IACS Unified Requirement E26 Cyber Resilience of Ships adopted April 2022 by International Association of Classification Societies (IACS). Applies as a mandatory class requirement to new ships contracted for construction from 1 July 2024 (originally 1 January 2024, delayed by IACS at Board level). Adopted by all 12 IACS Member Societies (ABS American Bureau of Shipping + BV Bureau Veritas + CCS China Classification Society + ClassNK Nippon Kaiji Kyokai + CRS Croatian Register of Shipping + DNV Det Norske Veritas + IRS Indian Register of Shipping + KR Korean Register + LR Lloyds Register + PRS Polish Register of Shipping + RINA Registro Italiano Navale + RS Russian Register) and incorporated into their respective Rules. Applies to: all new ships above 500 GT under SOLAS or otherwise contracted under IACS Member Society class. Scope: ship-level cyber resilience covering Computer Based Systems (CBS) onboard. Coordinates with IMO Resolution MSC.428(98) Maritime Cyber Risk Management in Safety Management Systems (effective 1 January 2021 SMS audits) + IMO MSC-FAL.1/Circ.3/Rev.2 Guidelines on Maritime Cyber Risk Management + BIMCO Guidelines + ISO/IEC 27001 + IEC 62443 (industrial automation cybersecurity) + NIST Cybersecurity Framework (CSF). UR E26 establishes 5 goal-based requirements aligned with NIST CSF Functions: Identify + Protect + Detect + Respond + Recover. IACS Rec 166 was the precursor non-mandatory recommendation. IACS UR E26 + E27 + scope + Member Societies + 1 July 2024 effective + IMO MSC.428(98) coordination + NIST CSF alignment applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.