Risk Assessment & Threat Mapping
This guide explains the risk assessment process required to exclude systems from E26 scope, and provides a methodology for mapping functional threats to the vessel’s specific OT topology.
1. The RA Methodology (E26 vs. Best Practice)
For UR E26 compliance, the risk assessment must be “Functional-Based.” For non-mandatory vessels, we recommend a “Vulnerability-Based” approach to prioritize budget and maintenance.
Focuses on Category II & III systems. Requires formal documentation of the “Safety Impact” if a system’s Integrity or Availability is lost.
Focuses on Cost & Operational Downtime. Prioritizes “Low-Hanging Fruit” like USB lockdowns and network segmentation.
2. Functional Threat Mapping (UR E27 Alignment)
Under UR E27, you must prove that technical controls are in place to mitigate specific threats. Use this matrix to bridge the gap between your inventory and your security controls.
The 5×5 matrix shown here looks simple but the maritime application has a nuance that generic risk frameworks miss. In a standard IT risk assessment, likelihood is based on threat actor capability and motivation. In a maritime OT context, the most significant likelihood factor is often the operational state of the vessel — an internet-facing ECDIS with default credentials in a busy port is a likelihood-5 exposure, while the same system isolated and offline in a shipyard dry-dock is a likelihood-1 exposure for the same vulnerability.
This means maritime risk scores should be voyage-phase dependent rather than fixed values. A risk register that assigns static likelihood scores without acknowledging operational context will systematically understate risk during high-exposure periods and overstate it during low-exposure periods — neither of which satisfies the functional-based assessment methodology required by E26 §5.3.
<< Click the diagram to expand at full resolution
3. Defining Risk: Scoring & Visual Matrix
To ensure consistency across the fleet, use the following criteria and the 5×5 Heat Map to determine your risk priority.
| IMPACT | |||||
| 5 | 10 | 15 | 20 | 25 | |
| 4 | 8 | 12 | 16 | 20 | |
| 3 | 6 | 9 | 12 | 15 | |
| 2 | 4 | 6 | 8 | 10 | |
| 1 | 2 | 3 | 4 | 5 | |
| LIKELIHOOD | |||||
- 1. Rare: Requires physical access + expert skill.
- 2. Unlikely: Possible via remote port; no known exploit.
- 3. Possible: Networked system; standard security.
- 4. Likely: Legacy OS or known unpatched vulnerability.
- 5. Almost Certain: Internet-facing OT with default credentials.
- 1. Insignificant: No operational impact.
- 2. Minor: Loss of non-essential monitoring.
- 3. Moderate: Temporary loss; manual bypass possible.
- 4. Major: Degradation of propulsion/steering.
- 5. Catastrophic: Total loss of safety-critical control.
4. Risk Response & Treatment
Once a risk is scored, the Technical Manager must select a treatment strategy. This is a mandatory step for UR E26 §5.3 documentation.
5. Strategic Integration: The RA Hub
To avoid duplicating effort, your Risk Assessment must directly reference the data points already established in your other playbook sections:
6. RA Lifecycle: When to Re-Assess
A Risk Assessment is not a one-time project. Under E26 Management of Change (MoC), the RA must be updated during:
Strategic Intelligence: The “Cascading Failure”
The Auditor’s Trap: Many shipowners assess systems in isolation. However, UR E26 requires you to assess “Networked Dependence.” If a Category I (Non-Essential) system like Crew Wi-Fi shares a switch with a Category II system, the risk score of the Category I asset must be elevated due to the potential for lateral movement.
Pro-Tip: Always audit the Physical Layer (Layer 1) before finalising your risk score. A shared cable is a shared risk.
For CBS-specific network risk — particularly where vendor-certified equipment connects to owner-supplied systems — the CBS Risk Assessor complements this guide by assessing zone/conduit architecture and scope boundaries against IACS E26/E27 at the network topology level.
Compliance Documentation Previews
Standardized templates for Risk Assessment and Threat Analysis. Register free to access all vault forms.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
