[IACS UR E26/E27] CBS (Computer Based System) and Category Classification - The Core Framework for IACS UR E26 & E27 Compliance
CBS and Category Classification: The Core of IACS UR E26 & E27 Compliance
Understanding how Computer Based Systems are defined, classified, and protected under the IACS Unified Requirements
- LinkedIn : https://www.linkedin.com/in/shipjobs/
If CBS is not clearly defined, critical vessel systems — propulsion, steering, power management — become vulnerable to cyberattacks and operational failures. IACS UR E26 and E27 mandate CBS protection to mitigate these risks, and non-compliance can result in certification delays and operational disruptions.
Beyond regulatory compliance, defining CBS is essential for ensuring the cybersecurity and operational resilience of IT and OT systems onboard. Shipowners, shipyards, equipment manufacturers, and classification societies must collaborate to establish clear CBS standards.
Before engaging in discussions with stakeholders involved in shipbuilding, consider: 'The Relationship Between CBS Definition and Category Classification for Compliance with IACS UR E26 & E27.'
- CBS = Computer Based System — all programmable IT and OT systems onboard, per IACS UR E26 Sec.2. The acronym is often misunderstood; the correct definition is foundational to compliance.
- UR E26 classifies every CBS into four categories (I, II, III, Others) based on the consequence of failure — from no safety risk to immediate catastrophic risk.
- Category III systems (propulsion, steering, power) and Others (ECDIS, GMDSS) require the highest level of cybersecurity protection.
- UR E27 maps these categories to network architecture — four network types must be kept separate to prevent lower-risk networks from becoming attack vectors into safety-critical CBS.
- Mandatory for new builds: keel-laying on/after 1 Jan 2024. Existing vessels: first class renewal survey on/after 1 Jul 2024.
Ⅰ. CBS Definition in IACS UR E26
CBS — Computer Based System — is the foundational term in IACS UR E26. Every cybersecurity requirement flows from this definition. Misunderstanding what a CBS is leads to gaps in scope, incomplete risk assessments, and failed class surveys.
"A programmable electronic device, or interoperable set of programmable electronic devices, organized to achieve one or more specified purposes such as collection, processing, maintenance, use, sharing, dissemination, or disposition of information.
CBSs onboard include IT and OT systems. A CBS may be a combination of subsystems connected via network. Onboard CBSs may be connected directly or via public means of communications (e.g. Internet) to ashore CBSs, other vessels' CBSs and/or other facilities."
Source: IACS UR E26 (Rev.3, 2024), Section 2 — Definitions
Importance of a Clear CBS Definition
- ·Cybersecurity scope: Undefined CBS means critical systems may be excluded from protection — creating life-threatening vulnerabilities.
- ·Operational continuity: CBS must remain functional during blackout conditions; undefined systems cannot be hardened against failure.
- ·Class certification & insurance: Non-compliance affects class certificate issuance and may void P&I cover for cyber incidents.
Ⅱ. Key Requirements of IACS UR E26
UR E26 translates the CBS definition into enforceable engineering requirements. Understanding these is essential for shipyards designing systems, equipment makers seeking type approval, and owners managing cyber risk.
🛡️ System and Network Protection
- ·Cybersecurity measures must be applied to all IT and OT systems within the CBS definition.
- ·Network segmentation and access control are mandatory — CBS networks must be isolated from passenger, crew welfare, and untrusted IP networks.
- ·Regular security updates and patch management are required; a documented patch policy must be maintained.
📋 Cyber Risk Assessment and Management
- ·A formal cyber risk assessment must be conducted for all CBS during design, installation, and commissioning phases.
- ·A cyber incident response plan and contingency procedures must be documented, drilled, and available to the crew.
- ·System inventories (hardware, software, firmware versions) must be maintained and reviewed at each survey.
⚙️ Ensuring Operational Continuity
- ·CBSs must be designed and configured to remain functional — or fail safely — during blackout conditions and cyberattack scenarios.
- ·Critical systems (propulsion, steering, fire detection) must have documented backup or manual override mechanisms.
- ·Restoration procedures after a cyber incident must be tested and incorporated into the vessel's Safety Management System (SMS).
Ⅲ. Category Classification in IACS UR E26
Not all CBSs carry the same risk. UR E26 classifies every onboard system into four categories based on the consequence of failure — correctly classifying each system is a prerequisite for a compliant cyber risk assessment.
Ⅳ. CBS Definition ↔ Category Classification — The Link
The CBS definition sets what must be protected; the Category Classification sets how much protection is required. Misalignment between CBS scope and category assignment is the most common gap found during class surveys.
Compromised propulsion or steering CBS causes immediate loss of manoeuvrability — direct threat to life and vessel.
Compromised alarm or monitoring CBS delays crew response — eventual escalation to critical failure.
Cat I/II CBSs networked with Cat III systems create lateral movement paths for attackers to reach safety-critical systems.
Network segmentation between category tiers prevents a Cat I breach from propagating to Cat III systems.
- ·Cat I: Inventory all administrative CBSs; apply OS patching and user access controls; log access events.
- ·Cat II: Enhanced access control; segment from Cat III networks; include in cyber risk assessment; document alarm system backup procedures.
- ·Cat III: Full network isolation from IT networks; hardware-level access restrictions; redundant manual override; include in SMS drills and incident response plan.
- ·Others (Statutory): Ensure ECDIS, AIS, GMDSS, LRIT meet IMO MSC-FAL.1/Circ.3/Rev.3; verify at each port-state inspection.
Ⅴ. IACS UR E27 — CBS Network Classification
UR E27 complements E26 by specifying how onboard networks must be structured and protected based on what they carry and who uses them. It translates the CBS category classification into concrete network architecture requirements.
- ·Physical/logical isolation: CBS networks must have no direct internet path to Cat III or Others systems.
- ·Passenger/crew separation: Guest and crew welfare networks must have no routing path to CBS — enforced at both L3 and L2 levels.
- ·Monitoring and anomaly detection: Anomalous behaviour on CBS segments (unexpected connections, port scans) must trigger the vessel's cyber incident response procedure.
Key Takeaways
IACS UR E26 and E27 form an interlocking framework — definition, classification, and network architecture.
The CBS definition establishes what must be protected; Category Classification determines how much protection is required; UR E27's network classification specifies how those systems must be architecturally separated. Together they represent the most comprehensive mandatory cybersecurity standard the maritime industry has ever implemented.
"Strengthening CBS protection is not just a compliance checkbox — it is the foundation of vessel safety and operational continuity."
Shipyards, equipment manufacturers, owners, and class societies must align on CBS scope and category assignment from the earliest design stage to avoid costly rework at survey — and to ensure that the ships of tomorrow are protected from the threats of today.
Comments
Post a Comment