Respond: Incident Containment & Mitigation
IACS UR E26 Control 4.4: Cyber Incident Response Capabilities
The “Fire Drill” for the digital ship. Once a threat is detected, the ETO must act to isolate systems and prevent the spread of malware. This phase defines the technical and procedural steps to protect vessel safety during an active cyber event.
Incident response at sea — what makes it different
Incident response on a vessel operates under constraints that simply do not exist on shore. There might be no IT department to call. The ETO may be the only person on board with any understanding of the OT network. The vessel may be at sea with no shore connectivity. And critically — isolating a system to contain a cyber incident can itself create a safety risk if that system is part of propulsion, steering, or power management. Physical safety overrides cyber response at every decision point, and the response procedures have to be written with that constraint built in.
The playbooks in this phase are designed for that environment. They cover the first 15 minutes after a suspected incident is identified — what to check, what to preserve, what to isolate, and how to communicate — through to formal reporting to the Master, DPA, flag state, and Class. The procedures work whether the vessel is subject to IACS UR E26, operating under IMO MSC-FAL.1, or simply implementing best practice without a regulatory driver.
Pre-written response procedures are not just a compliance requirement — they are the difference between a controlled response and a chaotic one. An ETO who has read the First 15 Minutes playbook before an incident occurs will make better decisions under pressure than one who is working it out in real time. That benefit exists regardless of whether the vessel has a Class notation or a SIRE inspection coming up.
Effective response relies on Pre-Defined Isolation. In a maritime environment, we do not have time for complex forensics during a crisis—we must prioritize Vessel Maneuverability. This phase ensures the ETO can “cut the lines” between infected segments without crashing the Bridge.
Core Concept: The Cyber-Emergency Shutdown
Establishing clear rules for which network links can be severed instantly and which require a controlled sequence to avoid a total blackout.
Classification & Triage
Determining the severity of the incident and initiating the immediate diagnostic sequence.
Containment
Active measures to sever malicious connections and isolate infected OT segments.
Communication
Formal reporting to the Master, Fleet Office, and meeting IMO/IACS reporting deadlines.
Critical Action Policy:
In the event of a cyber incident affecting propulsion or steering, Physical Safety overrides Cyber Response. Only isolate systems if the action does not endanger the immediate safety of the vessel.
