Back to ship cybersecurity overview

IACS UR E26 / E27 Compliance

Settle system types late, and the schedule slips.

The scope of documents to submit is fixed only once system types are confirmed. We settle types at maker selection and re-assess risk at every stage.

Contact us See deliverables by role
If types are settled late Gwangmyung Maritime

  1. 01Maker selection · quotation

    If types are settled late

    Unable to explain whether UR E27 applies.

    Gwangmyung Maritime

    RA 1 · Types confirmed at selection; class guidance provided

  2. 02Approval drawings

    If types are settled late

    Repeated class comments due to inadequate definition of security functions and external interfaces.

    Gwangmyung Maritime

    RA 2 · Threat exposure paths assessed from drawings and cabling

  3. 03FAT

    If types are settled late

    Account management, logging, backup and recovery, and remote access controls found to fall short.

    Gwangmyung Maritime

    RA 3 · Controls assessed against the real operating environment

  4. 04Delivery

    If types are settled late

    Software and network architecture changes and a delivery-schedule adjustment are required, and the yard reviews alternative suppliers.

    Gwangmyung Maritime

    Handed over into operation under SCARP

System type classification

The scope of documents to submit is fixed only once each system’s type is confirmed. An unconfirmed type is a schedule risk in itself.

Non-CBS
Not a computer-based system (CBS) under the UR E26 criteria
Non-CBS supporting evidence required
Out-of-Scope
A CBS, but outside the UR E26 1.3.2 scope of application
Out-of-scope supporting evidence required
Exclusion
A CBS, but excluded from requirement application under the UR E26 6.4 acceptance criteria
Exclusion supporting evidence required
Target
A CBS that falls under none of the above, and is therefore subject to UR E26
Full design documentation submission mandatory
Three-phase risk assessment for early type confirmation

Submission scope remains fluid until system types are confirmed, so we re-assess risk at every stage from maker selection onward.

RA PHASE 1

Maker Selection

  • Early identification at selection
  • Class guidelines + 1:1 classification
  • Upfront supplier consultation

RA PHASE 2

Drawing & Cabling

  • Stage 1 type + asset information
  • Integrated drawing · cabling review
  • Threat exposure path assessment

RA PHASE 3

Operating Environment

  • Reflects the actual operating environment
  • Response capability · level of control
  • Assessment against known threats
TIER 1 E26 Ship-wide Owner · Shipyard TIER 2 E27 Per-system Supplier · Integrator TIER 3 SCARP Operation Ship Mgmt. Co.

Three-tier scope of ship cyber resilience mandate

Responsibility expands across E26 (ship-wide) → E27 (per-system) → SCARP (operation lifecycle).

E26
Establishes the ship-wide cyber security concept and management framework.
E27
Requires design and operation that presume cyber security in each system.
SCARP
Runs the ship cyber resilience programme continuously in the operation phase.

UR E27 supplier readiness

Products that cannot explain and demonstrate UR E27 conformity become hard to select during a yard’s design, procurement and approval process.

TA · SoC · SoF — means of demonstrating conformity, not a grade

TA Type Approval
Suited to suppliers repeatedly delivering the same standard product to multiple yards and vessels.
SoC Statement of Compliance
A realistic starting point when a specific product version or project takes priority.
SoF Statement of Fact
Focused on the design approval and product inspection procedures of an individual vessel project.

Responding to UR E27 is not about obtaining a certificate — it is about building both the product’s security capability and the engineering system that produces and sustains it.

One-stop Service

Advisory Design Integration Support Operation Readiness

For System Supplies UR E27 · 10 deliverables · 41 requirements

Deliverables — UR E27 sec.

  1. 3.1.1CBS Asset Inventory
  2. 3.1.2Topology Diagram
  3. 3.1.3Description of Security Capabilities
  4. 3.1.4Test Procedure for Security Capabilities
  5. 3.1.5Security Configuration Guidelines
  6. 3.1.6Secure Development Lifecycle (SDL) Documentation
  7. 3.1.7Plans for Maintenance and Verification
  8. 3.1.8Information Supporting Incident Response and Recovery Plans
  9. 3.1.9Management of Change Plan (MoC)
  10. 3.1.10Test Reports
For System Integration UR E26 · 6 compliance deliverables + risk management · security solutions · FAT attendance

Demonstration of Compliance — UR E26 sec.

  1. 5.1.3Ship Asset Inventory
  2. 5.1.1Zones and Conduit Diagram
  3. 5.1.2Cyber Security Design Description
  4. 5.1.4Risk Assessment for Exclusion of Computer-Based Systems
  5. 5.1.5Description of Compensating Countermeasures
  6. 5.2.1Ship Cyber Resilience Test Procedure

Also delivered

  1. Risk assessment and risk management for non-compliant systems (UR E26 · E27)
  2. Security solution supply — domain controller, network monitoring, NIDS, WSUS, anti-malware server, firewall, L2/L3 managed switch
  3. FAT audit attendance for compliance checks
For Ship Management and Operation UR E26 on the shipowner’s behalf · 12 compliance items + cyber ship design

Cyber Ship Design

  1. Shipowner's detailed cyber requirements (L1 · L2)
  2. Gap analysis — owner policy vs IACS UR E22 · E26 · E27, then USCG and IMO MSC revisions
  3. Penetration testing for vessels (fleet)

Demonstration of Compliance (12)

  1. Ship Cybersecurity and Resilience Program (SCARP)
  2. Management of Change (MoC)
  3. Management of Software Updates
  4. Management of Firewalls
  5. Management of Malware Protection
  6. Management of Access Control
  7. Management of Remote Access
  8. Management of Mobile and Portable Devices
  9. Detection of Security Anomalies
  10. Verification of Security Functions
  11. Incident Response Plans
  12. Recovery Plans

Need to address IACS UR E26 / E27?

Consult with our experts to meet compliance requirements.

Contact us