request arrives.
Maritime cyber compliance overview
Regulatory and customer pressure
IACS UR E27 maker obligations
If you make computer-based systems for ships contracted for construction on or after 1 July 2024, UR E27 binds you, with the system integrator, who is the shipyard until delivery. It asks for security capabilities built into each system and documents that show them.
A documentation package per system
The documents include a computer-based-system asset inventory, topology diagrams, a description of security capabilities, test procedures, configuration guidelines, a maintenance and verification plan, support for the owner’s incident response, a change-management plan and test reports, with secure development lifecycle documents on request.
A secure development lifecycle
UR E27 asks for a secure development lifecycle from requirements through end of life, so the evidence behind how you build and test is part of what a buyer reviews.
The Cyber Resilience Act for products outside marine equipment
Regulation (EU) 2024/2847 does not apply to equipment within the marine equipment Directive 2014/90/EU (Article 2(4)). A product outside it, such as hotel, entertainment or crew-welfare IT, can make you a manufacturer under the Act, with Article 14 reporting from 11 September 2026 and most of the rest from 11 December 2027.
Threats that target this industry
Vulnerabilities in shipped firmware
Firmware and software stay in service for years, so a vulnerability found after delivery has to reach every ship that runs the product.
Your own remote-service connections
Support links into customers’ vessels are a way into their networks, and buyers ask how you protect them.
Compromise of the build and update path
An attacker who reaches your build or update pipeline reaches every system you ship to.
The frameworks CMDash tracks for you
- IACS UR E27: Cyber resilience of on-board systems and equipmentThe maker obligations, tracked as rows a buyer can request and you can evidence.
- ISO/IEC 27001:2022The management system standard the E27 rows are crosswalked to.
- NIST Cybersecurity Framework 2.0A structure your security, product and support teams share.
- SOC 2 Type IIThe report enterprise buyers request from software and service suppliers.
Crosswalked, so one piece of evidence counts twice: IACS UR E27: Cyber resilience of on-board systems and equipment ↔ ISO/IEC 27001:2022 · IACS UR E27: Cyber resilience of on-board systems and equipment ↔ NIST Cybersecurity Framework 2.0 · SOC 2 Type II ↔ ISO/IEC 27001:2022
Capabilities that matter most here
Maker documentation tracker
See which UR E27 documents you hold for each system, so the package a shipyard or owner asks for is ready.
OT inventory and security zones
A computer-based-system inventory with the fields UR E27 asks makers to supply.
Framework tracking and crosswalk
Work once against UR E27 and carry the status to the ISO 27001 and NIST CSF 2.0 controls that overlap.
Evidence from your tools
Evidence from the tools you run, collected on a schedule.
Trust Center and questionnaires
Answer shipyard and owner security questionnaires from one reviewed set of answers.
Vendor register
Keep the suppliers behind your components in one register.
Risk register and FAIR
A risk register that ranks what to fix before the next release.
Sources
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.