UR E26 requires the shipowner to integrate cyber resilience into the newbuilding process from the outset. This starts with identifying all Computer-Based Systems (CBS) and their interconnections. From this, a risk assessment must be produced showing which systems could compromise vessel safety during a cyber incident.
Based on this risk assessment, protective measures must be defined — network segmentation, access control, hardening. But UR E26 goes beyond protection: it also requires detection capabilities (recognising anomalies), response procedures (containing an incident) and recovery plans (restoring critical functions).
UR E27 runs in parallel, directed at the suppliers of onboard systems. Every OEM must demonstrate for their CBS: which security functions the product offers, how it is hardened, which vulnerabilities are known, how updates are applied and over what period support is guaranteed. This is a fundamental change from previous practice, where many OEMs delivered their systems as black boxes without detailed security documentation.
Together, E26 and E27 form a two-tier system: E26 creates the framework at vessel level, E27 ensures that the building blocks — the individual CBS — can technically support this framework. For class this means: at delivery, both the overall architecture and the conformity of individual system suppliers are surveyed.
The most critical points in the newbuilding process concentrate on three areas: system architecture, network segmentation and supplier interfaces. For system architecture, the task is to define early how the various CBS domains — navigation, automation, communication, cargo — are separated from one another. This requires a dedicated network plan that is not created only during commissioning but is already part of detailed planning.
Network segmentation is the operational centrepiece. IACS expects networks to be divided into zones, each with a defined protection level. Communication between zones takes place via controlled transition points — so-called conduits. A classic problem: the automation supplier brings their own network segment, the navigation supplier likewise, and in the end three separate networks are connected via an uncontrolled switch. This is precisely the situation UR E26 aims to prevent.
Supplier interfaces are where things become particularly complex. Every OEM has their own ideas about how their system connects. Some require direct internet access for remote maintenance, others use proprietary protocols, still others deliver systems with embedded operating systems that have not been patched for years. The yard must act as integrator here and ensure all CBS are embedded in a coherent network topology.
A fourth, often overlooked point involves Factory Acceptance Tests (FAT) and Site Acceptance Tests (SAT). Previously these were used primarily for functional testing — does the system run, does it communicate correctly? Now cyber aspects must also be verified: are hardening measures implemented? Have default passwords been changed? Are unnecessary services deactivated? Does the actual network connection match the documentation?
UR E27 makes unmistakably clear: cyber is not solely the yard's or operator's responsibility. Every OEM delivering a Computer-Based System must provide so-called System Integrator Documentation. This includes: a description of the system architecture, a list of all network interfaces, hardening guidelines, known vulnerabilities with mitigation measures and a statement on patch availability.
For many maritime OEMs, this is a considerable adjustment. Automation manufacturers who have been building proprietary systems with 20-year life cycles for decades often have no established processes for security documentation. The question "Which CVEs affect your system and how are they mitigated?" is standard in other industries but still uncharted territory in the maritime OEM landscape.
The consequences are real: if a supplier cannot meet UR E27 requirements, their system becomes a problem during classification. Class surveys not only the vessel topology (E26) but also the conformity of individual system suppliers (E27). A non-compliant CBS can block delivery.
For operators this means: supplier selection must henceforth also consider cyber maturity. A supplier who builds technically excellent systems but cannot deliver security documentation becomes a project risk. This should be addressed as early as the specification phase — not only when systems are already installed onboard.
Operators should embed cyber topics in the newbuilding process from the very beginning. Concretely this means: include cyber requirements in the building specification, agree UR E27 conformity as a contractual clause with every CBS supplier, and appoint a dedicated cyber responsible party within the newbuilding project.
During FAT, cyber tests should be established as a fixed component: verification of hardening, testing of access control, verification of network connections against the specification. During SAT onboard, the actual network topology is additionally checked — does the real installation match the plan?
Documentation is another critical point. UR E26 requires current and complete documentation of network architecture, CBS inventory and risk assessment. These documents must not only be available at delivery but must also be kept current throughout the operational phase. A system changed after delivery — whether through a software update, a new VSAT installation or replacement of a control system — must be reflected in the documentation.
The building specification is the central contractual document between operator and yard. Cyber requirements must be included as a dedicated section, not as a footnote in the IT section. The following elements should be covered:
First: a requirement for the network topology. The yard must deliver a complete network plan showing all CBS, their connections, zone boundaries and conduits. This plan must be agreed with class before detailed planning begins.
Second: UR E27 conformity as a delivery requirement for all CBS suppliers. Every OEM must deliver their System Integrator Documentation before FAT. The yard is responsible for integrating this documentation into the overall package.
Third: cyber tests during FAT and SAT. The specification should define concrete test cases — hardening verification, access control testing, network segmentation testing, recovery testing for critical systems.
Fourth: a handover documentation package containing all cyber information relevant for operations — CBS inventory, network plan, risk assessment, hardening guidelines, patch strategy, recovery procedures.
Anyone who does not include these requirements in the building specification will find it difficult to enforce them contractually later. Retrospective demands on OEMs are expensive and time-consuming — and they arise precisely when the project is under time pressure.
The first vessels built under full UR E26/E27 applicability are expected to be delivered in 2026/2027. Patterns are already emerging from ongoing projects: the greatest difficulties occur where cyber requirements were not integrated into the project structure from the beginning.
Yards in East Asia, which build the majority of global tonnage, are responding differently. Some large yards have established dedicated cyber teams. Smaller yards rely on external consultants or expect the operator to specify requirements in detail. This creates asymmetry: experienced operators obtain better results because they ask the right questions.
On the classification society side, the level of survey detail varies. All IACS members have incorporated the URs into their rule sets, but interpretation and survey depth differ. Operators working with multiple class societies should clarify early what specific expectations their respective society holds.
Free initial consultation – we analyze your situation and find the best path forward.
Request Consulting