Cyber Risk Management of Automation Systems
UR E26 Rev.1 and E27 Rev.1 apply to new ships within scope contracted for construction on or after 1 July 2024; existing ships remain under MSC.428(98), SMS and specific requirements. Current IMO guidance is MSC-FAL.1/Circ.3/Rev.4.
Operational Explanation
UR E26 Rev.1 and E27 Rev.1 apply to new ships within scope contracted for construction on or after 1 July 2024; existing ships remain under MSC.428(98), SMS and specific requirements. Current IMO guidance is MSC-FAL.1/Circ.3/Rev.4.
Regulatory Reference
IACS UR E26 Rev.1 (November 2023) and UR E27 Rev.1 (September 2023); MSC.428(98); MSC-FAL.1/Circ.3/Rev.4, approved by FAL 50 and MSC 111 and dated 28 May 2026.
Rev.4 dated 28 May 2026 is the reference verified for this review. The general IMO cyber security page still lists Rev.3: use the official document linked from the FAL index to identify the edition and date. The guidelines provide recommendations for integration into risk management; they do not replace applicable flag and class requirements. IMO MSC-FAL.1/Circ.3/Rev.4.
For automation, identify OT systems, connections and essential-service dependencies; define authorised access, incident response and recovery. Connect cyber measures to operational safety and SMS responsibilities. IACS: cyber resilience objectives.
UR E26 Rev.1, §1.3.1, covers passenger ships (including HSC) on international voyages, cargo ships and HSC of 500 GT and above on international voyages, MODUs of 500 GT and above, and self-propelled mobile offshore units engaged in construction. Check exclusions and the specific E27 scope for systems and equipment. Application is tied to the construction contract signed on or after 1 July 2024, not simply delivery of the ship. IACS UR E26 Rev.1 — notes and §1.3.1. MSC.428(98), paragraph 2, encourages Administrations to ensure that cyber risks are addressed in the SMS no later than the first annual verification of the company Document of Compliance after 1 January 2021; this is not a universal entry-into-force date. IMO MSC.428(98).
Scope of Application
UR scope by type/size, contract date and applicable class Rules; renewal survey alone does not turn an existing ship into a UR E26 new ship.
Procedure / How to Complete It
- Classify ship and scope under applicable UR/class rule.
- For new ships retain required design, construction, commissioning and operational evidence.
- For existing ships apply Company-SMS cyber controls and flag/class/contract/modification-specific requirements.
- Do not require first Annual Survey logs without an applicable requirement.
- Check the current IMO revision against the official index.
Practical Example
At renewal an existing ship retains MSC.428/SMS controls; it enters UR E26 only through a specific requirement/modification scope, not the survey alone.
What Typically Goes Wrong
Citing a 2026 IACS revision, automatically including existing ships at Renewal Survey, imposing first Annual Survey logs without an applicable requirement, or naming an IMO revision other than the published Rev.4.
Common Mistakes Mistake Library
| Mistake | Consequence | How to Avoid It |
|---|---|---|
| Wrong cyber version or scope | Controls and evidence demanded from the wrong ship | Check official IMO/IACS indexes and contract date |
What the PSCO Checks
Operational Tips
- Separate current requirement, class/maker, SMS and voluntary guidance.
- Do not improvise tests, thresholds or intervals.
- Record deviations and corrective action.
Preparation checklist
- UR/class scope evidenced
- Contract date checked
- New/existing distinguished
- SMS cyber evidence ready
- MSC-FAL.1/Circ.3/Rev.4 cited
FAQ
Related Topics
Last substantive revision of this page: 16 September 2026 · page fingerprint 68e7d8fb2127