Part of the MARITIME OT Playbook
← Return to Hub
Phase Review & Verification
This matrix summarizes the mandatory functional requirements from IACS UR E26 (Rev.1 Nov 2023). For a vessel to be compliant, the ETO must verify that each action below is implemented and testable.
PHASE 1: IDENTIFY
| §4.1.1: Vessel asset inventory | Functional Action: Create and maintain a full inventory of all Computer Based Systems (CBS), identifying their category (I, II, or III) and physical location. |
PHASE 2: PROTECT
| §4.2.1: Security zones & segmentation | Functional Action: Define logical and physical boundaries between systems of different categories using a zone and conduit architecture. |
| §4.2.2: Network protection safeguards | Functional Action: Implement firewalls, managed switches, and OS hardening to control and filter traffic between zones and reduce the attack surface. |
| §4.2.3: Malware protection & data integrity | Functional Action: Deploy endpoint detection and anti-malware controls on CBS where technically feasible. Ensure data integrity during transit and storage, protecting sensitive system configurations. |
| §4.2.4: Access control | Functional Action: Limit physical, logical, and digital access to critical CBS hardware and network infrastructure. Covers secure spaces, visitor supervision, port security, and identity management. |
| §4.2.5: Wireless communication | Functional Action: Secure all wireless interfaces with encryption and authentication to prevent unauthorized access to OT network segments. |
| §4.2.6: Remote access control | Functional Action: Implement strict controls for all vendor, VSAT, and shore-to-ship connections. Enforce zero-trust principles for all untrusted network access including supply chain and OEM service access. |
| §4.2.7: Removable media & portable devices | Functional Action: Control the use of USB drives, external storage, and portable devices to prevent malware introduction into the OT network. Enforce media scanning before any connection to CBS. |
PHASE 3: DETECT
| §4.3.1: Network operation monitoring | Functional Action: Implement tools to monitor network traffic and system logs for anomalies. Centralise event logs with trusted timestamps. Generate alerts for suspicious activity. |
| §4.3.2: Verification & diagnostics | Functional Action: Regularly test and verify that CBS are operating within their defined security parameters. Confirm that detection systems are active and logs are being correctly recorded and retained. |
PHASE 4: RESPOND
| §4.4.1: Incident response plan | Functional Action: Establish and maintain documented procedures for the crew to follow when a cyber incident is detected. Covers classification, containment, reporting, and DPA notification. |
| §4.4.2: Local & manual operation | Functional Action: Verify that the vessel can be safely operated via local physical controls if the CBS network is compromised or isolated. Annual test records required. |
| §4.4.3: Network isolation | Functional Action: Provide the capability to physically or logically isolate network segments during an attack without disrupting safe vessel operation. |
| §4.4.4: CBS safe state & fallback to minimal risk condition | Functional Action: Define and document the safe state for each Category III CBS. Establish procedures to bring the vessel to a documented Minimal Risk Condition when normal CBS operation cannot be maintained. |
PHASE 5: RECOVER
| §4.5.1: Recovery planning & execution | Functional Action: Maintain a documented recovery plan to restore essential CBS functions post-incident. Execute controlled recovery from verified clean sources only. |
| §4.5.2: Backup and restore | Functional Action: Regularly back up system configurations and golden images. Verify offline that backups can be successfully restored to a known good state. |
| §4.5.3: Integrity verification & system reconstitution | Functional Action: Verify system integrity after an incident before returning CBS to service. Update the SMS cyber plan with lessons learned. Confirm restored systems are free from compromise before reconnecting to the OT network. |
Audit Cycle Complete
All phases of the IACS UR E26 lifecycle have been mapped to the vessel’s documentation and Safety Management System.
ACCESS COMPLIANCE DASHBOARD