InsightsCyber compliance
Does IACS UR E26 apply to my vessel?
IACS UR E26 has generated a remarkable amount of fear-based selling. So before anything else, here is the honest position: E26 probably does not apply to most of the ships already in your fleet. And you still have cyber work to do. Both things are true, and the difference decides your budget and your timeline.
The one question that decides most cases
Was the ship contracted for construction on or after 1 July 2024?
- Yes: E26 applies as a class requirement, and E27 governs the systems and equipment your suppliers deliver. You have a hard requirement with a date attached, and the cheapest time to deal with it is before delivery, not after.
- No: E26 does not automatically apply. It is not retroactive. Anyone telling you your 2019-built tanker must "comply with E26" is selling, not scoping.
Second question: is the vessel type in scope at all?
The mandatory scope covers:
- Passenger ships on international voyages
- Cargo ships of 500 GT and above on international voyages
- High-speed craft of 500 GT and above
- Mobile offshore drilling units of 500 GT and above
- Self-propelled mobile offshore units
For other vessel types, the requirements are non-mandatory guidance. That does not mean irrelevant. It means nobody will detain you over them yet.
The part that applies to everyone anyway
Every vessel has been subject to IMO cyber risk management under the ISM Code since January 2021. That obligation is already live, it already applies to your whole fleet, and it is already being looked at by Port State Control. So even a fleet with zero E26 exposure needs, at minimum: a cyber asset inventory, sensible network segregation, controlled access and remote paths, and an incident response plan the crew will actually follow at 03:00.
And the direction of travel is one way. Class societies increasingly treat E26-aligned practice as the standard for existing tonnage, and it shows up in charterers' questionnaires and vetting long before it shows up in a rule.
What E26 actually requires, in practice
If you are in scope, you must be able to show:
- A documented inventory of every computer-based system essential to safe operation, with manufacturer, model, firmware version and network connectivity
- A process for identifying and responding to known vulnerabilities in those systems
- Network architecture that segregates what needs segregating, documented and approved
- Access control, malware protection and recovery capability
- A Cyber Resilience Test Procedure, exercised at construction and at annual surveys
- A Ship Cyber Security and Resilience Program, maintained for the life of the vessel and verified by class
Notice that every one of those depends on the first one. You cannot protect, detect, respond or recover without knowing what is connected. The inventory is dull, boots-on-deck work, and it is where operators actually fail. Not because they are careless, but because nobody ever wrote down what is on the vessel network.
A decision path you can apply today
- Newbuild contracted on or after 1 July 2024, in-scope type: hard requirement. Start before delivery; the handover documentation is where compliance either exists or does not.
- Existing vessel, in-scope type: no automatic E26 obligation, but a live ISM obligation and hardening market expectations. Do the inventory and segmentation properly, at your own pace, before a charterer or PSC sets the pace for you.
- Out-of-scope type: treat E26 as good practice guidance. Take the parts that protect your operation, skip the ceremony.
- Equipment supplier: your question is E27, not E26, and it is now appearing in procurement contracts. See our E27 guidance for suppliers.
Questions we hear every week
My ship was contracted before 1 July 2024. Does E26 apply?
Not automatically. E26 and E27 apply to ships contracted for construction on or after 1 July 2024 and are not retroactive. But IMO cyber risk management under the ISM Code has applied to every vessel since January 2021, and Port State Control increasingly looks at it.
My vessel is under 500 GT or trades domestically. Am I in scope?
For vessel types outside the mandatory scope, E26 is non-mandatory guidance rather than a requirement. Worth doing some of it anyway, but nobody will detain you over it yet.
Can NPT Solutions certify my vessel against E26?
No, and be suspicious of anyone who says they can. Class societies certify. We prepare you, build the architecture, and produce the evidence your surveyor asks for.
A note on sources: the contract date, scope thresholds and five-function structure above reflect IACS and classification society publications as we understand them at the time of writing. This area moves. Your class society and flag administration are the authoritative sources; confirm anything that matters with them before relying on it.
Want the answer for your actual fleet?
A scoping call is free and deliberately small. Tell us your vessel types, tonnage and contract dates, and we will tell you which requirements bite, which do not, and what we would do first.