📋 Compliance
IACS UR E26/E27
Annual Survey
3-Part Series · Part 3
Automating IACS E26/E27 Annual Survey: What OT Monitoring Can and Cannot Do
Ship OT Cybersecurity — A Practitioner's Guide for Vessel Operators
Captain Paul
Maritime Cybersecurity Consultant · CRSI Specialist
You have read through the E26/E27 framework in Part 1. You understand what a capable OT monitoring solution must deliver in Part 2. Now the operational question: does deploying that solution actually reduce the burden of Annual Survey — and if so, by how much? The honest answer is 60% yes, 40% no. This post explains exactly where that boundary falls, why it exists, and how to turn that 60% into a genuine operational advantage.
60%
Can Be Automated
Technical evidence layer — answerable with data from continuous monitoring
40%
Always Requires Surveyor
Organizational competence — not directly observable from network telemetry
Ⅰ. Why Complete Automation Is Structurally Impossible
IACS E26 does not only require technical controls. It requires those controls to be embedded in a functioning management system — documented procedures, trained crew, defined responsibilities, and tested response capabilities.
A Classification Society surveyor is not just checking whether your firewall rules are in place. They are assessing whether the people responsible for cybersecurity on board actually understand what they are doing and can demonstrate it. The IMO, IACS, and Classification Societies have consistently positioned maritime cybersecurity as a management discipline, not purely a technical one.
No OT monitoring solution can verify that your crew's incident response drill was conducted properly, or that your cybersecurity management plan actually reflects how the vessel operates. Understanding this boundary is a competitive advantage — those who believe vendor claims of "full compliance automation" will be disappointed at their next survey.
Ⅱ. What OT Monitoring Can Automate: The 60%
The technical evidence layer — items where the surveyor's question is answerable with data rather than judgment:
1
CBS Inventory Verification
Continuously updated CBS list (device names, IP, firmware, zone assignments) + change log since last survey. Converts manual reconciliation into an automated comparison report. E26 Clause 4 (Protect)
2
Network Topology Validation
Current topology map vs. approved baseline, with deviations automatically flagged. What previously required a network engineer to manually trace connections can be produced on demand. E26 Clause 4 — Zone and Conduit integrity
3
Software Version and Patch Status
Structured vulnerability report — CBS name, software version, CVEs, CVSS scores, patch status, compensating controls. SBOM-capable vessels extend this to component-level analysis. E27 SL-C — software integrity and patch management
4
Access Control Log Review
Authentication events, failed login attempts, privilege escalation, access outside normal operational hours — all aggregated in a centralized, tamper-evident store. E27 Clause 6 — audit trail requirements
5
Security Event History
Event count by category, notable incidents with full timeline reconstruction, response actions documented. If no significant incidents occurred, the absence of events is itself documented evidence of a functional monitoring capability. E26 Clause 5 (Detect) + Clause 6 (Respond)
6
Remote Access Session Documentation
Complete session log — initiation, authentication method, systems accessed, duration, termination. Covers all vectors: VPN, jump servers, vendor satellite connections. Sessions deviating from approved procedure are automatically flagged. E26 Clause 4 — remote access controls
Ⅲ. What Cannot Be Automated: The 40%
Three categories: physical verification, document quality assessment, and human competence evaluation.
PHYSICAL
Physical and Cable Verification
Network monitoring sees traffic — it does not see cables. A physically connected but dormant system, or an unauthorized wireless access point with no active clients, is invisible to passive monitoring. The surveyor will physically inspect network cabinets and trace cable runs.
DOCUMENT
Cybersecurity Procedure Quality Assessment
OT monitoring can log that procedures exist and track version history. It cannot assess whether they are fit for purpose. A cybersecurity management plan copied from a template and never adapted to the specific vessel will have correct file metadata but will fail the quality assessment.
CREW
Crew Training and Competence Verification
Vessels with sophisticated monitoring deployments sometimes have crew who cannot explain what the monitoring system does or how to initiate an isolation response. The monitoring data looks clean; the human capability behind it does not match. E26 Clause 6 — training records and drill verification.
RESPONSE
Incident Response Capability Demonstration
The surveyor may ask for a live walkthrough of what happens when an alert fires — who gets notified, what is the decision tree for isolation, how is the flag state informed. The monitoring solution provides the alert; what the organization does with that alert is what the surveyor is evaluating.
Ⅳ. The Continuous Survey Model: Turning 60% Into a Strategic Advantage
Traditional Annual Survey preparation follows a predictable pattern: in the weeks before the survey, engineers scramble to collect logs, reconcile the CBS inventory, and produce evidence packages that should have been maintained continuously throughout the year.
OT monitoring, properly deployed, eliminates this preparation cycle entirely for the automatable 60%. On the day the surveyor arrives, the system generates the technical evidence package on demand — with no manual preparation required.
Before: Reactive
- ✗Last-minute log collection
- ✗Manual CBS reconciliation
- ✗Expensive, stressful, incomplete
- ✗Day 1 of survey: reviewing evidence adequacy
After: Continuous
- ✓Evidence generated on demand
- ✓Surveys complete faster
- ✓Fewer findings (issues caught continuously)
- ✓Day 1: focus immediately on the 40%
Ⅴ. Building the Pre-Survey Evidence Package
The monitoring solution must produce evidence covering six domains:
01
Technical Inventory Evidence — Current CBS list with version data and zone assignments, change log since last survey, comparison against approved baseline
02
Network Topology Evidence — Current topology map, comparison against approved topology, list of any unauthorized connections detected and remediated
03
Vulnerability Management Evidence — Current unpatched vulnerability list with CVSS scores, patch history, documented compensating controls for accepted risk items
04
Access Control Evidence — Authentication event summary, remote access session log, privileged access events, access policy violations detected and addressed
05
Security Event Evidence — Incident summary, full timeline for significant events, response actions taken, closure status for all identified incidents
06
Monitoring Capability Evidence — Confirmation the monitoring system was operational throughout the survey period, alert response time statistics, any monitoring gaps with explanations
Ⅵ. A Realistic Timeline for Implementation
For vessel operators currently without OT monitoring, the path to survey-ready continuous monitoring is typically six months for a single vessel:
M 1–2
Foundation
CBS inventory construction, network topology documentation, Zone and Conduit formalization. This work must precede monitoring deployment — you cannot baseline what you have not documented.
M 3–4
Deployment
Monitoring solution installation, passive sensor placement at SPAN ports or TAPs, initial traffic capture and protocol identification. Expect 2–4 weeks of baseline learning before anomaly detection is reliable.
M 5–6
Calibration
Tuning alert thresholds, establishing normal operational parameters per CBS, integrating host log sources. This phase is frequently underallocated in project plans and is the most common cause of post-deployment dissatisfaction.
M 6+
Operations
Continuous monitoring, monthly evidence package review, quarterly procedure updates. Annual survey preparation reduced to package generation and the 40% human assessment components.
The Bottom Line
OT monitoring does not eliminate the Annual Survey. It does not replace the surveyor, remove the need for trained crew, or make cybersecurity management plans write themselves.
What it does is remove the preparation burden for 60% of the survey process, convert reactive evidence collection into continuous evidence generation, and shift the survey conversation from "do you have the documentation?" to "does your operation match what the documentation says?"
That shift — from documentation compliance to operational compliance — is where the genuine value of IACS E26/E27 lies. The monitoring solution is the tool. The outcome depends on how you use it.
📚 Series Navigation — 4 Parts
#IACS_E26
#IACS_E27
#AnnualSurvey
#ShipCybersecurity
#OTMonitoring
#ContinuousSurvey
#ClassificationSociety
#CBS
#Maritime40
Captain Paul
Maritime Cybersecurity Consultant · CRSI Specialist
Captain Paul is the editorial voice of ShipPaulJobs — an independent Maritime Industry 4.0 platform for shipbuilding and maritime professionals. Views expressed are based on independent consulting practice and do not represent any Classification Society or vendor position.
Comments
Post a Comment