IACS Unified Requirements E26 and E27 appear repeatedly in maritime cyber security discussions. Often referenced, less often explained.
They mark the point where IACS, through its member classification societies, extended the logic of technical assurance into cyber resilience.
- So what do these two requirements actually do?
- And why does the distinction between them matter?
They address the problem from two different altitudes.
UR E26: Cyber Resilience of Ships
E26 treats the vessel as a single integrated system.
It establishes a minimum set of requirements for the cyber resilience of a ship across its design, construction, commissioning, and operational life.
Its structure follows five key functions:
- Identify
- Protect
- Detect
- Respond
- Recover
Its concern is the whole vessel. How onboard IT and OT systems are integrated, documented, tested, surveyed, and maintained as part of a cyber-resilient ship.
The key audience includes
- Shipyards
- System integrators
- Owners
- Operators
- Classification societies
UR E27: Cyber Resilience of On-Board Systems and Equipment
E27 works one level down.
It defines the minimum security capabilities that onboard systems and equipment must have in order to be considered cyber resilient.
This requirement is aimed primarily at equipment manufacturers and third-party suppliers.
It connects maritime cyber resilience with established industrial control system security principles, including references to IEC 62443-3-3 and IEC 62443-4-1.
In simple terms:
- E27 hardens the components.
- E26 governs the ship they are assembled into
Together, they create a layered model for maritime cyber resilience.
One point is widely misunderstood. The versions in force today are not the original editions.
IACS withdrew the first editions before they entered into force and replaced them with revised requirements:
- UR E26 Rev.1
- UR E27 Rev.1
These apply to ships contracted for construction on or after 1 July 2024.
Applicability is also now split between mandatory requirements and non-mandatory guidance depending on vessel type and size.
For anyone benchmarking against E26 or E27, working from the withdrawn 1 January 2024 editions is not a small administrative mistake.
It is a live compliance risk.
