Cyber Risk Management of Automation Systems

UR E26 Rev.1 and E27 apply to new ships within scope from 1 July 2024; existing ships remain under MSC.428(98), SMS and specific requirements. Current IMO guidance is MSC-FAL.1/Circ.3/Rev.4.

Operational Explanation

UR E26 Rev.1 and E27 apply to new ships within scope from 1 July 2024; existing ships remain under MSC.428(98), SMS and specific requirements. Current IMO guidance is MSC-FAL.1/Circ.3/Rev.4.

Regulatory Reference

Scope of Application

UR scope by type/size, contract date and applicable class Rules; renewal survey alone does not turn an existing ship into a UR E26 new ship.

Procedure / How to Complete It

1. Classify ship and scope under applicable UR/class rule.
2. For new ships retain required design, construction, commissioning and operational evidence.
3. For existing ships apply Company-SMS cyber controls and flag/class/contract/modification-specific requirements.
4. Do not require first Annual Survey logs without an applicable requirement.
5. Check the current IMO revision against the official index.

Practical Example

At renewal an existing ship retains MSC.428/SMS controls; it enters UR E26 only through a specific requirement/modification scope, not the survey alone.

What Typically Goes Wrong

Citing a 2026 IACS revision, automatic Renewal Survey inclusion, universal first Annual Survey logs, or a cyber circular before Rev.4.

Common Mistakes Mistake Library

What the PSCO Checks

Operational Tips

• Separate current requirement, class/maker, SMS and voluntary guidance.
• Do not improvise tests, thresholds or intervals.
• Record deviations and corrective action.

Preparation checklist

• UR/class scope proven
• Contract date checked
• New/existing distinct
• SMS cyber evidence
• Rev.4 cited

FAQ

Related Topics

Last substantive revision of this page: 31 August 2026 · page fingerprint 790119a13507