Blog, 7 November 2026

E26 and E27 for Limassol ship managers: who owes what on ships contracted from 1 July 2024

If the building contract for a ship was signed on or after 1 July 2024, the class rules IACS UR E26 Rev.1 and UR E27 Rev.1 apply to it. The yard designs, documents and tests the ship’s cyber resilience. Each equipment supplier gets its system certified under E27. After delivery the work passes to the shipowner, and to the manager who runs the ship: a cyber security programme approved by class before the first annual survey, records at that survey, evidence on request at later annual surveys, and tests witnessed by class at the special survey.

Which ships does E26 apply to?

UR E26 applies to ships contracted for construction on or after 1 July 2024. The E26 Rev.1 text defines that date as the day the contract to build the vessel is signed between the prospective owner and the shipbuilder. The first versions, published in April 2022, were withdrawn before they came into force on 1 January 2024. IACS said the revised rules “supersede the originals”, so for practical purposes only Rev.1 counts.

The mandatory scope is passenger ships on international voyages, cargo ships and high-speed craft of 500 GT and upwards on international voyages, mobile offshore drilling units of 500 GT and upwards, and self-propelled offshore construction units. For older ships and smaller craft E26 is non-mandatory guidance. A ship contracted before 1 July 2024 is not caught by it, even if it was delivered later. A ship in that scope contracted on or after that date is.

What E26 covers on the ship

UR E26 treats the ship as one system. It covers the operational technology that keeps the ship safe: propulsion, steering, anchoring and mooring, power generation, fire detection, bilge and ballast, the loading computer, watertight integrity, lighting and required safety systems, plus the navigation and communication systems required by the rules. Any IP connection from those systems to the office network, crew welfare or passenger networks is in scope too.

The requirements follow five headings: identify, protect, detect, respond and recover. In plain terms: know every networked device on board, split the systems into security zones with firewalls between them, notice when something goes wrong, have a plan for it, and be able to restore the systems. Safety systems must sit in their own zones, physically separated from the others, and navigation and communication systems may not share a zone with machinery or cargo systems.

What E27 asks of equipment suppliers

UR E27 Rev.1 is the rule for the maker of each system: the engine automation, the ballast control, the bridge equipment. E27 lists 30 required security capabilities for every system in scope, such as user login, access rights and malware protection. It adds further capabilities (items 31 to 41) for systems that connect to networks outside E26’s scope, such as a link to the shore, including multifactor login for remote users. E27 says these requirements are based on selected requirements in IEC 62443-3-3, the industrial control security standard, and its secure development rules point to IEC 62443-4-1.

Each supplier prepares a document set for class: an asset inventory, topology diagrams, a description of the security capabilities, a test procedure, security configuration guidelines, secure development documents, maintenance plans, information for the owner’s incident response and recovery plans, and test reports. The secure development documents, maintenance plans and incident response information go to class on request. A system without a type approval covering E27 also needs a survey and factory acceptance test. Either route ends with a System certificate that travels with the equipment to the yard.

Who owes what under E26 and E27?

E26 names four parties: shipowner or company, systems integrator, supplier and the classification society. Until delivery the shipyard is the systems integrator, unless another firm is contracted for that role. E26 adds one line that matters for contracts: the responsibility to fulfil the requirements lies with the party that has contracted with the classification society.

The definition of “shipowner” is the part a manager should read twice. In E26 it means the owner or any organisation “such as the manager, agent or bareboat charterer” that has taken over responsibility for operating the ship. If your office runs the ship, the operational duties are yours.

What must the ship manager have ready before the first annual survey?

Before the first annual survey, the shipowner submits a Ship cyber security and resilience programme to the class society. Once it is approved, the first annual survey checks records showing the programme is actually followed. E26’s summary table lists what the programme has to cover:

• Management of change, and of software updates
• Management of firewalls, malware protection and access control
• Handling of confidential information
• Remote access, including how a remote software update is confirmed before it starts
• Mobile and portable devices, such as USB sticks and service laptops
• Detection of security anomalies and verification of security functions
• Incident response plans and recovery plans

The shipowner also keeps the test procedure up to date with the suppliers’ help, keeps a copy of test results on board, and trains and drills the crew and the office staff ashore. For a Limassol manager, one sentence in E26 stands out: a change of vessel management company requires a new verification of the programme. Take over a ship from another manager and you are back in front of class.

Where we think the gaps open

In our view, the risk sits in the handover. The yard’s documents describe the ship on the day of the commissioning test. From then on, every new remote-access link, replaced switch or added sensor makes the zones and conduit diagram a little less true, and E26 expects the shipowner to manage those changes under UR E22 and keep the documents current. A manager who receives the pack as a folder of PDFs and never opens it again will find out at the first annual survey.

In our view, the second gap is the suppliers. Their E27 documents set what the ship can do: how logins work, which ports are open, how updates arrive. If a supplier’s security configuration guidelines are thin, the yard builds to thin guidelines, and the manager inherits that.

Those documents are also sensitive. A zones and conduit diagram is a map of the ship’s networks. If you want AI to search the pack, run it on your own hardware, as described in our guide to AI without sending client data to the cloud.

What to ask your yard and your suppliers

Put these questions on the table early, ideally before the specification is frozen:

1. Who is the systems integrator: the yard, or a firm the yard hires? Who has contracted with class?
2. When will we see the draft zones and conduit diagram and the cyber security design description?
3. Which systems hold a type approval covering E27, and which go through survey and factory testing?
4. Has any system been excluded from E26 by risk assessment, or approved with compensating countermeasures? Show us the document.
5. May we attend the onboard cyber resilience tests?
6. Will the delivery pack include every supplier’s security configuration guidelines, maintenance plans and incident response information?
7. For each supplier with remote access: how is a session started, logged and ended, and how is an update confirmed before it runs?
8. Who is each supplier’s security contact after delivery?

Where we help

We offer Limassol ship managers and technical superintendents help with three parts of this: drafting the Ship cyber security and resilience programme so it matches how your office really runs the fleet, reviewing the yard’s zones and conduit diagram against the ship as built, and checking supplier E27 documents before they become your problem. The aim is a programme your crew can follow and a surveyor can verify.