Class Society Cyber Guidelines
IACS UR E26 & E27
Society Profiles · E26/E27 Interpretations · Official Document Downloads
IACS UR E26 & E27 are the unified regulations on ship cyber resilience, mandatory for newbuildings contracted on or after 1 July 2024. Each of the 12 IACS member societies publishes its own interpretation guidelines, reflecting national industry characteristics, shipyard collaboration structures, and regulatory environments. This page lets you review each society's profile and download their official documents at a glance.
Why Class Society Interpretations Matter
IACS UR E26 and UR E27 are unified requirements, so the minimum technical baseline is the same for every IACS member. What differs is how each classification society turns that baseline into its own rule book, guidance notes, optional notations and approval workflow. For a shipyard building hulls for owners who use different societies, or an equipment maker supplying several yards, these differences decide how much documentation has to be rewritten.
In day-to-day projects the differences usually show up in four places:
- Where the requirements sit — integrated into the main classification rules (for example LR and RINA) or published as separate guidance or notation rules (for example BV NR 659 or the KR guide).
- Document format and review sequence — what the society expects in the zones and conduits diagram, asset inventory and design description, and when each document must be submitted for approval.
- Equipment approval under E27 — whether computer-based systems are handled through type approval, product certification or project-specific review.
- Voluntary notations — additional cyber notations (such as DNV CYBER SECURE or BV CYBER) that go beyond the mandatory E26/E27 baseline.
The table below summarises how the nine societies covered on this page implement E26/E27. It is based on the official documents listed in the interactive directory further down.
At a Glance: How Nine Class Societies Implement E26/E27
| Society | Founded | Key document | Cyber notation | Distinctive emphasis |
|---|---|---|---|---|
| ABS | 1862 · USA | CyberSafety Guide v2 (Jun 2025); MVR Part 4 §4-9-13/14 (Jan 2026) | CyberSafety series | NIST CSF-based risk management; dedicated guide for equipment manufacturers (Vol.7) |
| BV | 1828 · France | NR 659 (Jul 2024) | CYBER notation | IEC 62443 zone & conduit method; clause-by-clause mapping to E26 functions |
| CCS | 1956 · China | Guidelines for Ship Cyber Security (2024) | CS notation | Aligns IACS requirements with Chinese national standards and Classified Protection 2.0 |
| CRS | 1949 · Croatia | Guidelines for Cyber Security Onboard Ships (2025) | Cyber Security notation | Close alignment with IMO MSC-FAL.1/Circ.3 and the IACS common baseline |
| DNV | 1864 · Norway | DNV-RU-SHIP Pt.6 Ch.5 Sec.21 | CYBER SECURE (Basic / Advanced) | Security by design; threat analysis at design stage; Korea-specific product certification guide |
| KR | 1960 · Korea | Cyber Resilience Approval and Survey Guide for Ship Automation Systems | Cyber Resilience notation | Bilingual (Korean/English) guide with surveyor checklists for yards and OEMs |
| LR | 1760 · UK | LR-RU-001 Rules and Regulations (Jul 2025) | Cyber Security notation | E26/E27 integrated into the main class rules; supply chain and software integrity focus |
| ClassNK | 1899 · Japan | Cyber Security Guidelines T1348e; UR E22 Rev.3 | ClassNK cyber security notation | Detailed technical guidance based on IEC 62443-3-3 security levels and network topology review |
| RINA | 1861 · Italy | Rules for Ships Part F (2026) | CYBER notation | Strong in cruise and ferry applications; alignment with EU NIS2 and ENISA guidance |
IACS has twelve members. This page currently covers nine of them; Indian Register of Shipping (IRS), Polski Rejestr Statków (PRS) and Türk Loydu (TL) will be added. Always confirm the latest edition on the society's official website before using a document in a project.
Browse each society's profile and official documents
Open a society below to read its profile, its E26/E27 interpretation highlights and the official documents available for download.
E26 vs E27: Who Does What
Most confusion in projects comes from mixing up the two rules. UR E26 looks at the ship as an integrated system, while UR E27 looks at the individual systems that are installed on it. Both apply together on ships contracted for construction on or after 1 July 2024.
| Aspect | UR E26 — Ship | UR E27 — Systems & equipment |
|---|---|---|
| Applies to | The ship as a whole: computer-based systems (CBS) in the scope of the rule and the networks connecting them | Individual CBS and equipment delivered by suppliers for ships under E26 |
| Main responsible party | Shipyard (as system integrator) during design and construction; shipowner during operation | System and equipment suppliers (OEMs) |
| Typical deliverables | Zones and conduits diagram, vessel asset inventory, cyber security design description, ship cyber resilience test procedure, and the owner's ship cyber security and resilience program | System documentation, security capabilities of each system, secure development lifecycle evidence, and test procedures for the security capabilities |
| How it is verified | Plan approval and surveys during construction, then annual surveys in service | Approval of the system (type approval or project-specific) and testing, typically at the factory |
How to Use These Guidelines in Practice
For shipyards
- Confirm the classification society of each hull at contract stage; owners in the same series may choose different societies.
- Map the society's required document list to the E26 deliverables and agree the format of the zones and conduits diagram and asset inventory with class before design freeze.
- Collect E27 documentation from suppliers early; missing supplier evidence is one of the most common causes of approval delays.
- Plan the ship cyber resilience tests into the commissioning and sea trial schedule rather than leaving them to the end.
For equipment manufacturers (OEMs)
- Check whether each society expects type approval, product certification or a project-specific review for your system.
- Build one evidence package mapped requirement-by-requirement to UR E27 and reuse it across societies, adding only society-specific items.
- Keep security capabilities and test results tied to a specific product and software version, since updates may require re-assessment.
For shipowners and managers
- Make sure the ship cyber security and resilience program delivered at handover fits into your safety management system, in line with IMO Resolution MSC.428(98).
- Keep the asset inventory and zones and conduits diagram up to date after every change; they are reviewed again at annual surveys.
- Decide early whether a voluntary cyber notation adds value for your charterers, insurers or fleet policy.
Frequently Asked Questions
Does UR E26 apply to existing ships?
UR E26 and E27 are mandatory for new ships contracted for construction on or after 1 July 2024. Existing ships are not required to comply, but owners can apply the requirements voluntarily, and several societies offer cyber notations that can also be assigned to ships in service.
Are class cyber notations mandatory?
No. The mandatory baseline is UR E26/E27 as implemented in each society's rules. Notations such as DNV CYBER SECURE, BV CYBER or the ABS CyberSafety series are optional and are usually chosen when an owner or charterer wants a higher, documented level of cyber resilience.
Will an E27 approval from one society be accepted by another?
Not automatically. Because the requirements are unified, much of the evidence can be reused, but each society decides how it recognises approvals issued by others. Suppliers should confirm the acceptance route with each society early in the project rather than assume it.
Which document should I read first?
Start with the rule text of the society that classes your ship (the mandatory requirements), then use that society's guidance notes for interpretation and examples. The IACS UR E26 and E27 texts themselves remain the common reference for all members.
Note: The summaries on this page are the author's interpretation for orientation only. They do not replace the official rules. Where they differ, the latest edition published by the classification society and IACS prevails.
Related reading on ShipPaulJobs
- IACS UR E26 Compliance Series (1/7): The Cyber Resilience System Integrator
- IACS UR E26 Compliance Series (2/7): Zones and Conduit Diagram
- International Association Compliance Guidelines
- National and Port Security Compliance Guidelines
Specialises in OT/IT cyber security and IACS regulatory analysis for the shipping and shipbuilding industries. Compiles E26/E27 interpretation profiles for each class society and provides practical guides for use by shipyards and equipment manufacturers.
🌐 More Articles ↗
Comments
Post a Comment