This guide defines which systems can be operated locally and manually if the primary network is compromised — and proves to a Class Surveyor that your vessel can maintain safe operation independent of any CBS during a cyber incident.
IACS UR E26 §4.4.2 is one of the few requirements that a Class Surveyor will physically test — not just review on paper. They will ask the ETO to demonstrate that propulsion, steering, and safety-critical systems can be operated from their local panels without any dependence on the networked control system. If the answer is “we’ve never tried that,” it is an immediate finding.
This requirement connects directly to SOLAS II-1 Regulation 31, which mandates that local control of propulsion and steering remains available at all times regardless of the state of any connected system. A cyber incident that disables the integrated automation system must not also disable the ship’s ability to manoeuvre safely.
What “Local & Independent” Actually Means
E26 §4.4.2 requires that local backup controls are fully independent of the primary control network — meaning they must function even if the entire OT network is isolated or powered down. This is not the same as a software-based fallback mode. It means physical local panels that operate without any CBS involvement.
The two-layer architecture shown here is the physical reality E26 §4.4.2 and SOLAS II-1 Regulation 31 are designed to protect. Layer 1 is the normal operating state — integrated automation, networked CBS, centralised control. Layer 2 is what must exist independently and completely below it — hardwired local panels that function even if the entire OT network is powered off.
The surveyor test section is particularly important for commissioning preparation. E26 §4.4.2 is one of the few requirements that Class surveyors physically test rather than just review on paper. They will ask to see the Local Control Test Record, ask the ETO to describe the isolation procedure, and at commissioning may walk to the ECR local panel or steering gear room to verify the fallback works. If the test record does not exist, or if the ETO cannot demonstrate the procedure, it is a finding regardless of whether the panels themselves are functional.
<< Click the diagram to expand at full resolution
What this does NOT mean
A backup HMI on the same network
A redundant server that fails over automatically
Remote access from shore as a fallback
Any control path that passes through a CBS in scope
What this DOES mean
Physical local control panel at the machinery itself
Hardwired emergency stop and start capability
Manual valve operation at the local manifold
Bridge wing manual steering that bypasses autopilot and IAS
Systems Requiring Local Control Verification
The following table maps the critical systems on a typical vessel to their local control method and the E26 evidence required. Adapt this to your vessel’s actual configuration — the principle is that every Category III system must have a local fallback that does not depend on the IAS or any networked CBS.
System
Cat.
Local Control Method
Evidence for Class
Main Propulsion
III
Local control panel in ECR / engine side — speed and direction control independent of bridge telegraph CBS
Completed test record showing local start, stop, and speed change without IAS active
Steering Gear
III
Local steering panel on bridge wing and at steering gear room — manual helm input bypassing autopilot and IAS
SOLAS drill record + E26 local control test confirming steering gear room operation
Power Management / Generators
III
Local start/stop panels on each generator — manual synchronising without PMS network involvement
Test record of manual generator start, synchronisation, and load transfer at local panel
Fire Detection & Suppression
III
Hardwired fire alarm panel — detection and alarm activation independent of AMS network
Fire drill record confirming local alarm panel activation; AMS bypass test
Bilge & Ballast
II/III
Local valve operation and pump start at manifold — no dependency on cargo/ballast management CBS
Test record of manual ballast operation at local valve manifold
Watertight Doors / Integrity
III
Local manual operation at each door — watertight integrity must not depend on the door control network
Test record confirming local operation of each watertight door independent of CBS
The Surveyor Test — What to Expect
A Class Surveyor assessing E26 §4.4.2 compliance will typically do two things: ask to see documentation, and then ask you to demonstrate. The following is the typical sequence during a commissioning or special survey.
Step 1
Document ReviewThe surveyor asks for the Local Control Test Record — a document listing each critical system, its local control method, and a signed record of the last successful test. If this document does not exist or is more than 12 months old, it is a finding before any physical test takes place.
Step 2
Network Isolation SimulationThe surveyor may ask the ETO to simulate network isolation — not a full blackout, but confirmation that the ETO knows the isolation procedure and can describe what each critical system would do when its CBS connection is severed. Reference the Network Isolation Procedures playbook for the correct sequence.
Step 3
Physical DemonstrationAt commissioning survey, the surveyor may walk to the ECR local panel, bridge wing, or steering gear room and ask to see the local control operate. They are not expecting a full blackout test — they want to confirm the panel is functional, labelled, and the ETO knows how to use it without CBS support.
Step 4
Incident Response Plan CheckThe surveyor checks that the Incident Response Plan (§4.4.1) includes specific reference to local control procedures — i.e. the plan says “if propulsion CBS is compromised, transfer to local ECR panel using procedure X.” If local control is not mentioned in the IRP, it does not satisfy §4.4.2 even if the panels work.
Common Findings — What Fails This Requirement
No local control test records
The most common finding. Panels may work perfectly but if there is no test record signed by the ETO and dated within 12 months, there is no evidence of compliance.
Local panels not labelled
Emergency local controls must be clearly labelled so any crew member — not just the ETO — can locate and operate them under stress without referring to a manual.
IRP does not reference local control
The Incident Response Plan must explicitly reference local control as a response option. A plan that only addresses digital isolation without mentioning physical fallback does not satisfy §4.4.2.
Local control bypassed during commissioning
On some newbuilds the local control panels are installed but never commissioned properly because the IAS works and nobody tests the fallback. Surveyors have found local panels with no power supply or disconnected signal cables.
Annual Local Control Test Procedure
Run this test at minimum once per year and record each result. At commissioning, run it for every system listed in your CSDD as having a local control requirement.
Notify the Master and Chief Engineer before the test — any local control test must be pre-approved as it temporarily bypasses normal automation
Test each system individually — for each Category III system, confirm the local panel operates the physical equipment without any CBS interaction
Document the result immediately — record the date, system tested, test method, result (pass/fail), and any observations. ETO signs each entry
Record any failures as defects — a local panel that does not operate correctly is a defect to be raised in the planned maintenance system and rectified before the annual survey
File the record in the SMS cyber annex — the test record must be retrievable at annual survey without searching through maintenance logs
Surveyor tip: Keep the Local Control Test Record as a standalone document in your SMS cyber annex — not buried in the planned maintenance system or engineering logs. When a surveyor asks for it, you should be able to hand it over in under 30 seconds. A laminated quick-reference card at each local panel showing the test procedure and last test date is considered good practice by DNV and LR.
Compliance Documentation
Templates supporting local control documentation and IRP integration.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
E26 §4.4.2
Local, independent and manual operation — Local backup controls required by SOLAS II-1 Regulation 31 must be fully independent of the primary control system and protected from cyber incidents in any connected network.
