IACS, the classification societies' association, revised two Unified Requirements on ship cyber resilience: UR E26, "Cyber Resilience of Ships," and UR E27, "Cyber Resilience of On-Board Systems and Equipment." The originals applied to new ships from 1 January 2024 and were withdrawn. The revised versions apply to ships contracted for construction on or after 1 July 2024.
Safeguard does not certify equipment or operate ships. This is a short guide for makers of onboard systems on what to prepare.
What's affected
Per IACS's press release, the revision standardized survey requirements, added changes from industry feedback, and split applicability into mandatory and non mandatory compliance depending on vessel type and size. The IACS Secretary General said that "IACS has decided to apply only the revised requirements from 1 July 2024."
The titles show the split: E26 is about the ship, E27 is about onboard systems and equipment. Read the current IACS text for exact scope.
What to do now
- Find out whether your customers' newbuilds were contracted on or after 1 July 2024.
- For each onboard system you supply, assemble a component inventory per release, covering firmware, operating system and libraries.
- Scan each inventory for known vulnerabilities and keep dated results.
- Define how a fix reaches a vessel that may be at sea or in a place with poor connectivity, including offline update packages.
- Keep a log of who approved each software change.
An inventory scanned offline works for this: Safeguard can run on premises or fully air gapped, with a local runner so code stays on site.
Why it matters
A ship is a long lived, hard to reach machine. Yard integrators will ask each equipment maker for the same records, so preparing them once saves repeated questionnaires.
Quick check
From which date do the revised UR E26 and E27 apply?
To ships contracted for construction on or after 1 July 2024.
