IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
IACS Unified Requirements E26 (the ship as a whole) and E27 (onboard systems and equipment) on cyber resilience, both in Rev.1 of 2023, are applied uniformly by IACS member societies to ships whose building contract is signed on or after 1 July 2024 (the April 2022 originals were withdrawn before taking effect). E26 treats the ship as a whole: 17 requirements under identify, protect, detect, respond and recover (asset inventory, security zones, network protection, malware protection, access control, wireless, remote access, portable devices, monitoring, diagnostics, incident response, independent local control, network isolation, fallback to a minimal risk condition, recovery, backup and controlled restart), demonstrated through design documents, witnessed commissioning tests and an owner's cyber security and resilience programme checked at annual and special surveys, with a risk-assessed route for excluding isolated systems. E27 sets what suppliers must deliver: documentation, 30 required and 11 additional security capabilities drawn from IEC 62443-3-3, a secure development lifecycle drawn from IEC 62443-4-1, and plan approval with survey and factory acceptance testing leading to a System certificate.
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems is a compliance framework from International (IACS, 12 classification societies) with 7 domains and 83 controls that map to 89 other frameworks. The largest domains are UR E27 section 4: security capabilities – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems (41 controls), UR E26 section 4: requirements (identify, protect, detect, respond, recover) – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems (17 controls), UR E27 section 3: CBS documentation – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems (10 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
UR E26 section 4: requirements (identify, protect, detect, respond, recover) – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
UR E26 sections 5 and 6: demonstration of compliance and exclusions – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
| Code | Title |
|---|---|
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E26-5.1 | E26 5.1 During design and construction phases |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E26-5.2 | E26 5.2 Upon ship commissioning |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E26-5.3 | E26 5.3 During the operational life of the ship |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E26-6 | E26 6 Risk assessment for exclusion of CBS from the application of requirements |
UR E27 section 2: security philosophy – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
| Code | Title |
|---|---|
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-2.3 | E27 2.3 Essential systems availability |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-2.4 | E27 2.4 Compensating countermeasures |
UR E27 section 3: CBS documentation – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
UR E27 section 4: security capabilities – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
UR E27 section 5: secure development lifecycle – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
| Code | Title |
|---|---|
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.1 | E27 5.1 Controls for private keys (IEC 62443-4-1 SM-8) |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.2 | E27 5.2 Security update documentation (IEC 62443-4-1 SUM-2) |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.3 | E27 5.3 Dependent component security update documentation (IEC 62443-4-1 SUM-3) |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.4 | E27 5.4 Security update delivery (IEC 62443-4-1 SUM-4) |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.5 | E27 5.5 Product defence in depth (IEC 62443-4-1 SG-1) |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.6 | E27 5.6 Defence in depth measures expected in the environment (IEC 62443-4-1 SG-2) |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.7 | E27 5.7 Security hardening guidelines (IEC 62443-4-1 SG-3) |
UR E27 section 6: demonstration of compliance – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
| Code | Title |
|---|---|
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-6.2 | E27 6.2 Plan approval |
| iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-6.3 | E27 6.3 Survey and factory acceptance test |
Your Compliance Coverage
If you comply with IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems, you already cover:
IACS Recommendation No. 194 - Cybersecurity Controls for Existing Ships
14%
14 controls mapped
Compare →OWASP ASVS
8%
8 controls mapped
Compare →MITRE D3FEND
8%
8 controls mapped
Compare →+ 86 more: AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) (8%), BSI IT-Grundschutz (8%)
See all 89 mapped frameworks ↓Maps to 89 other frameworks
Coverage is not the same as your position
This page shows what IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems and who does it apply to?
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems is a compliance framework from International (IACS, 12 classification societies) with 7 domains and 83 controls. IACS Unified Requirements E26 (the ship as a whole) and E27 (onboard systems and equipment) on cyber resilience, both in Rev.1 of 2023, are applied uniformly by IACS member societies to ships whose building contract is signed on or after 1 July 2024 (the April 2022 originals were withdrawn before taking effect). E26 treats the ship as a whole: 17 requirements under identify, protect, detect, respond and recover (asset inventory, security zones, network protection, malware protection, access control, wireless, remote access, portable devices, monitoring, diagnostics, incident response, independent local control, network isolation, fallback to a minimal risk condition, recovery, backup and controlled restart), demonstrated through design documents, witnessed commissioning tests and an owner's cyber security and resilience programme checked at annual and special surveys, with a risk-assessed route for excluding isolated systems. E27 sets what suppliers must deliver: documentation, 30 required and 11 additional security capabilities drawn from IEC 62443-3-3, a secure development lifecycle drawn from IEC 62443-4-1, and plan approval with survey and factory acceptance testing leading to a System certificate. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems actually require?
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems has 83 controls organised across 7 domains. The largest domains are UR E27 section 4: security capabilities – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems (41 controls), UR E26 section 4: requirements (identify, protect, detect, respond, recover) – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems (17 controls), UR E27 section 3: CBS documentation – IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems (10 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems do I already cover?
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems maps to 89 other compliance frameworks. The top mapping partners are IACS Recommendation No. 194 - Cybersecurity Controls for Existing Ships (14% coverage), OWASP ASVS (8% coverage), MITRE D3FEND (8% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems?
Start your IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 83 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,064 frameworks.
Get Started Free →Free forever, no credit card required