Ship Cyber Rules Find Their Way Back to the Shipyard — What Korea's Maritime Safety Act Amendment Asks of Global Shipbuilding
A Korean bill on diagnosing the cyber safety of ships in service never mentions shipyards. What the state will measure is what the yard integrated, documented and delivered. A global comparison of who regulates the yard, and how.
- LinkedIn : https://www.linkedin.com/in/abysstoinfinity
Introduction — The bill does not mention shipyards
On 18 September 2026 a partial amendment to Korea's Framework Act on Maritime Safety (Bill No. 2221467, sponsored by Rep. Song Ok-joo and eleven others) was filed at the National Assembly. The statement of reasons on the Assembly's bill information system is short. Electronic chart use and ship-shore networks such as Starlink are expanding, cyber risk is growing with them, and so the bill creates a legal basis for the Minister of Oceans and Fisheries to diagnose maritime cyber safety, evaluate the actual state of it, and establish and implement cyber safety measures (a new Article 12-2). (National Assembly bill information system)
Shipyards appear nowhere in this bill. It governs the operational phase, and the party it empowers is the state. This article reads it as a shipbuilding matter anyway. In 2025 China took 63% of new orders by compensated gross tonnage and Korea 21% (Clarksons data as reported by eworldship and cited by SCMP), and UNCTAD states that 91% of ships completed in 2025, in gross tonnage terms, were built in China, the Republic of Korea or Japan. The cyber resilience of the world fleet is decided, in practice, in the design offices and commissioning berths of three countries. When one of them says the state will diagnose the cyber safety of ships in service, the question is who built the thing being diagnosed.
The text of the bill itself had not been published at the time of writing. This article therefore does not assess the wording of the article. It starts from what the statement of reasons says.
Part 1 — What the bill actually does
Press reports say current law has no provision for state-level diagnosis and response. That is half right. The Framework Act on Maritime Safety already defines "maritime cyber safety" in Article 3(6) and, in Article 4(2), requires the state and local governments to establish and implement policies for, among other things, maritime cyber safety management. The gap comes after that. The Act has no provisions on diagnosis, evaluation or incident notification.
That gap has been filled by a ministerial notice, the Guidelines on Maritime Cyber Safety Management (MOF Notice No. 2023-74, currently No. 2024-52). Article 4 says the Minister "may establish and implement" measures. Article 5 says the Minister "may conduct" a diagnosis or evaluation of ships and companies and "may request" the shipowner to correct weaknesses found. Article 17 requires shipowners to notify the Minister "without delay" when a cyber attack causes, or threatens to cause, a marine casualty. The notice applies to ships and companies that operate a safety management system under Article 46 of the Maritime Traffic Safety Act. (Korea Law Information Center)
The statement of reasons and Articles 4 and 5 of the notice have the same structure. Until the text is published this cannot be stated as fact, but the bill reads as one that lifts the Minister's existing powers from a notice into statute. The ministry also said, in its 31 October 2024 plan to strengthen maritime cyber safety, that it would enact a law, targeted to take effect in 2027, covering cyber safety management systems for private shipping companies and ships and a security certification scheme for ships and equipment. (MOF press release) The present bill is the step before that: the state measures first. The phrase shipbuilders should note is the later one, security certification for ships and equipment.
Part 2 — Why this is a shipyard matter: what gets diagnosed is what the yard delivered
IACS UR E26 (Cyber resilience of ships) Rev.1 identifies four stakeholders: shipowner, systems integrator, supplier and classification society. It defines the systems integrator as follows.
Until delivery, the party responsible for the ship's cyber resilience is the shipyard unless a contract says otherwise. At delivery the yard hands the owner the suppliers' documentation and everything it produced itself (section 5): the zones and conduit diagram, the cyber security design description, the vessel asset inventory, any risk assessment for excluded computer based systems, and the test procedure. After delivery the owner maintains these and must have its own Ship cyber security and resilience program approved before the first annual survey.
What would a state look at when it diagnoses a ship in service? Whether an asset inventory exists, how the network is segmented, how remote access is controlled. That is the documentation and configuration the yard produced at the design stage. An operational-phase law returns to the yard by four routes.
The bill regulates the ship in service. What it measures was delivered by the shipyard.
Part 3 — What shipyards already carry: the systems integrator under UR E26/E27
Duties during construction
E26 does not only ask for documents. It places security duties on the integrator during the building period. The integrator "shall ensure that malware protection is kept updated during the construction phase" (4.2.3.4.2) and "shall prevent unauthorised access to the CBSs during the construction phase" (4.2.4.4.2). Communication with untrusted networks may only be enabled temporarily (4.2.6.4.2), and use of physical interface ports must be controlled (4.2.7.4.2). At commissioning, after other commissioning activities are complete, the cyber resilience test is carried out with the class surveyor present.
The risk these clauses address is documented. The industry Guidelines on Cyber Security Onboard Ships v5 list as a vulnerability the fact that automation systems are often "integrated by shipyards with minimal regard to cyber issues", and describe a newbuild dry bulk ship delayed from sailing for several days by a virus in its ECDIS, at a cost in the hundreds of thousands of US dollars.
Collecting supplier documentation
UR E27 requires suppliers to produce an asset inventory, topology diagrams, a description and test procedure of security capabilities, security configuration guidelines, secure development lifecycle documents and more, and to deliver the approved versions to the systems integrator (section 6.2). Type approval is voluntary, and even with type approval a ship-specific step remains: "This classification process is ship-specific and shall result in a System certificate." (section 6) For every hull the yard must gather approved documents from dozens of suppliers and reflect them in the vessel asset inventory.
Bottlenecks that have surfaced
Readiness in numbers
According to the 2025 Thetius, CyberOwl and HFW report (14 interviews and 142 survey responses; shipyards are a subset, so the yard sample is small), only 17% of shipyards feel they have adequate in-house cyber security expertise and 64% say they lack understanding of how to deliver vessels that are secure by design. Owners are no further ahead. Only 32% include cyber security in their newbuild teams, and one in six understands what to look for at handover. In DNV's Maritime Cyber Priority 2024/25 (489 respondents), 41% said cyber security is not typically involved in procurement, falling to 27% among shipbuilding and yard professionals, which DNV attributes to UR E26/E27.
Contracts have not caught up. The same Thetius report says, citing HFW, that "issues arising out of E26 and E27 are not making it into the contracts of newbuilds", and states that E26 has made cyber resilience at the design stage an essential factor in seaworthiness.
Part 4 — Global ship cyber security compliance: four layers
Product layer — class enforces, IMO stays non-mandatory
The only cyber standard that applies as a mandatory requirement to newbuildings and their equipment worldwide is IACS UR E26/E27, and every IACS member implements the same requirements. The Korean Register did so through its Guidance for Cyber Resilience of Ships and Systems, ClassNK through Part X of its steel ship rules and accompanying guidelines, CCS through its Guidelines for Ship Cyber Security (2024, with a 2025 edition since), DNV through Cyber secure (Essential), and BV through NR659. The integrator definition is the same across them. The Korean Register says the role is performed by the shipyard until delivery unless contractually assigned elsewhere. ClassNK says "Except when contracted or designated otherwise, this is the shipyard."
On the IMO side everything is guidance. MSC-FAL.1/Circ.3 is now at Rev.4 (28 May 2026), and its paragraph 4.2 lists UR E26 and E27 as additional standards. FAL 50 and MSC 111 agreed to develop a goal-based, non-mandatory Maritime Cyber Code with a 2028 target (DNV), and the MASS Code adopted in May 2026 also starts as non-mandatory.
Corporate layer — who regulates the shipyard as a company
The same questions were put to the leading shipbuilding nations by order and output share, plus the EU and the United States.
| Question | China | Korea | Japan | EU | United States |
|---|---|---|---|---|---|
| General law placing cyber duties on the yard as an entity | The Cybersecurity Law places multi-level protection and incident reporting duties on every network operator, shipyards included. Nothing names shipbuilding. The critical information infrastructure regulation lists the defence science and technology industry but not shipbuilding | None found. National core technologies in shipbuilding carry protection duties under the industrial technology protection law (anti-leakage) | Ship parts are designated critical products. Certified suppliers are "recommended" to take cyber measures, with an incident reporting Q&A | NIS2 Annex II covers NACE 30 manufacturing, which includes 30.1 building of ships | No sector-specific duty in force found. CIRCIA incident reporting rules are pending. CISA's Critical Manufacturing Sector includes commercial ship manufacturing (a designation, not a duty) |
| Naval and defence trigger | The CII regulation names the defence science and technology industry (designation of individual yards not confirmed) | Defence Technology Security Act | None found | Not researched | DFARS 7012 and NIST SP 800-171. CMMC Phase 2 suspended in July 2026 according to law firm commentary |
| State support for yard and equipment cyber | None found | Technical and cost support for small equipment makers seeking IACS certification (2024 plan) | No cyber-specific support found | No yard-specific programme found | None found |
| Cyber in autonomous ship law | Trial rules include network security requirements (secondary source) | Autonomous ship act lists "security" of ship-shore data exchange in safety evaluation | Safety guidelines include a cyber security section | None found | None found |
"None found" means this research did not confirm it, not that it does not exist. The picture is still clear. Within the scope researched, the EU is the only jurisdiction whose cyber statute names shipbuilding as a regulated sector. General cyber laws, such as China's Cybersecurity Law, bind yards like any other company but do not single them out. NIS2 Annex II 5(f) covers NACE division 30, "Manufacture of other transport equipment", and NACE 30.1 is "Building of ships and boats". EU yards above the medium-sized threshold are candidate important entities, with risk management duties and 24-hour and 72-hour incident reporting. The same directive, when it comes to shipping companies, says "not including the individual vessels operated by those companies". The EU leaves the ship out and regulates the company.
In the three countries that build most of the world's tonnage, no statute singles out the yard. The sector-specific work is done by class rules and contracts. Japan comes closest on the statutory side. Under its economic security regime, the transport ministry's policy recommends that certified suppliers obtain ratings under a supply chain security evaluation scheme and use JC-STAR labelled IoT devices, and a separate Q&A asks them to file a preliminary report within three to five days of recognising a ransomware or similar attack and a detailed report within 30 days.
Contract layer — standard forms have only just moved
SHIP25, the Norwegian standard newbuilding contract published in October 2025, added a stand-alone Clause 23, Cyber Security. It sets out the builder's technical, operational and organisational measures, an early warning "at the latest within twelve (12) hours" of an incident, support for the buyer's NIS2 reporting, and audit rights. The clause governs the yard's own digital environment. The words E26 and E27 do not appear anywhere in the form, and the cyber resilience of the delivered ship is still left to the class-rules clause and the specification. Other standard forms, such as BIMCO NEWBUILDCON (latest edition 2007) and the SAJ form, appear from their dates to have no cyber clause, though this was not confirmed from the texts.
Operational layer — the owner's questions are passed to the yard
IMO Resolution MSC.428(98) only "encourages", but flag States turn it into an ISM audit requirement by circular (Liberia calls it "mandatory"). OCIMF SIRE 2.0 question 7.5.1 and RightShip RISQ question 12.7 ask the same of tankers and bulk carriers. The United States excludes foreign-flagged vessels from 33 CFR Part 101 Subpart F but has said it will look at cyber practices in port state control. Korea's diagnosis and evaluation would add one more questioner to this list. The more questioners there are, the more owners want the answers in hand at delivery.
The yard itself is a target
| Year | Shipyard | What happened |
|---|---|---|
| 2016, 2021 | Daewoo Shipbuilding & Marine Engineering (Korea) | 2016 intrusion and data leak; 2021 reports of renewed hacking attempts |
| 2018 | Austal (Australia) | Data breach and extortion attempt |
| 2020 | Vard Langsten (Norway) | Ransomware |
| 2020 | Kawasaki Heavy Industries (Japan) | Unauthorised access through overseas offices |
| 2023 | Lürssen (Germany) | Ransomware halted operations |
| 2023 | Fincantieri Marinette Marine (United States) | Ransomware stopped CNC machines and briefly delayed naval construction |
The list holds only publicly reported cases, so its geography reflects reporting habits. The point is that the yard's security (corporate layer) and the delivered ship's security (product layer) are joined at design data, integration, production OT and the supply chain.
Part 5 — Five currents in the comparison
Part 6 — Implications for shipbuilding
Shipyards. Treat the delivery package as a deliverable. As the number of operational-phase questioners grows, document quality becomes a variable in price negotiation and post-delivery disputes. The construction-phase duties on malware and access control cannot be separated from the yard's own security. EU yards already carry entity-level duties under NIS2, and yards elsewhere contracting with EU owners will be asked for the same through SHIP25-style clauses.
Equipment makers. In a structure where type approval is repeated per class society, a separate Korean certification for ships and equipment would add another layer. Whether such a scheme accepts IACS type approval as it stands matters to every supplier worldwide. In the EU market, whether a product falls under the Marine Equipment Directive decides whether the Cyber Resilience Act applies.
Shipowners. E26 hands responsibility to the owner after delivery. Put a cyber specialist on the newbuild team, give the integrator information on owner-supplied equipment at the design stage, and write into the contract what must be received at handover.
Legislators. Aligning diagnosis and evaluation criteria with E26 deliverables and the IMO guidelines reduces duplication for yards and owners and makes results comparable across countries. A bespoke standard adds one more layer of fragmentation. Standards set by a country that takes a fifth of the world's new orders do not stay domestic. They travel with the ships it delivers.
Closing
This bill places no duty on shipyards. But once a state starts measuring the cyber safety of ships in service, what it measures is what the yard integrated, documented and delivered.
An operational-phase law returns to the yard through the diagnostic yardstick, the gap with existing ships, the announced certification scheme and the owner's specification. The global comparison shows that cyber statute names the shipyard only in the EU, and that class rules and contracts do the sector-specific work everywhere else. How the gap is filled will be seen in the text of the bill, in its subordinate legislation and in the law announced for 2027.
Sources
This article is an analysis of public documents and does not constitute legal advice. The text of Bill No. 2221467 had not been published when this was written.
Owner-side maritime cybersecurity advisor covering IACS UR E26/E27 compliance, zone and conduit design, and OT/IT security architecture for commercial vessels — working across LR, ClassNK, DNV, ABS, and BV newbuilding projects.
🌐 More Articles ↗⚓ Join the ShipPaulJobs Community
Join →
Excellent insight. Maritime cyber regulations may target ships, but their requirements ultimately find their way back to the shipyard through design, integration, commissioning, and documentation.
ReplyDelete