Cyber compliance for ship operators and owners
Owners and operating companies answer for the cyber resilience of each ship and for the management system behind the fleet. CMDash tracks the class, flag-state and company-level frameworks side by side, with the evidence behind each.
Maritime cyber compliance overview
Regulatory and customer pressure
IACS UR E26 and UR E27
If your ship was contracted for construction on or after 1 July 2024 and is a passenger ship on international voyages, or a cargo ship or high-speed craft of 500 GT or more on international voyages, its classification society applies UR E26 to the ship. UR E27 sets what the makers of its on-board systems document and build in.
IMO guidance in the safety management system
IMO’s cyber guidance is non-mandatory, and MSC 110 agreed that a non-mandatory code should be developed. Resolution MSC.428(98) affirms that an approved safety management system should take cyber risk into account, so the ISM Code audit is where it is looked for.
The Coast Guard cyber rule for US-flagged ships
If your ship is US-flagged and required to have a security plan under 33 CFR part 104, the rule requires incident reports to the National Response Center without delay since 16 July 2025, general cybersecurity training from 12 January 2026, and a cybersecurity assessment and plan by 16 July 2027.
NIS2 for the company, not the ship
NIS2 Annex I lists sea and coastal passenger and freight water transport companies and excludes the individual vessels they operate. If your company is established in the EU, the obligation sits with the company, and national transposing laws set the detail.
Threats that target this industry
Remote access by makers and service providers
Service work on propulsion, navigation and cargo systems often arrives over a remote link, and each link is a way into the ship’s networks.
Updates and service work on removable media
Software updates and service tools reach shipboard systems on laptops and removable media that sit outside your normal controls.
Ransomware on the shore side
Fleet management, planning and e-mail systems ashore connect to every ship, so an outage there reaches the fleet.
The frameworks CMDash tracks for you
- IACS UR E26: Cyber resilience of shipsThe class requirement for ship cyber resilience, assessed per vessel, with the documents shown for design approval, commissioning and survey.
- IACS UR E27: Cyber resilience of on-board systems and equipmentWhat your makers owe you, so you can check their documents against it.
- IMO Maritime Cyber Risk ManagementThe IMO guidance to fold into your safety management system.
- USCG Cybersecurity in the Marine Transportation SystemFor US-flagged vessels, with the regulation text on every row.
- NIS2The company-level duties for water transport companies in the EU.
- ISO/IEC 27001:2022The management system standard the maritime frameworks are crosswalked to.
- NIST Cybersecurity Framework 2.0A structure the board, the fleet and the shore team share.
Crosswalked, so one piece of evidence counts twice: IACS UR E26: Cyber resilience of ships ↔ ISO/IEC 27001:2022 · IACS UR E26: Cyber resilience of ships ↔ NIST Cybersecurity Framework 2.0 · IMO Maritime Cyber Risk Management ↔ NIST Cybersecurity Framework 2.0 · IMO Maritime Cyber Risk Management ↔ NIS2 · USCG Cybersecurity in the Marine Transportation System ↔ NIST Cybersecurity Framework 2.0
Capabilities that matter most here
Fleet and facility view
A unit per ship with its own applicability check and control status, rolled up into one fleet view.
OT inventory and security zones
The vessel asset inventory and security zones, per ship, exported as one documentation pack.
Maker documentation tracker
Request and track the UR E27 documents from the makers of each ship’s systems.
Framework tracking and crosswalk
Carry control status from UR E26 to the ISO 27001 and NIST CSF 2.0 controls that overlap.
Evidence from your tools
Evidence from the tools you run, collected on a schedule.
Incident reporting clocks
Put the deadlines of the regimes you choose on the incident record.
Vendor register
Keep the makers and service providers with access to your ships in one register.
Sources
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.