IACS updates two cyber security requirements

The update relates to the URs covering the cyber resilience of ships that were introduced in April 2022: UR E26 Cyber Resilience of Ships, and UR E27, Cyber Resilience of On-Board Systems and Equipment, which applied to new ships from 1 January 2024.

IACS notes that the maritime sector has gained greater experience of cyber security oversight in the intervening period, while the need for a standardised approach to survey requirements has been identified.

In addition, the scope of applicability of the URs have been categorised as mandatory and non-mandatory compliance depending on vessel types and sizes, in response to the challenges regarding the implementation of new cyber requirements in smaller and non-conventional vessels.

These improvements have resulted in extensive changes to the two URs and so they will now supersede the originals and will be applied to new ships contracted for construction on and after 1 July 2024. The original versions of the URs, as well as their previous application date of 1 January 2024, have been withdrawn.

The revised version of URE27 is available on the IACS website here. The revised version of URE26 is still being finalised and will be published before the end of the year.

IACS Secretary General, Robert Ashdown, said “Incorporating industry feedback to ensure IACS requirements are clear in their applicability and are capable of being consistently applied in ship surveys, is important in ensuring that measures to enhance cyber resilience have the desired impact. As a result, and given that the original requirements had not yet entered into force, IACS has decided to apply only the revised requirements from 1 July 2024. It is believed that industry will welcome the clarity that this decision brings.”