Ship OT Cybersecurity for Vessel Operators: CBS, Zones, Security Levels and SBOM

Ship OT Cybersecurity — A Practitioner's Guide for Vessel Operators

Captain Paul 

Maritime Cybersecurity Consultant · CRSI Specialist

 

If your vessel is under construction or due for a major retrofit after July 2024, IACS Unified Requirements E26 and E27 are no longer optional reading — they are contractual obligations tied to your Classification Society certificate. Yet the same question comes up in every conversation with ship OT/IT engineers: "I know E26/E27 exist, but what do they actually require me to do on board?" This post answers that question directly — no vendor pitch, no generic checklist.

Ⅰ. The Two Documents and Why They Are Different

IACS published E26 and E27 together, but they operate at different levels of the vessel hierarchy.

IACS UR E26

Cyber Resilience of Ships

Vessel-level governance layer — defines how a ship as a whole must be organized, protected, monitored, and recovered.

IACS UR E27

Cyber Resilience of On-board Systems

Component-level product standard — defines what individual CBS must be capable of doing before installation.

In practice: E26 governs how you run the ship's cybersecurity program. E27 governs what you are allowed to buy and install.

Ⅱ. The CBS: The Fundamental Unit of E26/E27

Everything revolves around the Computer-Based System (CBS) — any programmable system on board that performs a function relevant to the safety, security, or operation of the vessel.
(And CBS can be classified into 4 types, and E26 focuses on managing Target and Exclusion. 
reference : https://www.shippauljobs.com/2026/04/efficient-way-to-classify-system-types.html  )

• Navigation systems (ECDIS, GNSS, Radar, AIS)
• Propulsion and steering control systems
• Power management and distribution systems (PMS, EMS)
• Alarm and monitoring systems (AMS, IAS)
• Cargo management systems
• Communication systems (GMDSS, VSAT)
• Vessel data recorders (VDR, S-VDR)

The first practical step in E26 compliance: build and maintain a complete CBS inventory. Every CBS must be identified, documented, and assigned to a Zone.

---

Ⅲ. Zone and Conduit: How E26 Structures the Ship Network

E26 requires the vessel's network to be organized into Zones and connected by Conduits — drawn directly from IEC 62443.

OT Zone (L0–1)

Sensors, actuators, PLCs, DCS — field devices directly controlling physical processes

Control Zone (L2)

SCADA, HMI, Historian, AMS — the supervisory layer

IT / Admin (L3)

Crew network, business systems, shore connectivity

A Conduit is the controlled pathway between two Zones (firewall, data diode, DMZ). No uncontrolled paths between zones are permitted — every connection must be documented, justified, and enforced.

Ⅳ. The Five Functions of E26

E26 organizes the vessel's cybersecurity obligations around five functions — directly mapped from the NIST Cybersecurity Framework:

IDENTIFY

Maintain a complete and current inventory of all CBS — software versions, configurations, and interconnections. This is the foundation.

PROTECT

Implement access controls, network segmentation (Zones and Conduits), software hardening, and secure configuration across all CBS.

DETECT

Establish capability to detect cyber incidents in a timely manner. OT monitoring is now a compliance requirement — detect anomalies, unauthorized changes, and intrusion attempts.

RESPOND

Define incident classification, escalation procedures, isolation of affected systems, and communication to flag state and Classification Society.

RECOVER

Define and implement procedures for restoring affected CBS. Recovery priorities must align with vessel safety criticality — propulsion and navigation before administrative systems.

---

Ⅴ. Security Levels: The E27 Targeting System

E27 introduces Security Levels (SL) to define how much protection a CBS must provide:

Level	Definition	Typical Application
SL 0	No specific security requirements	Non-critical, isolated systems
SL 1	Protection against unintentional violation	Basic operational systems
SL 2	Protection against intentional violation using simple means	Most navigation and control systems
SL 3	Protection against intentional violation using sophisticated means	Safety-critical systems, remote access gateways

For each CBS: define a Target Security Level (SL-T) via risk assessment, then verify the CBS meets a Capability Security Level (SL-C) through Type Approval. When procuring, you must specify required SL-C and demand a valid Type Approval certificate.

Ⅵ. Type Approval: The E27 Procurement Gate

Type Approval under E27 is the mechanism by which individual CBS demonstrate compliance before installation:

1. 1 Manufacturer submits the CBS for evaluation by a Classification Society
2. 2 Society assesses the CBS against E27 requirements at the claimed SL-C
3. 3 If approved, a Type Approval certificate is issued, valid for a defined period
4. 4 Shipyard or operator verifies that installed CBS hold valid TA certificates at the required SL-C

Common gap found during assessments: the CBS inventory exists, but SL-T assignments are either missing or not verified against supplier Type Approval status.

---

Ⅶ. The SBOM Requirement: Often Overlooked

Both E26 and E27 reference the need for software transparency. E26 requires CBS software configurations to be documented and maintained. E27 expects manufacturers to provide information about software components within their systems — effectively a Software Bill of Materials (SBOM) requirement.

Most manufacturers are not yet delivering formal SBOMs. However, Classification Societies are increasingly asking for software component transparency during Annual Surveys. Establishing an SBOM tracking process now puts you significantly ahead of the compliance curve.

Ⅷ. What Applies to Your Vessel: Applicability Rules

If your vessel falls within scope, both E26 and E27 apply simultaneously — you cannot comply with one without the other, since E26 requires CBS that meet E27 standards.

Ⅸ. The Practical Starting Point

The sequence that works in practice — and what a Classification Society surveyor will work through during your Annual Survey:

1

Build the CBS inventory — every programmable system, its location, function, software version, and network connections

2

Define Zones and Conduits — map the network topology and formalize the zone boundaries

3

Assign SL-T to each CBS — based on safety criticality and risk assessment

4

Verify Type Approval status — for each CBS against the required SL-C

5

Implement E26 controls — access control, monitoring, incident response, recovery procedures

6

Document everything — the Cybersecurity Management Plan is a survey deliverable, not an internal document

---

 Series Navigation — Vessel Operators Compliance Guide (4 Parts)

▶ NOW IACS E26/E27 Compliance Guide: What Ship OT/IT Engineers Need to Know

Part 2 Ship OT Monitoring for IACS E26/E27: Required Functions, Scope, and Protocols

Part 3 Automating IACS E26/E27 Annual Survey: What OT Monitoring Can and Cannot Do

Part 4 IACS UR E26/E27 Compliance Matrix: Cybersecurity Solutions for Maritime OT

📖 IACS UR E26 Complete Guide

IACS UR E26 — Cyber Resilience of Ships: The Complete Guide

ZCD · CBS Classification · SCARP · Audit Procedures · E27 Interface — 모든 것을 한 페이지에서.

전체 가이드 읽기 →

Captain Paul

Founder & Editor-in-Chief · ShipPaulJobs

Senior Manager at a global consulting firm specializing in Maritime Cyber Security, AI, and Data Analytics. 17+ years spanning shipbuilding R&D, AI product development, and maritime cyber compliance. Specializes in IACS UR E26/E27, IMO MSC guidelines, and smart ship development. Founder of ShipPaulJobs.

📌 Field Note — Captain Paul

Treating E26 and E27 as a single combined regulation will inevitably cause confusion in practice. "E26 governs how a vessel's cybersecurity program is managed; E27 governs what can be purchased and installed." Getting this distinction clear from the start means every subsequent task can be correctly sorted without confusion about which regulation it belongs to.

The most common friction point in practice: a CBS inventory exists, but SL-T (target security level) assignments are missing, or supplier type approval status (SL-C) hasn't been cross-validated against it. The same applies to SBOM requirements — most manufacturers still don't provide a formal SBOM, but class societies are increasingly requesting software component transparency at annual surveys, making it advantageous to build a tracking system now.

A common misconception in practice:
Assuming that completing a CBS inventory constitutes E26/E27 compliance. An inventory without SL-T assignments, or without cross-validation against supplier type approval (SL-C) status, cannot satisfy procurement and installation requirements — and there is no way to comply with only one of E26 or E27 within the vessel scope.

Key practical takeaways:

• Use CBS inventory construction as the starting point for all work, but document to the level of software versions and inter-system connections.
• Assign a risk-assessment-based SL-T to each CBS, and always cross-validate against supplier type approval (SL-C) status.
• Finalize zone/conduit structure before designing access controls, detection, response, and recovery procedures — and write the cybersecurity management plan from the outset as a document intended for survey submission.

Related Articles

• Ship OT Monitoring for IACS E26/E27: Required Functions, Scope, and Protocols
• IACS E26/E27 Compliance Matrix: Maritime OT Cybersecurity Solutions
• IACS UR E26 vs E27: The Complete Comparison

⚓ Join the ShipPaulJobs Community

Join →