IMO Resolution MSC.428(98) requires cyber risks to be addressed in a ship's Safety Management System, and has been applied at the first annual verification of the company's Document of Compliance after 1 January 2021. The IACS Unified Requirements E26 and E27 go further for newbuilds.
UR E26 (Cyber resilience of ships) sets requirements for how computer-based systems on board are identified, protected, monitored, and recovered after an incident across the vessel's life. UR E27 (Cyber resilience of on-board systems and equipment) sets requirements for the systems and equipment themselves, so suppliers have to show their products meet a minimum level of security.
For existing ships, the same principles are good practice and are increasingly what charterers, insurers and vetting inspectors ask about: an accurate asset inventory, segmentation between IT, OT and crew networks, controlled remote access, endpoint protection that works over satellite links, and an incident response plan the crew has practised.
Visiotech carries out cyber risk assessments against the ISM Code, BIMCO guidelines and IACS UR E26/E27, and delivers a prioritised remediation roadmap and evidence pack you can use in audits.