Services / E27 for Suppliers
E27 is now a procurement condition, not a nice-to-have.
If you make equipment that goes on vessels, owners and yards are starting to ask for things you may not have yet. We help you build them, and the evidence trail that goes with them.
The bids you lose quietly.
IACS UR E27 covers the cyber resilience of on-board systems and equipment, which makes it the suppliers' half of the new maritime cyber regime. For ships contracted from 1 July 2024 it is a class requirement, and owners are pushing its obligations down their supply chain through procurement contracts.
Suppliers who cannot answer the new questions are being excluded from bids. Quietly, and without being told why.
The good news: the requirements are buildable, and most makers are closer than they fear.
The questionnaire you should expect.
These are the capabilities owners, yards and their consultants increasingly require before your product goes on a vessel.
If you can already evidence all five, you do not need us. If any of them made you pause, that pause is what costs bids.
- A secure software update mechanism. Signed, controlled, documented delivery of firmware and software to systems in service.
- A vulnerability disclosure policy. A published, working way for researchers and customers to report weaknesses, and a process behind it.
- Evidence of hardening. Not a claim. Documentation showing how the product ships secured, and against what baseline.
- Firmware traceability. The ability to state which firmware version runs on which vessel, and prove it at survey.
- Security capabilities documentation. The handover material yards and owners need to build their own E26 evidence on top of your product.
From gap to evidence, at maker scale.
Gap assessment against E27
What you already satisfy, what is missing, and what order to fix it in. Fixed fee, deliberately small.
Secure update architecture
Designed and implemented with your engineers, sized for your product, not for an enterprise software company.
Vulnerability handling process
Disclosure policy, triage process and advisory format that a small engineering team can actually sustain.
Hardening and evidence pack
The documentation trail that survives a surveyor's question and a procurement team's checklist.
Ongoing retainer
Firmware ages and questionnaires keep coming. We keep the evidence current so each bid does not restart from zero.
We sit on both sides of this requirement.
We are not a paperwork consultancy. We install and segment the vessel networks E26 asks owners to defend, we manage the onboard systems your products live alongside, and we build our own maritime software. When we help you design a secure update path, we are describing constraints we deal with ourselves: satellite links, offline vessels and crews with a job to do.
That also means we know exactly what the owner's side will ask for, because we are often the ones preparing their E26 evidence and asking suppliers the same questions.
Next step
Find out where you stand before a tender decides it for you.
A gap assessment is a fixed fee and deliberately small. Tell us what you make and where it goes on board, and we will tell you what E27 actually demands of it, and what to build first.
We make equipment, not software. Does E27 still apply to us?
If your product contains computer-based systems and goes on board vessels in scope, yes. E27 is aimed at the systems and equipment suppliers deliver, and owners' procurement teams are now writing it into contracts.
We have not been asked about E27 yet. Why act now?
Suppliers who cannot answer are being excluded from bids quietly, without being told why. The first time you hear about it may be a tender you did not win.
Can you certify our product?
No. Class societies handle type approval and certification. We build the capabilities and the evidence trail so that when certification or a customer audit comes, you pass it.
We are a small engineering team. Is this heavy?
It does not have to be. The requirements scale sensibly: a working update mechanism, a real disclosure route and honest documentation. We design processes a small team can sustain, not enterprise ceremony.
Do you work with our existing development process?
Yes. We fit the security work into how you already build, test and release. Replacing your toolchain is not the goal; passing procurement and survey is.