View

Situation 04 · Cyber compliance

Class is asking about cyber

Cyber risk management on ships used to be a paragraph in the SMS. It is now a condition of class for new vessels and an audit item for the management company on existing ones. The hard part isn't the policy — it's the evidence.

The requirement, in plain terms

  • IMO MSC.428(98) requires cyber risk to be addressed in the safety management system. The management company holding the Document of Compliance carries that responsibility, and it’s what surveyors press on in in-service audits.
  • IACS UR E26 (vessel) and E27 (systems and equipment) apply to newbuilds contracted on or after 1 July 2024 and are a condition of class. Among other things, E26 requires a documented inventory of every essential computer-based system — manufacturer, model, firmware, and how it’s networked.
  • Existing vessels aren’t retroactively subject to E26, but flag, insurers, charterers and class notations are moving the same way.

We verify the current text against IACS and your class society before any document goes in your file. Requirements move; we don’t restate them from memory.

What goes wrong

  • The policy exists; the inventory doesn’t. Nobody can say what firmware the ECDIS is on or what the engine control network is connected to.
  • The integrator who built the network is asked to assess it and, unsurprisingly, finds it fine.
  • A generic maritime cyber template gets adapted and the surveyor recognises it.
  • The crew have a procedure for USB sticks and nothing for the remote access the OEM uses every week.

What we do

  1. Inventory. The E26-style asset register, built by walking the vessel — not by emailing suppliers for a list. Every system, its network zone, its remote access paths, its patch state.
  2. Assessment. Where the real exposure is, in engineering terms rather than compliance vocabulary. Usually a shorter list than expected, with two or three things that matter.
  3. The file. Risk assessment, network diagrams, zones and conduits, procedures that match what the crew actually do, and the evidence pack for class or flag.
  4. Newbuilds. E26/E27 folded into the build specification and supplier requirements from the start, so it’s a deliverable rather than a surprise.

Who this is for

Management companies holding the DoC, owners’ teams on E26-era newbuilds, and operators who’ve been asked a question by class, flag or an insurer and want an answer that will hold up.