Regulation is not a single rule but a continuum
IACS UR E26/E27 do not stand alone. They sit within a progression in which IMO's cyber risk management guidelines were taken up in the BIMCO guidelines, which in turn were made concrete in the IACS Unified Requirements. With the EU NIS2 Directive now adding penalty provisions, maritime cybersecurity is shifting from recommendation to obligation. The NIST Cybersecurity Framework (CSF) runs through this entire progression.
How the key regulations have evolved
IMO MSC-FAL.1/Circ.3 — Guidelines on Maritime Cyber Risk Management
- Original — Adopted at the 98th session of the Maritime Safety Committee (MSC 98) in June 2017. Requires cyber risk management to be addressed in a ship's Safety Management System (SMS)
- Rev.1 — Revised at MSC 103 in May 2021, issued June 2021
- Rev.2 — Revised at MSC 104 in October 2021, issued June 2022
- Rev.3 — Revised at MSC 108 in May 2024, issued April 2025
BIMCO — The Guidelines on Cyber Security Onboard Ships
- Version 1 — Issued January 2016
- Version 2 — Issued December 2018
- Version 3 — Issued December 2020. Explicitly references IACS UR E26/E27 requirements
- Version 4 — Issued November 2024. Incorporates IACS UR E26/E27 standards and best practices
IACS UR E26/E27 — Unified Requirements for Cyber Resilience of Ships
- Original — Issued April 2022
- Rev.1 — Issued December 2023
EU NIS2 Directive (2022/2555)
- Issued December 2022. Aligned with cybersecurity frameworks such as NIST CSF, ISA/IEC 62443 and ISO/IEC 27001
- EU Member States must impose administrative fines on essential entities that breach cybersecurity risk-management measures or reporting obligations
- Fines of up to a maximum of at least EUR 10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher
Expected direction of future revisions
- Cybersecurity governance requirements
- A stronger focus on ship operations
- Sanctions for non-compliance and violations
IMO Guidelines Rev.2 → Rev.3: What changed
| Area of change | Rev.2 (2022) | Rev.3 (2025) | Implications for cybersecurity |
|---|---|---|---|
| Risk management functional elements | 5 (Identify · Protect · Detect · Respond · Recover) | 6 (the existing 5 + Govern) | Cybersecurity is a responsibility of senior management, not just the technical department |
| Systems in scope | 8 (7 onboard + 1 communications) | 9 (communications split into separate port and shore interfaces) | An evolution to the policy level, beyond technical asset management |
| Operational management items | Recommendations only | 11 topics (access control, incident response, backup, etc.) | A cyber response framework including risk assessment, with verifiable procedures, is no longer optional |
| Training requirements | Brief mention | 2 types (annual basic training, OT-specific training) | Role-based cybersecurity training becomes mandatory |
| Required documentation | Recommendations only | 11 documents (cybersecurity policy, asset inventory, etc.) | Systematic documentation across design, construction and operation is essential |
| Reference standards | 3 (ISO/IEC 27001, BIMCO, IACS Rec 166) | 5 (the existing 3 + IACS UR E26/E27, NIST CSF 2.0) | Alignment with international standards is a compliance obligation, not a matter of discretion |
The key point is that Rev.3 adds Govern as a functional element. Cybersecurity has formally moved from being a task for IT staff to an area for which senior management is accountable.
Where E26/E27 sit within the IACS Unified Requirements
E26/E27 belong to the family of IACS Unified Requirements covering shipboard electrical and electronic equipment. Each requirement has a different focus.
| Requirement | Focus | Key requirements |
|---|---|---|
| UR E10 | Environmental testing of equipment | Hardware reliability in the marine environment (temperature, humidity, vibration). Standard test procedures for electrical, electronic and programmable equipment |
| UR E22 | Computer-based systems (CBS) | Design, commissioning and maintenance of CBS used for essential ship functions. Software safety, redundancy and fault tolerance. Classification of CBS by criticality |
| UR E26 | Cyber resilience of ships | Minimum cyber resilience requirements across OT systems. Applies to systems critical to navigation, propulsion and safety. Risk identification and mitigation across the full life cycle, from design and operation to decommissioning |
| UR E27 | Cyber resilience of on-board systems and equipment | Security measures for IT/OT systems and connected equipment. Alignment with IEC 62443 for the secure development lifecycle (SDLC). Defines the responsibilities of shipyards, suppliers and system integrators |
Where E10 addresses the physical reliability of hardware and E22 the safety of software-based systems, E26 and E27 add a further layer on top: cyber resilience. E26/E27 compliance therefore needs to proceed hand in hand with the CBS categorisation defined in E22.
What to do now
Today's IACS UR E26/E27 focus on minimum resilience, but they will evolve towards requiring a stronger response to cyber threats and better information sharing.
- Shipowners — Newbuildings fall under E26/E27; the operating fleet under IMO Rev.3 and, where applicable, NIS2. Both regimes should be managed as a single cybersecurity programme.
- Shipyards — Prepare the E26 deliverables by delivery, and factor in the owner's operational-phase requirements (the 11 operational management items in Rev.3) early to reduce rework after delivery.
- Suppliers — E27 compliance is not about obtaining a certificate; it means building both the security capabilities of the product and the engineering organisation that sustains them.
Gwangmyung Maritime prepares design and operations together, based on this progression as a whole rather than on individual rules.