IACS UR E26: The Cyber-Resilient Ship

7 min read

What you'll take away Describe what IACS UR E26 requires of a newbuilding, the five functional elements, security zones and network segmentation, and which ships it applies to.

The IMO resolution in Lesson 1 told companies to manage cyber risk. It said almost nothing about how a ship should be built to make that possible. That gap belonged to the classification societies, and they closed it collectively: IACS unified requirement E26, "Cyber resilience of ships", applies to ships contracted for construction on or after 1 July 2024: passenger ships on international voyages, cargo ships and high-speed craft of 500 GT and over on international voyages, and mobile offshore units. For smaller cargo ships, fishing vessels and yachts it is non-mandatory guidance. From that date, cyber resilience is not a premium option: it is part of what class means for a newbuilding in scope, the same way watertight subdivision is.

The word resilience is doing deliberate work. The requirement does not promise an unhackable ship: Lesson 1 should have cured us of that idea. It requires a ship that can take a cyber hit the way a well-designed hull takes flooding: locally, controllably, and without losing the functions that keep her safe.

Five elements, one familiar shape

E26 organises its requirements around five functional elements: Identify, Protect, Detect, Respond, Recover. If that sequence feels familiar, it should: it is the shape of every damage-control doctrine at sea. Know your ship; keep the water out; sound the tanks; contain the flooding; restore the ship. Applied to networks:

  • Identify. An inventory of the ship's computer-based systems: what is on board, what it does, how it connects. Nothing else in the requirement works without this list, because you cannot defend equipment you have not admitted to owning.
  • Protect. Barriers against compromise: network segmentation, control of access, human, wireless, and remote, and hardening of the systems themselves.
  • Detect. The means to notice abnormality: monitoring of networks and verification that security functions still work. An intrusion you cannot see is one you cannot respond to.
  • Respond. Limiting damage during an incident: an incident response plan, and, critically for a ship, the ability to fall back to independent, local control of essential functions when the networked layer is suspect.
  • Recover. Getting back: backups kept and tested, and procedures for restoring systems to a known-good state after the event.

Zones: watertight bulkheads for networks

The heart of the Protect element is network segmentation into security zones. Systems are grouped by criticality and trust, navigation here, machinery there, crew and business systems well away from both, and the connections between zones run through controlled, documented conduits. The design assumption is humble and correct: something, someday, will be compromised. Segmentation ensures the compromise inherits a bulkhead, not a corridor. One crew laptop with dirty downloads must never have a network path to the power management system, any more than a flooded forepeak should flood the engine room.

One flat network crew laptop ECDIS engine automation no bulkheads, one compromise roams Segmented into security zones Zone: crew & business crew laptops, webmail, admin Zone: navigation ECDIS, radar, GNSS receivers Zone: machinery OT engine automation, power mgmt controlled conduit controlled conduit Protect element: systems grouped by criticality, with every crossing through a documented conduit.
Segmentation is the heart of the Protect element. On the left, one compromise has a corridor to everything; on the right it inherits a bulkhead, and every crossing is a conduit somebody has to specify and defend. Zone membership shown is indicative.

This is also where E26 becomes a paperwork reality at the yard. The zone architecture must be designed, drawn, and defended: which systems sit in which zone, what traffic the conduits permit, how remote access enters and is supervised, and how it is all tested before delivery.

Reading it in practice

The unified requirement itself, UR E26 Rev.1 (November 2023), is freely published but terse, as rules are. The open, readable route into it is ClassNK's Guidelines for Cyber Resilience of Ships, which walk through E26 element by element with the survey and documentation expectations spelled out, what the inventory should contain, what the zone diagrams must show, what evidence demonstrates Respond and Recover exist outside the binder. Underneath both sits IACS Recommendation 166, the consolidated recommendation on cyber resilience from which the unified requirements grew, useful when you want the reasoning behind a clause rather than the clause alone.

For an owner or superintendent, the practical takeaways are three. At contract: the specification for any ship in scope contracted on or after 1 July 2024 must show the zones, the inventory, and the five elements: makers' standard brochures are not evidence. At delivery: demand the test records, not just the drawings. In service: the inventory and the zone diagram are living documents; every retrofit, every new maker's laptop connection, every added sensor must land somewhere on them, or the ship drifts quietly back toward the flat network the rule exists to prevent.

E26 covers the ship as a system. But a ship is assembled from dozens of suppliers' boxes, and no yard can harden the inside of a maker's controller. That is the other half of the story: UR E27, the subject of the next lesson.

Check yourself

1. What is the purpose of dividing a ship's networks into security zones?
2. Under the Identify element, what must exist before anything can be protected?
3. What does the Detect element require, in essence?
4. What is the practical difference between Respond and Recover?
5. Why does this course teach E26 through the ClassNK guidelines rather than the bare IACS text?
6. Which of these are among the functional elements E26 is organised around?

Select all that apply.

7. Under E26, an acceptable design is one flat network where every device on board can reach every other.
8. UR E26 applies to ships contracted for construction on or after 1 July of which year?

One email a month, at most

New courses, new articles and the occasional sea curiosity, in a single email. A quiet month means no email at all. Nothing is sent until you confirm your address, and one click unsubscribes you from anything we send.