SeaReadyMaster's Companion

IMO Res. MSC.428(98) · MSC-FAL.1/Circ.3/Rev.4 · IACS UR E26 & E27 · SIRE 2.0

Maritime Cyber Risk Management, IACS UR E26/E27 & Shipboard OT Checklist

Since 1 January 2021 (IMO Res. MSC.428(98)), maritime cyber risk management has been a mandatory part of every vessel’s ISM Code Safety Management System (SMS). With the entry into force of IACS Unified Requirements E26 and E27 on 1 July 2024 and heightened scrutiny under SIRE 2.0, RightShip RISQ 3.2, and USCG CVC-WI-027, inspectors now physically test bridge, engine-room, and cargo control room cyber controls.

This guide explains the regulatory baseline (MSC.428(98), MSC-FAL.1/Circ.3/Rev.4, IACS UR E26/E27), physical USB and OT port locks on ECDIS and loading computers, IT/OT network segmentation, and GNSS spoofing / ransomware response drills.

Updated · Written by SeaReady in our own words. Not affiliated with OCIMF, RightShip, CDI, any MoU or any administration — always check the current official documents.

1. Regulatory Baseline: MSC.428(98), MSC-FAL.1/Circ.3/Rev.4 & IACS UR E26/E27

Shipboard cyber security inspections bridge five key international and classification instruments covering both Information Technology (IT) and Operational Technology (OT):

Key maritime cyber security regulations and standards inspected by PSC, Class, SIRE 2.0 and RightShip.
Instrument / AuthorityApplicability & Effective DateCore Shipboard & SMS Requirement
IMO Resolution MSC.428(98) — Cyber Risk Management in Safety Management SystemsMandatory at first annual DOC verification after 1 January 2021Requires cyber risks to be appropriately addressed inside the vessel’s ISM Code Safety Management System (SMS) in accordance with the objectives and functional requirements of the ISM Code (Elements 1.2.2.2, 7, 8, 9 & 10). Failure to follow SMS cyber controls is cited by PSCOs under ISM Code deficiencies.
IMO Circular MSC-FAL.1/Circ.3/Rev.4 — Guidelines on Maritime Cyber Risk ManagementSix functional elements, all running at the same time (para 3.5): Govern, Identify, Protect, Detect, Respond, RecoverCovers both Information Technology (IT) and Operational Technology (OT) systems — bridge navigation/ECDIS, propulsion/power management, cargo/ballast control, fire/safety systems, access control, and crew welfare networks — using a risk-based defence-in-depth approach.
IACS Unified Requirement E26 (Rev.1) — Cyber Resilience of ShipsMandatory for newbuilding contracts signed on or after 1 July 2024Establishes vessel-wide cyber resilience requirements across five functional phases for Computer Based Systems (CBS): system inventory, network segmentation between untrusted IT and safety-critical OT zones, security zone boundary protection (firewalls), incident detection, and recovery.
IACS Unified Requirement E27 (Rev.1) — Cyber Resilience of On-Board Systems and EquipmentMandatory for newbuilding contracts signed on or after 1 July 2024Sets 31 baseline system-integrity and security capabilities (plus 10 additional requirements for systems connecting to untrusted networks) based on IEC 62443-4-2 for marine equipment suppliers — physical port locks, role-based authentication, audit logging, and signed firmware.
USCG NVIC 01-20 & 33 CFR Part 101/104 (MTSA Cyber Rule & Foreign Vessel PSC)Enforced during USCG Port State Control exams (Work Instruction CVC-WI-027)USCG PSCOs check whether poor cyber hygiene (uncontrolled USB media on ECDIS/cargo computers, default passwords, unpatched operating systems, or unsegmented crew Wi-Fi) indicates an ISM SMS failure; any suspected cyber incident affecting a vessel bound for a US port must be reported to the National Response Center (NRC).

2. Physical OT Security: Bridge, CCR & Engine Control Room Walkaround

Vetting and PSC inspectors rarely ask to inspect firewall rule tables directly — instead, they walk the bridge, Cargo Control Room (CCR), and Engine Control Room (ECR) looking for physical and procedural breaches of the Ship Cyber Security Plan:

  • Physical USB & RJ45 Port Blockers: Every unused USB, RJ45 Ethernet, and serial port on ECDIS, radar, VDR, cargo loading / stability computers, ballast water management panels, and main-engine/power-management workstations must be fitted with a physical mechanical port blocker, with the removal key held under the custody of the Master or Chief Engineer.
  • Dedicated ECDIS & Loading Computer USB Workflow: Weekly ENC chart updates and stability transfers must use colour-coded, serial-numbered USB media dedicated to a single system, scanned at an isolated malware-checking station before every use, and logged in the Removable Media / USB Control Log.
  • Third-Party Technician & Surveyor Access Control: Before a shore service engineer connects a laptop or USB diagnostic tool to any shipboard OT system (main engine governor, BWMS, VDR, or radar), require a signed IT/OT Work Permit, verify recent malware scan proof on their device, supervise the connection continuously, and record the firmware version before and after service.

3. Top 4 Shipboard Cyber Deficiencies & How to Prevent Them

Under USCG Work Instruction CVC-WI-027 and SIRE 2.0 Human Factors, any of the four findings below can be escalated to an ISM Code non-conformity:

Most frequent cyber security observations recorded during SIRE 2.0, RightShip and USCG PSC inspections.
Common Shipboard FindingRequired ControlCorrective & Preventive Action
Unlocked USB ports on ECDIS, Radar, or Cargo Loading ComputerPhysical USB port blockers + dedicated malware-scanning kioskNever insert a crew personal USB stick, phone charging cable, or un-scanned pilot/surveyor USB directly into ECDIS, the cargo loading computer, or machinery control workstations.
Shared or default admin passwords taped to bridge/ECR monitorsUnique role-based accounts + secure password custody with MasterRemove all sticky notes showing passwords from the bridge, Cargo Control Room (CCR), and Engine Control Room (ECR); ensure manufacturer default passwords (`admin/admin`, `1234`) are changed and logged in the Master’s sealed cyber envelope.
Outdated IT/OT Asset Inventory & Network Topology DiagramLive hardware/software/firmware register in the Cyber Security PlanMaintain an up-to-date inventory of all IP-connected and standalone OT/IT assets (make, model, OS/firmware version, network zone, and physical port status) matching actual shipboard equipment.
No GNSS / GPS Spoofing & Jamming Bridge Response DrillDocumented cyber incident & GNSS spoofing drill in SMSConduct and log periodic cyber response drills covering GNSS position spoofing (cross-checking radar parallel indexing, visual bearings, eLoran/dead reckoning & gyro/magnetic compass) and ransomware isolation of business IT.

4. IT/OT Network Segmentation, Offline Backups & GNSS Spoofing Response

Under the six functional elements of MSC-FAL.1/Circ.3/Rev.4 (para 3.5: Govern, Identify, Protect, Detect, Respond, Recover) and IACS UR E26, the Master and Senior Officers must be ready to demonstrate recovery capability:

  • Govern: Know who is accountable for cyber security — the person or entity the company has named to plan, resource and run it — and the roles and responsibilities on board and ashore. Have the cyber risk policies to hand, and show how business continuity works: backups, disaster recovery and crisis management.
  • Strict IT / OT Network Segmentation: Ensure the crew welfare Wi-Fi, business email/admin network, and safety-critical OT networks (bridge navigation, engine automation, cargo control) are segregated by hardware firewalls with no unauthorized bridges, dual-homed PCs, or rogue cellular routers plugged into OT switches.
  • Tested Offline ("Cold") Backups: Keep offline, immutable backup images and configuration files for the stability/loading computer, planned maintenance system (PMS), and business servers in the Master’s fireproof safe, and log periodic restoration tests.
  • GNSS / GPS Spoofing & AIS Manipulation Playbook: Train bridge watchkeepers to recognise GNSS spoofing/jamming signatures in high-risk areas (Eastern Mediterranean, Black Sea, Red Sea, Arabian Gulf, Baltic Sea) and switch immediately to terrestrial radar parallel indexing, visual fixes, echo sounder contours, and dead reckoning without relying on spoofed GPS feeds.

Planning a shipboard network architecture review or a scoped PMS data integration? Read Marvel Solutionz’s Marine IT & OT Network Segmentation and Shipboard PMS Integration Guide (opens in a new tab).

Questions seafarers ask

When did maritime cyber risk management become mandatory under the ISM Code?

Under IMO Resolution MSC.428(98), adopted on 16 June 2017, Administrations were required to ensure that cyber risks are appropriately addressed in existing Safety Management Systems (SMS) no later than the first annual verification of the Company’s Document of Compliance (DOC) after 1 January 2021. Port State Control Officers, SIRE 2.0 inspectors, and RightShip RISQ inspectors audit shipboard compliance against the company’s Cyber Security Plan and SMS procedures.

What is the difference between IACS UR E26 and IACS UR E27?

Both IACS Unified Requirements apply to newbuilding ships contracted for construction on or after 1 July 2024. IACS UR E26 targets the ship as a collective system-of-systems throughout design, construction, commissioning, and operational life — requiring network architecture segmentation, security zones, and boundary firewalls between IT and OT systems. IACS UR E27 targets individual on-board computer-based systems and equipment (aligned with IEC 62443-4-2), requiring equipment manufacturers to build in user authentication, USB/port hardening, event logging, and software integrity verification.

How should bridge officers safely update weekly ENC chart permits and notices to mariners via USB?

Under the BIMCO Guidelines on Cyber Security Onboard Ships and standard SMS procedures, weekly ENC chart updates must use a dedicated, brightly labelled "ECDIS ONLY" USB flash drive. Before transferring files from the ship’s business/communication PC to the dedicated USB drive, the USB drive and update files must be scanned on an isolated malware-scanning station with up-to-date antivirus signatures, and every USB unlock/relock event must be recorded in the Bridge Cyber / USB Logbook.

What should the Officer of the Watch (OOW) do if GNSS / GPS spoofing or jamming is suspected?

If the ECDIS position jumps unexpectedly, HDOP degrades, or GPS speed/course diverges from log speed and gyro heading, the OOW must immediately call the Master, switch navigation primary fixing to radar range/bearing and Parallel Indexing (PI) plus visual terrestrial bearings, silence false GNSS-driven alarms only after verifying backup sensors, check AIS and GMDSS time/position inputs, and log the anomaly in the Deck Log Book and Cyber Incident Report.

Open the ISM, PSC & SIRE 2.0 Checklists in SeaReady

Audit shipboard IT/OT cyber controls, ECDIS USB logs, IACS UR E26/E27 compliance, and GNSS spoofing drills alongside your PSC and SIRE 2.0 preparation — 100% offline in SeaReady.

  • Offline SIRE 2.0, RightShip RISQ and PSC checklists
  • AI mock inspector and orals examiner
  • AI photo review of defects and ship-work photos
  • Rest-hour planner and record-book tools
Start your 14-day free trial See plansOpen this tool in the app

Crew $39.99/mo · Officer Pro $99.99/mo · Ship licence $899/mo per ship + 5% sales tax

14-day free trial, no card needed. Works offline at sea once installed.

Related guides

All 68 guides →