Back to insights
Compliance

IACS UR E26/E27: Regulatory Overview and Compliance Strategy

An overview of the key provisions of the IACS UR E26/E27 cyber resilience requirements, in force since July 2024, and what shipyards, shipowners and suppliers need to prepare.

By Gwangmyung Maritime

Background

On 1 July 2024, the International Association of Classification Societies (IACS) Unified Requirements UR E26 and UR E27 came into full effect. They are the first international standards to make cyber resilience mandatory for newbuild ships, and their impact is being felt across the entire shipbuilding and offshore industry.

UR E26 — Cyber Resilience of Ships

UR E26 defines cybersecurity requirements at the whole-ship level.

Key Requirements

  • Identify (Asset Inventory): Identify and inventory all CBS (Computer Based Systems) on board
  • Protect: Network segmentation design, access control and data protection
  • Detect: Anomaly monitoring and log management
  • Respond: Establishing a cyber incident response plan
  • Recover: Establishing backup and restoration procedures

Scope of Application

  • All newbuild ships contracted for construction on or after 1 July 2024
  • Responsibility shared by both the shipowner and the shipyard

UR E27 — Cyber Resilience of On-board Systems and Equipment

UR E27 defines security requirements at the individual system and equipment level.

Key Requirements

  • Secure Development Lifecycle: Evidence of the supplier's secure development process
  • Hardening: Removing unnecessary services and changing default passwords
  • Patch Management: Providing an MSUS (Manufacturer's Software Update Service)
  • Network Security: Firewall rules and secure communication protocols
  • Type Approval: Obtaining TA certification from each classification society

Scope of Application

  • Suppliers of CBS (Computer Based Systems) installed on board ships
  • Navigation equipment, engine control systems, cargo management systems and more

Compliance Strategy

Shipyards

  1. Build cybersecurity architecture into the design from the earliest stage
  2. Manage supplier CBS inventories and network topology
  3. Establish a documentation framework to support class surveys

Shipowners

  1. Establish a cyber risk management framework
  2. Build fleet-wide security governance
  3. Plan cybersecurity maintenance for the operational phase

Suppliers

  1. Prepare for UR E27 Type Approval (TA)
  2. Document the secure development lifecycle
  3. Establish an MSUS patch management framework

Conclusion

IACS UR E26/E27 is more than a compliance exercise — it is the starting point for building the cyber resilience that ships need in an era of digital transformation. Gwangmyung Maritime provides practical solutions for responding to these regulatory changes.