Maritime Compliance · Global Shipbuilding & Maritime Regulation
Maritime Compliance
📌 Blogger Label : "Compliances"
Guidance on IACS UR E26/E27, IMO regulations, classification society requirements, and cybersecurity standards shaping global shipbuilding and vessel operations — organized by topic.
This hub tracks the key international and regional frameworks governing maritime cybersecurity and vessel compliance. Content is reviewed by credentialed maritime cyber professionals and aligned with primary regulatory sources.
Last reviewed: September 2026 | Editorial & Verification Policy
Regulatory Framework at a Glance
IACS
UR E26 — Cyber Resilience of Ships
Mandatory for newbuildings contracted on or after 1 July 2024. Covers shipboard OT/IT system requirements, network segmentation, and supplier cyber obligations.
→ Official IACS UR E26 ↗IACS
UR E27 — Cyber Resilience of On-board Systems
Companion to E26. Sets security requirements for software, hardware, and system integrators supplying equipment to class-surveyed vessels.
→ Official IACS UR E27 ↗IMO
MSC-FAL.1/Circ.4 — Maritime Cyber Risk Management Guidelines
IMO guidelines requiring cyber risk to be addressed in Safety Management Systems (SMS) under the ISM Code. MSC-FAL.1/Circ.4 is the current revision of the Guidelines on Maritime Cyber Risk Management, superseding Circ.3. It reinforces the requirement to address cyber risks within a ship's SMS under the ISM Code.
→ IMO Cybersecurity ↗USCG
NVIC 01-20 — Cyber Strategies for Marine Transportation
U.S. Coast Guard navigation circular establishing cyber risk assessment and response expectations for vessels operating in U.S. waters and ports.
→ USCG NVIC ↗EU
NIS2 Directive (2022/2555) — Network & Information Security
EU-wide cybersecurity regulation effective October 2024. Applies to maritime transport operators in EU member states as a critical infrastructure sector.
→ NIS2 Official Text ↗IMO / SOLAS
ISPS Code — International Ship & Port Facility Security
Mandatory since 2004 under SOLAS Chapter XI-2. Requires Ship Security Plans (SSP), Ship Security Officers (SSO), and port facility assessments.
→ IMO ISPS ↗IACS UR E26 vs UR E27 — Key Differences
| Aspect | UR E26 (Ships) | UR E27 (Systems & Equipment) |
|---|---|---|
| Who it targets | Shipowners, shipyards, class societies | Equipment manufacturers, system integrators |
| Scope | Vessel-level cyber resilience requirements | Component/system-level security requirements |
| Effective date | Newbuilds contracted ≥ 1 Jul 2024 | Same — aligned with E26 |
| Key obligation | Cyber Risk Assessment, network segmentation, access control | Secure software development, vulnerability disclosure, patch management |
| Linked standard | IEC 62443-2-1, ISM Code | IEC 62443-4-1, IEC 62443-4-2 |
| Class survey impact | Required for plan approval & survey | Type approval of equipment |
🏆 Top Ranked
📌 Content Verification Policy
Most-discussed recent Maritime Compliance posts
📚 Article index — 139 posts
- NIS2 for Shipping Companies: Essential or Important Entity? From Status Assessment to Governance Design · 2026-10-23
NIS2 for Shipping Companies: Essential or Important Entity? From Status Assessment to Governance Design Questions every shipping company should… - How Can a Functional Description in a Manual Be Converted into a Reproducible Test Procedure? · 2026-10-23
<!--════════════════════════════════════════════════════════════ Article: How Can a Functional Description in a Manual Be Converted into a… - Does CRA Vulnerability Reporting Reach the Shipowner? The Gaps Shipbuilding and Equipment Contracts Must Close · 2026-10-23
Does CRA Vulnerability Reporting Reach the Shipowner? The Gaps Shipbuilding and Equipment Contracts Must Close Equipment makers now report to EU… - Three Pages for an Entire Ship: Why I Rejected a Shipyard's E26 Vessel Asset Inventory · 2026-10-18
<!--════════════════════════════════════════════════════════════ Article: In China, The Limitations of Shipyard-Submitted Documents (1) — Vessel… - Assessing the USCG's Unmanned Systems Test Area Policy: Three Reasons to Add Cybersecurity · 2026-10-17
Assessing the USCG's Unmanned Systems Test Area Policy: Three Reasons to Add Cybersecurity Julius Shin Maritime Technical Consultant · Shipboard… - The Missing Layer in IACS UR E26/E27: Why Maritime Cyber Resilience Needs HSM and KMS · 2026-10-16
- Zero Trust for OT in the Age of AI: Concept and Execution through NIST SP 800-207 and the NSA OT CSI · 2026-10-10
Zero Trust for OT in the Age of AI: Concept and Execution through NIST SP 800-207 and the NSA OT CSI NIST SP 800-207 defines what zero trust is.… - How Can a Statement That a Function Exists Be Converted into Verifiable Evidence? · 2026-10-09
<!--════════════════════════════════════════════════════════════ Article: How Can a Statement That a Function Exists Be Converted into Verifiable… - Rereading IACS UR E26/E27 Through the NSA Guidance · 2026-10-08
Zero Trust for OT in the AI Era: Rereading IACS UR E26/E27 Through the NSA Guidance Read clause by clause, E26/E27 already contain much of what NSA… - Zones and Conduit Diagram: Establishing the Vessel’s Security-Zone Architecture (IACS UR E26 Compliance Series · Article 2 of 7) · 2026-10-05
<!--═══════════════════════════════════════════════════════ Article: Zones and Conduit Diagram: Establishing the Vessel's Security-Zone Architecture… - One Europe, Two Shipbuilding Strategies: The Gap Between Brussels and Athens · 2026-10-01
One Europe, Two Shipbuilding Strategies: The Gap Between Brussels and Athens Julius Shin Maritime Technical Consultant · Shipboard Cybersecurity &… - NIST Now Counts Ships as OT — An E26 Practitioner Reads SP 800-82r4 Section 2.5.4 · 2026-09-26
NIST Now Counts Ships as OT — An E26 Practitioner Reads SP 800-82r4 Section 2.5.4 NIST's new OT guide now has a section on ships. It explains well… - What Should Be Included in the Scope of Approval or Conformity Verification? - UR E27 Response Strategies (6/12) · 2026-09-25
<!--════════════════════════════════════════════════════════════ Article: What Should Be Included Within the Scope of Approval or Conformity… - IACS UR E26/E27: Two Years of Survey Practice — A Class Surveyor’s Inside View · 2026-09-22
IACS UR E26 - Ship Cyber Rules Find Their Way Back to the Shipyard — What Korea's Maritime Safety Act Amendment Asks of Global Shipbuilding · 2026-09-20
Ship Cyber Rules Find Their Way Back to the Shipyard — What Korea's Maritime Safety Act Amendment Asks of Global Shipbuilding A Korean bill on… - Should TA, SoC, and SoF Be Treated as Equivalent Options? - UR E27 Response Strategies (5/12) · 2026-09-13
<!--════════════════════════════════════════════════════════════ Article: Should TA, SoC, and SoF Be Treated as Equivalent Options? Series : Article… - MSC-FAL.1/Circ.3/Rev.4: What Has Changed? · 2026-09-12
📌 Source Status NoteThis article analyses the MSC-FAL.1/Circ.3/Rev.4 document (dated 28 May 2026). Current document status and official applicability… - Hold Washing: When Clean Is Defined by Contract · 2026-09-12
Hold Washing: When Clean Is Defined by Contract The completion criterion for this system is written in a charterparty, not a regulation — and that… - The 30-Year Ship and the 10-Year Cipher: Post-Quantum Cryptography for Maritime OT · 2026-09-11
The 30-Year Ship and the 10-Year Cipher: Post-Quantum Cryptography for Maritime OT A ship lives 20–30 years. Its public-key cryptography may not. Why… - EU CRA – Application to theft and incident reporting (September 11, 2026) · 2026-09-11
<!--════════════════════════════════════════════════════════════ Article: EU CRA – Application to theft and incident reporting (September 11, 2026)… - Cargo Tank Level Gauging: One Number, Two Paths · 2026-09-10
Cargo Tank Level Gauging: One Number, Two Paths A radar gauge observes and informs. Nothing else. So why does the rulebook build a wall down the… - The Next Decade of Maritime Cyber Regulation, Read Through Five Stages of Environmental Rules · 2026-09-08
The Next Decade of Maritime Cyber Regulation, Read Through Five Stages of Environmental Rules Ballast water, EEDI, CII and the EU ETS took thirty… - How Should UR E27 Requirements Be Interpreted and Allocated to Our Product? (4/12) - UR E27 Response Strategies · 2026-09-05
<!--════════════════════════════════════════════════════════════ Article: How Should UR E27 Requirements Be Interpreted and Allocated to Our Product?… - Is Our Product Actually Subject to UR E27? - UR E27 Response Strategies (3/12) · 2026-09-01
<! - Gas Bunkering: A Safety Function Across Two Hulls · 2026-09-01
Gas Bunkering: A Safety Function Across Two Hulls When the trust boundary is not the hull but the coupling face between two ships, what does a zone… - Why Category Classification Comes First in Ship Cybersecurity Under IACS UR E26/E27 · 2026-08-30
<!--════════════════════════════════════════════════════════════ Article: Why Category Classification Comes First in Ship Cybersecurity Under IACS UR… - The Loading Computer: Architecture, Interaction & Authority in Ship Loading Systems · 2026-08-26
The Loading Computer: Architecture, Interactions, Cybersecurity Why a system that controls nothing can still sink a ship Julius Shin Maritime… - Why Did a Product Declared “Ready for Delivery” Come to a Halt Just Before FAT? - UR E27 Response Strategies (2/12) · 2026-08-23
<!--════════════════════════════════════════════════════════════ Article: Why Did a Product Declared "Ready for Delivery" Come to a Halt Just Before… - UR E27 Is Already in Effect — So Why Do Marine Equipment Manufacturers Still Feel So Little Urgency? - UR E27 Response Strategies (1/12) · 2026-08-17
<!--════════════════════════════════════════════════════════════ Article: UR E27 Is Already in Effect — So Why Do Marine Equipment Manufacturers… - Ship Cyber Resilience Complete Guide: OT Security, SCARP and Resilience by Design · 2026-08-11
<!--═══════════════════════════════════════════════════════ MAJOR PILLAR 02 — SHIP CYBER RESILIENCE Title : Ship Cyber Resilience: Complete Guide for… - IACS UR E26 vs E27: The Complete Comparison Guide · 2026-08-11
<!--═══════════════════════════════════════════════════════ MAJOR PILLAR 04 — IACS UR E26 vs E27 Title : IACS UR E26 vs E27: Complete Comparison… - IACS UR E26 Complete Guide to Cyber Resilience of Ships · 2026-08-11
<!--═══════════════════════════════════════════════════════ MAJOR PILLAR 01 — IACS UR E26 Title : IACS UR E26: Complete Guide to Cyber Resilience of… - UR E27 Supplier Readiness Series — From Compliance Pressure to Engineering Readiness · 2026-08-08
<!--════════════════════════════════════════════════════════════ Article: Under UR E27, Unprepared Marine Equipment Is Less Likely to Be Selected… - If CSDD is rushed during construction, SCARP falls apart after delivery of Vessel. · 2026-08-07
<!--════════════════════════════════════════════════════════════ Article: Skip on CSDD During Construction, and SCARP Collapses After Delivery Author… - Beyond E26 Paperwork: Building Sustainable Ship Cybersecurity Engineering (Ch.9) · 2026-08-06
<!--════════════════════════════════════════════════════════════ Article: Ch.09 — Maritime Cybersecurity as a Discipline Series : Why Maritime… - Red Kraken and the Maritime Logistics Stack: What Agentic Cyber Strategy Changes for Ports and Shipping · 2026-07-30
Red Kraken and the Maritime Logistics Stack: What Agentic Cyber Strategy Changes for Ports and Shipping A July 2026 CSIS tabletop exercise used a… - IACS UR E27 Asks You to Prove Up to 41 Applicable Security Capabilities — None of Them Inspect the Model · 2026-07-30
Capability #18 Malicious Code Protection "The CBS shall provide capability to implement suitable protection measures to prevent, detect and mitigate… - How Cyber Engineering Information Flows from Supplier to Class in a Newbuild (Ch.8) · 2026-07-26
<!--════════════════════════════════════════════════════════════ Article: Ch.08 — How Engineering Information Flows Through a Project Series : Why… - If IT Is Out of Scope, Your E26 Compliance Is Incomplete · 2026-07-25
<!--════════════════════════════════════════════════════════════ Article: Why Someone Said "IT Is Not the Target System" — And Why That… - If We Already Have an E27 Certificate, Why Is Cyber Security Verification During FAT Still Required? · 2026-07-24
<!--════════════════════════════════════════════════════════════ Article: E27 Type Approval Is Not a FAT Exemption — Why Cyber Security Verification… - OpenAI's Model Escaped Its Sandbox and Breached Hugging Face — The Maritime Industry Is Next in Line · 2026-07-22
<!--════════════════════════════════════════════════════════════ Maritime Cyber Brief — News Review Topic : OpenAI Model Escapes Sandbox, Breaches… - The Cyber Resilience System Integrator and the Six Core Ship-Level Deliverables · 2026-07-19
<!--═══════════════════════════════════════════════════════ Article: The Cyber Resilience System Integrator and the Six Core Ship-Level Deliverables… - When National Cyber Regulation Becomes a Ship Requirement — CIRCIA, the MTSA Cyber Rule, EO 14028 vs. IACS UR E26/E27 · 2026-07-18
When National Cyber - The importance of type approval Part II: From Detect to Recover · 2026-07-18
- Shipyard vs. Supplier Responsibilities Under IACS UR E26/E27 (Ch.7) · 2026-07-18
<!--══ - One Ship, Three Layers — Unifying NIS2, CRA, and IACS UR E26 · 2026-07-18
One Ship, Three Layers — - The importance of type approval Part I From Identify to Protect · 2026-07-14
- Smart Port Cybersecurity Survey: Help Shape a New Incident Management Framework (Dr. Gaber Mohamed, AASTMT) · 2026-07-12
<!--════════════════════════════════════════════════════════════ Article: Take Part in Original Maritime Cybersecurity Research — Smart Port Incident… - Securing Maritime OT Systems: A Practical Cyber Security Strategy · 2026-07-12
<!--══ HEADER - IMO MASS Code Enters into Force 1 July 2026 - Autonomous Ships Enter the Era of International Rules · 2026-07-12
<!--══ - Cybersecurity Challenges in Smart Ports: Building Resilience in the Era of Maritime Digital Transformation · 2026-07-12
<!--════════════════════════════════════════════════════════════ Article: Cybersecurity Challenges in Smart Ports: Building Resilience in the Era of… - UR E26, After the Mandate ⑥ — The Consultant's View: The Single Task of Reading the Boundary · 2026-07-10
<!--════════════════════════════════════════════════════════════ Article : UR E26, After the Mandate ⑥ — The Consultant's View: The Single Task of… - UR E26, After the Mandate ⑤ — The Vendor's View: The Economics of Certification and the Paradox of Integration · 2026-07-08
<!--════════════════════════════════════════════════════════════ Article : UR E26, After the Mandate ⑤ — The Vendor's View: The Economics of… - Maritime Cybersecurity Solutions: Complete Category Guide · 2026-07-08
Maritime Cybersecurity Solutions: Complete Category Guide Identity & Access · Network Security · Remote Access · Security Monitoring · Security… - E26 Zone Defense — Learn IACS UR E26 as a Tower Defense Game · 2026-07-07
Play UR E26 — E26 Zone Defense | ShipJobs <!-- =============== - Anatomy of a Ship ZCD — Understanding the Building Blocks of an IACS UR E26 Zone and Conduit Diagram · 2026-07-07
<!--════════════════════════════════════════════════════════════ Ship OT Cybersecurity Series · Part 5 of 5 Anatomy of a Ship ZCD Understanding the… - UR E26, After the Mandate ④ — The Shipyard's View: Implementing a Mandatory Rule on the Drawing Board · 2026-07-06
<!--════════════════════════════════════════════════════════════ Article : UR E26, After the Mandate ④ — The Shipyard's View: Implementing a… - Not Every Ship Is the Same Target: Cyber Risk by Type and Size · 2026-07-06
Not Every Ship Is the Same Target: Cyber Risk by Type and Size Tankers, container ships, LNG carriers and cruise ships face different threats — and… - Zone Before VLAN — Designing Logical Networks Using the Purdue Model and Zone & Conduit Concepts · 2026-07-05
<!--════════════════════════════════════════════════════════════ Ship OT Cybersecurity Series · Part 2 of 5 Zone Before VLAN Designing Logical… - Why Most Ship ZCDs Fail — Seven Common Mistakes in IACS UR E26/E27 Projects · 2026-07-05
<!--════════════════════════════════════════════════════════════ Ship OT Cybersecurity Series · Part 4 of 5 Why Most Ship ZCDs Fail Seven Common… - What Engineering Evidence UR E26/E27 Approval Actually Requires (Ch.6) · 2026-07-05
<!--══ - From Networks to ZCD — Translating Physical and Logical Networks into IACS UR E26 Documentation · 2026-07-05
<!--════════════════════════════════════════════════════════════ Ship OT Cybersecurity Series · Part 3 of 5 From Networks to ZCD Translating Physical… - From Cable to Cyber Resilience Designing Physical Networks for IACS UR E26/E27 · 2026-07-05
<!--════════════════════════════════════════════════════════════ Ship OT Cybersecurity Series · Part 1 of 5 From Cable to Cyber Resilience Designing… - Secure Vendor Remote Access (SVRA) for Ships: The Jump Server Approach to Eliminating Vendor Backdoors · 2026-07-04
Secure Vendor Remote Access (SVRA) for Ships: The Jump Server Approach to Eliminating Vendor Backdoors Eliminating permanent vendor backdoors on… - Maritime Cybersecurity: The Complete Guide · 2026-07-04
<!--═══════════════════════════════════════════════════════ MAJOR PILLAR 03 — MARITIME CYBERSECURITY Title : Maritime Cybersecurity: Complete Guide… - Italy Just Made Maritime Cyber Compliance Binding. : Effective 1 November 2026 - Here Is What Circular 177/2025 Actually Requires. · 2026-07-04
<!--════════════════════════════════════════════════════════════ Article: Italy MIT Circular 177/2025 — Maritime Cyber Regulation Analysis Author :… - How to Evaluate a Maritime Jump Server Solution — Jump Server Series (3/3) · 2026-07-04
How to Evaluate a Maritime Jump Server Solution A structured evaluation framework across 11 technical domains — with Good/Weak answer criteria,… - UR E26, After the Mandate ③ — Through the Eyes of the Classification Society · 2026-07-03
“UR E26, After the Mandate” ③ — Through the Eyes of the Classification Society Assurance, differentiation, and the weight of liability — what class… - ICS Security Book (3/8): Understanding IACS UR E26/E27 from First Principles · 2026-07-03
[BOOK - UR E26, After the Mandate ② — The Owner's View: Where Obligation Ends and Choice Begins · 2026-07-01
- IMO's 2025 Cybersecurity Decision — One Year On 2026, the Clock Is Running · 2026-06-30
<!--════════════════════════════════════════════════════════════ Series : Maritime Cyber Brief Issue : #1 Title : IMO's 2025 Cybersecurity Decision —… - UR E26, After the Mandate ① — One Mandatory Rule, Five Perspectives · 2026-06-29
UR E26, After the Mandate · ① — One Mandatory Rule, Five Perspectives What 1 July 2024 actually changed — and the single variable that decides… - From Functional to Explainable Design: What UR E26 Reviewers Expect (Ch.5) · 2026-06-28
- Why IACS Introduced UR E26 and E27: The Engineering Gap They Close (Ch.4) · 2026-06-27
<!--════════════════════════════════════════════════════════════ Article: Why Maritime Cybersecurity Became a System Engineering Issue (4/9) Chapter… - The MSC Antonia Grounding Was Not a Freak Accident. It Was a System Failure You Can Test For. · 2026-06-26
The MSC - E26 Deliverable Quality — The Low, Medium, and High Tiers · 2026-06-26
- What USCG's Performance-Driven COC Inspection Regime and IACS UR E26 Are Telling Us · 2026-06-24
< - Maritime Cyber Resilience Brief — Charting the USCG Cybersecurity Rule: Implementation Timeline and the Foreign‑Flag Question · 2026-06-22
<!--════════════════════════════════════════════════════════════ Article: Maritime Cyber Resilience Brief — Charting the USCG Cybersecurity Rule:… - Ship Cybersecurity Is a System Engineering Problem, Not an IT Add-On (Ch.3) · 2026-06-16
- The Shipyard — The One You Must Walk Closest Beside · 2026-06-14
The - Designing Secure Remote Access for Ships — Maritime Jump Server Series (2/3) · 2026-06-13
Designing Secure Remote Access for Ships 13 engineering design domains for maritime jump server architecture — from authentication and authorization… - Why Shipboard OT Interdependency Turns One Failure into Many (Ch.2) · 2026-06-07
- Which Comes First — the Chicken or the Egg? (Part 1) · 2026-06-06
Which Comes First — - IACS UR E26/E27 Compliance Matrix: Cybersecurity Solutions for Maritime OT · 2026-06-06
.ph{display:inline-block;padding:2px 8px;border-radius:10px;font-size:10px;font-weight:700;white-space:nowrap;}… - How Ship Digitalization Created the Cyber Risk Behind IACS UR E26 (Ch.1) · 2026-06-01
Chapter 1. - Smart Marine Consultant (4/4): Cyber Threats I've Actually Stood in Front of · 2026-05-30
🚢 Smart Marine Consultant — Series Navigation1/4 — What Does This Job Actually Mean?2/4 — The Full Map: How Smart Marine Works3/4 — What I See. What… - OT Security Architecture & Deployment — ICS Security Ch.8 · 2026-05-29
📚 BOOK REVIEW · ICS SECURITY SERIES Chapter 8 · OT Security Architecture & Deployment Fundamentals Pascal Ackerman — Industrial Control System… - ICS Security Testing Fundamentals — ICS Security Ch.7 · 2026-05-15
[BOOK] Industrial Control System - Why Modern Ships Need Jump Servers — Maritime Jump Server Series (1/3) · 2026-05-09
Why Modern Ships Need Jump Servers The connected ship era has created remote access pathways that VPN alone cannot secure. This article explains the… - IACS UR E26/E27 System Classification Guide — 1. Efficient Way to Classify System Types in IACS UR E26/E27 · 2026-05-02
IACS UR E26 - ICS Security Documentation Fundamentals — ICS Security Ch.6 · 2026-04-28
[BOOK] Industrial Control System - IACS UR E26/E27 System Classification Guide — 2. 10 Essential Elements Every Supplier Must Prepare · 2026-04-18
Required Documents for IACS UR E27 Compliance — 10 Essential Elements Every Supplier Must Prepare When - IACS UR E26/E27 System Classification Guide — 3. Is a SoC-Centric Approach Enough for Ship Cybersecurity? · 2026-04-17
IACS UR - A Decade Inside the Shipyard: Three Hidden Problems in IACS UR E26/E27 Projects · 2026-04-12
- 23 Cybersecurity Deliverables Under IACS UR E26/E27 — Who Owns What · 2026-04-04
- ICS Host Security After Preventive Controls — ICS Security Ch.5 · 2026-03-29
[BOOK] - ICS Threat Modeling: Attack Chains & EWS Pivot Analysis — ICS Security Ch.4 · 2026-03-15
[BOOK - ICS Security Chapter 3 Deep Dive: Host Security Fundamentals from an IACS UR E26 / E27 Perspective · 2026-03-13
[BOOK - Cybersecurity on the Connected Ship - Three Attack Surfaces Every Vessel Carries · 2026-03-08
<!--══ - [IACS UR E26/E27] Audits : What Classification Societies Actually Verify — And Why Projects Get Delayed · 2026-03-07
- Automating IACS E26/E27 Annual Survey: What OT Monitoring Can and Cannot Do · 2026-03-05
- Ship OT Monitoring for IACS E26/E27: Required Functions, Scope, and Protocols · 2026-03-04
- Ship OT Cybersecurity for Vessel Operators: CBS, Zones, Security Levels and SBOM · 2026-03-03
- ICS Network Architecture Fundamentals — ICS Security Ch.2 · 2026-03-03
[BOOK - The Nature of ICS/OT and Its Security Paradigm — ICS Security Ch.1 · 2026-03-01
[BOOK] - Introduction to the Book "ISO 23806 Ship Cyber Safety Certification" · 2026-02-22
Ship Cybersecurity Practical Guide — - [IACS UR E26/27] Redefining System Suppliers’ IACS UR E26/27 Interpretation Trends in Alignment with Cyber Resilience Principles · 2026-02-10
<!--════════════════════════════════════════════════════════════ Article: Redefining System Suppliers' IACS UR E26/27 Interpretation Author : Captain… - [Risk Management] Prologue - UR E26 and the Three-Body Problem · 2026-02-02
UR E26 and the Three-Body - The Next Competitive Edge in Maritime 4.0 Is Cybersecurity, Data, and AI · 2026-01-31
The Next - Comprehensive List of Shipboard Systems in Commercial Vessels — With Security Assessment Criteria and Cyber Risk Guide · 2026-01-10
<!--══ HEADER ══-- - [PenTesting] AI-Driven Autonomous PenTesting in Maritime - How Autonomous Security Is Reshaping Shipyard and Vessel Cyber Defense · 2026-01-09
<!--════════════════════════════════════════════════════════════ Article: AI-Driven Autonomous PenTesting in Maritime: How Autonomous Security Is… - Smart Marine Consultant (3/4): What I See. What I Solve. What Stays Broken. · 2026-01-08
🚢 Smart Marine Consultant — Series Navigation1/4 — What Does This Job Actually Mean?2/4 — The Full Map: How Smart Marine Works3/4 — What I See. What… - Smart Marine Consultant (2/4): The Full Map — How Smart/Cyber Ship Projects Actually Get Built · 2026-01-07
Smart Marine Consultant [2/4]:The Full Map — How Smart Ship Projects Actually Get Built Most people think a smart ship project starts when the steel… - Smart Marine Consultant (1/4): What Does This Job Actually Mean? · 2026-01-06
🚢 Smart Marine Consultant — Series Navigation1/4 — What Does This Job Actually Mean?2/4 — The Full Map: How Smart Marine Works3/4 — What I See. What… - Ship Owner Cybersecurity Policy - The Essential Standard for IACS UR E26 Fleet Compliance · 2026-01-04
- From Connected Car to Connected Ship — Mapping Automotive Cyber Concepts to Maritime Security · 2026-01-02
<!--══ - SCARP Under IACS UR E26: What Shipowners Must Prepare Before Delivery — and Why It's Not Just the Yard's Job · 2025-12-21
- Patching, Version Control, and Network Security in Shipboard OT — IACS UR E26 Perspective · 2025-12-20
- Zones, Boundaries, and Why Zone & Conduit Design Is About Architecture — Not Just Patching · 2025-12-16
Zones, Boundaries, and Why Zone & Conduit - Why Is Ship OT Security So Different from IT Security? — And Why IACS UR E26/E27 Had to Emerge · 2025-12-15
<!--══ - Four Scenarios That Will Define the Future of Maritime Cybersecurity · 2025-12-15
<!--══ - Poor Documentation - A Structural Industry Problem, Not a Supplier Capability Gap · 2025-12-07
< - The Missing Role in IACS UR E26/E27 — Why a Cyber Resilience Integrator Is No Longer Optional · 2025-11-27
CRSI: - [IACS UR E26] Belongs in Basic Design - Why Shipyards Must Adopt Cyber by Design from Day One · 2025-11-20
<!- - [Compliance] The 8 Global Cybersecurity Institutions — From IACS to ITU-T, Building the Standard for Maritime Logistics and IT/OT Security · 2025-10-10
- Starlink Maritime Cybersecurity: Risks, Compliance & OT Security Guide (2026) · 2025-07-18
Maritime 4.0 · Cyber Insight Captain Paul - [IACS UR E26/E27] IMO MSC-FAL.1/Circ.3/Rev.3 Explained — Alignment with IACS UR E26/E27 · 2025-05-03
- Why Zero Trust Is the Future of Ship Cybersecurity — From IMO to IACS UR E26/E27 · 2025-04-04
- [IACS UR E26/E27] CBS (Computer Based System) and Category Classification - The Core Framework for IACS UR E26 & E27 Compliance · 2025-03-17
- Maritime Cyber Risk Management: Protecting Commercial Ship Systems from GPS Spoofing to VSAT Interception · 2025-03-16
Maritime Cyber Risk Management: Protecting Commercial Ship Systems from GPS Spoofing to - AI-Based Maritime Cyber Threat Intelligence · 2025-03-08
AI-Based Maritime Cyber Threat Intelligence: Real-Time Detection & Self-Healing Security for Smart Ships - Beyond Minimum Regulations — Strengthened Cybersecurity Requirements for Operating Ships · 2025-02-22
Maritime 4.0 · Cyber Insight Captain Paul · Apr 2026 Beyond - Major Systems Installed on Commercial Ships – Detailed Functionality, Risks, and Risk Management · 2025-01-06
Commercial Ship Systems Explained: Functions, OT Cyber Risks, and Risk Management Guide A practical - IMO MSC.428(98) and the Five-Step Risk Framework — How It Connects to UR E26/E27 · 2024-12-18
IMO MSC.428(98) and the - Shipboard SIEM/IDS: Building a Real-Time Cyber Security Monitoring System for Ships · 2024-12-16
Maritime 4.0 · Cyber Insight Captain Ethan · Apr 2026 - A Must-Read for the Maritime Industry! Review of "A Study on Cyber Security Requirements for Ships" · 2024-12-02
<!--════════════════════════════════════════════════════════════ Article : A Study on Cyber Security Requirements of Ship Using Threat Modeling —… - Shipbuilding Cybersecurity: Aligning Newbuilding Milestones with IACS UR E26 & E27 Deliverables (Standard) · 2024-10-08
Aligning Shipbuilding Schedules with Cybersecurity Deliverables From Contract Signing to Delivery — What Owners, Shipyards, and Suppliers Must… - Compliance for Suppliers - 8 key Actions · 2024-10-06
- Global Maritime Cybersecurity Leadership: Key Organizations Shaping Ship & Port Cyber Standards · 2024-07-07
Global Maritime Cybersecurity Leadership: Key Organizations Shaping Ship & Port Cyber Standards NIST · IACS · IMO MSC/MEPC/ISM · BIMCO · OCIMF · IAPH…
Frequently Asked Questions — Maritime Compliance & Cybersecurity Regulations
What is IACS UR E26 and why does it matter for shipbuilding?
IACS Unified Requirement E26 establishes mandatory cyber resilience standards for ships contracted on or after 1 July 2024. It requires shipowners and yards to implement risk assessments, network segmentation, access controls, and incident response plans as a condition of class. Non-compliance means a vessel cannot receive class approval from any of the 12 IACS member societies — effectively blocking market entry. See the official IACS UR E26 text ↗.
How does IACS UR E27 differ from UR E26?
While UR E26 addresses vessel-level cyber resilience (the shipowner/shipyard perspective), UR E27 targets equipment manufacturers and system integrators. UR E27 requires suppliers to follow a secure-by-design approach aligned with IEC 62443-4-1/4-2, provide vulnerability disclosure processes, and support patch management throughout the product lifecycle. A vessel's UR E26 compliance depends directly on its suppliers meeting UR E27 — the two requirements are architecturally linked.
What is IMO MSC-FAL.1/Circ.4 and how does it differ from Circ.3?
MSC-FAL.1/Circ.4 is the current revision of the IMO Guidelines on Maritime Cyber Risk Management, superseding MSC-FAL.1/Circ.3. It reinforces the requirement to address cyber risks within a ship's Safety Management System (SMS) under the ISM Code. Flag states and port state control (PSC) officers reference it during inspections. For current document status and applicability, refer to the official IMO source ↗.
Does the EU NIS2 Directive apply to ships and shipping companies?
Yes — NIS2 (Directive 2022/2555, effective October 2024) classifies maritime transport as a critical infrastructure sector. EU-based shipping companies operating ferry services, cargo routes, or port facilities meeting the size thresholds (≥50 employees or €10M annual turnover) are "essential entities" subject to mandatory incident reporting, risk management obligations, and executive liability. Companies operating outside the EU but serving EU ports may be indirectly affected through their EU-based subsidiaries or contractual partners.
What does the USCG NVIC 01-20 require for vessels in U.S. waters?
USCG Navigation and Vessel Inspection Circular 01-20 provides a voluntary but expected framework for cyber risk management for vessels and facilities regulated under 33 CFR Parts 104–106. It aligns with the NIST Cybersecurity Framework and requires operators to identify OT/IT assets, assess cyber risks, develop and test cyber incident response plans, and report significant cyber incidents to the National Response Center. USCG marine inspectors use it as a benchmark during facility safety audits.
How do IACS, IMO, and flag state requirements interact?
IACS URs apply through classification — they are private-sector technical standards that all 12 major class societies have agreed to enforce uniformly. IMO instruments (including SOLAS and the ISM Code) are international law ratified by flag states. Flag states translate IMO obligations into domestic law and enforce them during surveys; class societies often act as Recognized Organizations (ROs) on behalf of flag states. In practice, a modern vessel must satisfy all three layers: class requirements (IACS), flag state law (IMO-derived), and — for vessels calling specific ports — coastal state regulations (USCG, NIS2, etc.).