What to Know First
A structured overview of cyber-resilience considerations for relevant ship systems.
- UR E26 addresses the ship; UR E27 addresses onboard systems and equipment.
- Applicability depends on vessel type, dates and the adopted class rules.
- You need cybersecurity records throughout your system’s life, from design and installation to updates and maintenance.
E26 and E27 in plain English
UR E26 looks at cyber resilience across the ship: identify, protect, detect, respond and recover. UR E27 sets requirements for the computer-based systems and equipment supplied for that ship.
The two requirements connect. A compliant component still needs to be integrated into a controlled ship architecture.
What fire-system suppliers may need to provide
For connected fire panels, monitoring gateways and workstations, expect questions about ports, protocols, accounts, removable media, logging, software versions, backups and secure update methods.
Remote support should be disabled or tightly controlled when not in authorised use.
- Network and data-flow diagram
- Asset and software inventory
- Hardening and account-management instructions
- Backup, restore and update procedure
- Known-vulnerability and support policy
Keep security documents up to date
Cyber resilience continues after delivery. Record configuration changes, security updates, expired accounts and replacement components. Test recovery rather than assuming a backup file is usable.
Coordinate cyber work with the fire system’s life-safety change and testing procedures.
Project Checklist
Contract, construction, vessel type, class rule and revision.
System inventory, network boundaries, data flows and remote connections.
Secure development, hardening, update, recovery and vulnerability handling.
Accounts, access, backup, logging, incident response and change control.
Frequently Asked Questions
Does a disconnected fire panel avoid cybersecurity requirements?
Not necessarily. Service laptops, removable media, temporary links and connected subsystems can still create cyber risks; confirm the applicable class requirements.
Official references
Information is based on reviewed sources and our experience at the date shown. Use it at your own risk and verify current codes, certificates and project conditions. Report an issue or suggest a correction.