IACS UR E26/E27 · Vessels contracted for construction on or after 1 July 2024
IACS UR E26/E27 compliance documentation for newbuild shipyards
CyberAnchor is a compliance documentation platform for shipyards acting as systems integrator under IACS UR E26. It collects the supplier documentation required by UR E27, builds the vessel asset inventory and zones-and-conduits design, drafts the Cyber Security Design Description (CSDD) and Ship Cyber Resilience Test Procedure (SCRTP), and exports class-ready packages structured for submission to any IACS member society, including ABS, DNV, Bureau Veritas, Lloyd's Register and ClassNK. The AI reasons; the engineer decides.
Certainty at delivery: the complete E26/E27 evidence set, consistent and class-ready, assembled as the build progresses.
Live — in production pilots with yard and class users · Built on IACS UR E26/E27 verbatim
Structured to UR E26 Rev.1 (Nov 2023) and UR E27 Rev.1 (Sep 2023); class-ready output for any IACS member society
~75% lower documentation cost than consultant-led preparation
The Digital Bulkhead
Platform capabilities
CyberAnchor orchestrates the evidence chain across the 30 baseline and 11 untrusted-network capabilities — 41 in total — and closes 21 of 41 on documentary evidence alone; the rest it drives through test-procedure generation, witnessed-evidence capture, and Society omission decisions.
| Feature | E26/E27 clause | What it does |
|---|---|---|
| Supplier documentation portal | E27 3.1.1–3.1.10 | Structured intake of the ten supplier documents per CBS with submission status; no cost to suppliers |
| Document parsing | E27 3.1.3, 3.1.4 | Extraction of declared capability coverage against the E27 capability set; gaps flagged per CBS for engineer review |
| Vessel asset inventory | E26 4.1.1, 5.1.3 | CBS inventory with UR E22 system categories I, II and III and the fields E26 requires |
| Zones-and-conduits designer | E26 4.2.1, 5.1.1 | IEC 62443 zones-and-conduits topology editor with diagram export |
| CSDD drafting | E26 5.1.2 | CSDD structure and content assembled from inventory, topology and supplier data for engineer completion |
| Incident response and recovery plans | E26 4.4.1.1, 4.4.1.3, 4.4.1.4.1, 4.5.1.4.4; E27 3.1.8 | Consolidates supplier plan inputs for the shipowner, who owns both plans under E26 |
| SCRTP generation | E26 5.2.1 | Test procedure covering methodology and steps with expected results and acceptance criteria, built per CBS and per requirement |
| Class-ready export | E26 5.1, 5.2 | Submission packages formatted for the receiving IACS member society |
| Surveyor view | E26 5 | Read-only access for the Society to documents and test evidence |
Access model
Shipyards subscribe annually, tiered by the number of concurrent newbuild projects. Supplier invitations are unlimited and free; Society surveyors are invited at no cost. Ship owners have complimentary access during construction and receive the vessel's compliance record at delivery, the handover E26 Section 5 requires of the systems integrator. The founding cohort is capped at five shipyards or Q2 2027, whichever comes first.
CyberAnchor is led by Naveen Selvam, Founder & CEO — 12 years of maritime classification experience with the American Bureau of Shipping (ABS), INL Consequence-driven Cyber-informed Engineering (CCE) training (2018), IEC 62443 Expert and ISA Senior Member credentials, and prior seagoing service.
Applicability under IACS UR E26
Mandatory scope
- Passenger ships, including passenger high-speed craft, on international voyages
- Cargo ships of 500 GT and upwards on international voyages
- High-speed craft of 500 GT and upwards on international voyages
- Mobile offshore drilling units of 500 GT and upwards
- Self-propelled mobile offshore units engaged in construction (wind turbine installation, crane units, drilling tenders, accommodation units)
Non-mandatory guidance
- Cargo ships under 500 GT
- Fishing vessels
- Passenger yachts carrying not more than 12 passengers; pleasure yachts not engaged in trade
- Site-specific offshore installations (FPSOs, FSUs)
- Ships of war and troopships; vessels not propelled by mechanical means; wooden ships of primitive build
Does E26 apply to your newbuild?
Select the vessel type to check applicability under IACS UR E26 Rev.1 (ships contracted for construction on or after 1 July 2024).
Roles under E26/E27
| Role | E26/E27 term | Deliverables | Clauses | CyberAnchor function |
|---|---|---|---|---|
| Shipyard | Systems integrator | Zones and conduits diagram; CSDD; vessel asset inventory; risk assessment for CBS exclusion (if used); description of compensating countermeasures (if used); as-built updates; SCRTP; witnessed commissioning tests; handover of the full document set to the shipowner at delivery | E26 5, 5.1.1–5.1.5, 5.2, 5.2.1 | Project orchestration, asset inventory, zones-and-conduits designer, CSDD and SCRTP workflow, class-ready export |
| Equipment supplier / OEM | Supplier | The ten E27 documents: CBS asset inventory; topology diagrams; description of security capabilities; test procedure; security configuration guidelines; secure development lifecycle documents; maintenance and verification plans; information supporting incident response and recovery; management of change plan; test reports | E27 3.1.1–3.1.10, 6.2, 6.3 | Supplier portal at no cost to suppliers, document parsing, per-CBS gap tracking |
| Classification society | Society | Assessment of systems integrator documents; approval of the SCRTP; witnessed testing; decision on omission of tests; System certificate per CBS; first annual, subsequent annual and special surveys | E26 5, 5.2.1, 5.3; E27 6 | Read-only surveyor evidence view |
| Ship owner | Shipowner | Incident response plan; recovery plan; Ship cyber security and resilience program; upkeep of the SCRTP and CBS documentation through management of change | E26 4.4.1.1, 4.5.1.4.4, 5.3, 5.3.1 | Receives the vessel compliance record at delivery |
E26 functional elements
| Functional element | What the vessel documentation must address | E26 clauses | CyberAnchor output |
|---|---|---|---|
| Identify | Vessel asset inventory of every CBS in scope, with system category | 4.1.1 | Asset inventory |
| Protect | Security zones and network segmentation; network protection safeguards; malware protection; access control; wireless communication; remote access and untrusted networks; mobile and portable devices | 4.2.1 – 4.2.7 | Zones-and-conduits designer; CSDD design-phase sections |
| Detect | Network operation monitoring; verification and diagnostic functions | 4.3.1 – 4.3.2 | CSDD and SCRTP sections |
| Respond | Incident response plan; local, independent and manual operation; network isolation; fallback to minimal risk condition | 4.4.1 – 4.4.4 | Incident response inputs; SCRTP sections |
| Recover | Recovery plan; backup and restore; controlled shutdown, reset, roll-back and restart | 4.5.1 – 4.5.3 | Recovery plan inputs; SCRTP sections |
Compliance questions
Does IACS UR E26 apply to my newbuild?
UR E26 Rev.1 applies to ships contracted for construction on or after 1 July 2024, with the contract date determined under IACS PR No. 29, that fall within E26 1.3.1: passenger ships on international voyages; cargo ships and high-speed craft of 500 GT and upwards on international voyages; mobile offshore drilling units of 500 GT and upwards; and self-propelled mobile offshore units engaged in construction. Other vessels may apply it as non-mandatory guidance.
Who is the systems integrator under E26?
E26 defines the systems integrator as the organisation responsible for integrating supplier systems into the ship's integrated system. Until vessel delivery this role is taken by the shipyard unless another organisation is specifically contracted for it. The systems integrator produces the E26 design documents, the as-built updates and the Ship Cyber Resilience Test Procedure.
What is the Ship Cyber Resilience Test Procedure (SCRTP)?
The SCRTP is the commissioning-phase document (E26 5.2.1) in which the systems integrator specifies how each Section 4 requirement is demonstrated on board by testing or analytic evaluation, then executes it under Society witness after other commissioning activities are complete. It must define test setup, equipment, initial conditions, methodology and steps, and expected results with acceptance criteria, and record findings during testing.
How many security capabilities does E27 define?
E27 defines 30 required security capabilities for every CBS in scope (Section 4.1) and 11 additional capabilities for CBSs that communicate with untrusted networks, meaning any network outside E26 scope (Section 4.2) — 41 in total. Each capability references an IEC 62443-3-3 system requirement.
What does "class-ready" mean? Does CyberAnchor certify or approve the vessel?
No. CyberAnchor produces class-ready documentation: structured to the clause requirements of UR E26 and UR E27 and formatted for the receiving IACS member society. Review and sign-off remain with the shipyard's engineers; assessment, approval, System certificates and survey outcomes remain decisions of the classification society. The human-review gate is part of the design and is written into the customer agreement, which also carries the data-processing and liability terms expected of a SaaS platform.
Platform, data and commercial questions
Is customer data used to train AI models?
No. Documents uploaded by a customer or its suppliers are used only to generate that customer's compliance output. CyberAnchor does not train models on customer data, and the same restriction is written into its contract with the underlying model provider.
How does CyberAnchor use AI, and who makes the decisions?
AI performs document parsing and produces drafts. Every AI-drafted document passes mandatory engineer review before it can be exported, and nothing reaches a classification society without human sign-off. The AI reasons; the engineer decides.
Where is customer data hosted?
In a dedicated, access-controlled cloud environment with per-customer isolation, encrypted in transit and at rest. Regional hosting, including EU/EEA data residency, is agreed per customer contract.
Can suppliers or other customers see a shipyard's project data?
No. Access is scoped per project. Supplier accounts see only the project and systems they are invited to. Customers are isolated from one another.
How is data protected technically?
Data is encrypted in transit (TLS 1.2 or higher) and at rest. Access is scoped per project and per supplier account, and changes to compliance records are recorded in an audit trail.
Can CyberAnchor run on-premises or offline?
Not today. AI processing runs in CyberAnchor's cloud environment and requires connectivity. Private or virtual-private-cloud deployment can be discussed for sensitive environments.
What happens to a customer's data on exit?
All project data and documentation are exported to the customer in open formats; nothing is locked in. On termination, data is deleted, including backup cycles, within the period defined in the Data Processing Agreement, with certification on request.
How does E27 supplier documentation relate to the EU Cyber Resilience Act?
Onboard equipment with digital elements placed on the EU market falls within the Cyber Resilience Act (Regulation (EU) 2024/2847). Manufacturers' vulnerability and incident reporting obligations apply from 11 September 2026; the Regulation applies in full from 11 December 2027. The E27 supplier document set already covers adjacent ground — secure development lifecycle documentation (E27 3.1.6) and maintenance and verification plans (E27 3.1.7) — so CRA-aligned evidence such as software bills of materials, coordinated vulnerability disclosure policies and support periods can be submitted through the same E27 supplier workflow. CyberAnchor's own assessment is that a cloud compliance platform is not itself a product with digital elements within the CRA's scope.
How does CyberAnchor support NIS2 supply-chain due diligence?
For customers subject to NIS2 (Directive (EU) 2022/2555, Article 21(2)(d), supply-chain security), CyberAnchor's security documentation is structured for direct use as supplier due-diligence evidence. Contractual breach notification without undue delay supports customers' own reporting timelines.
What contractual data-protection terms does CyberAnchor offer?
A GDPR Article 28 Data Processing Agreement with EU Standard Contractual Clauses (Module Two) and a maintained sub-processor register, available for signature alongside any pilot.
What independent assurance exists?
CyberAnchor's infrastructure sub-processors hold SOC 2 Type II and ISO 27001 certifications, and CyberAnchor's own SOC 2 audit preparation is underway.
How is CyberAnchor licensed?
One platform with all modules included. Shipyards subscribe annually, tiered by the number of concurrent newbuild projects; supplier invitations are unlimited and free; there is no per-vessel repurchase. Ship owners have complimentary access during construction and receive the vessel's compliance record at delivery.
See the platform on your own newbuild's supplier list
Request a demo and we will walk through supplier intake, zone design, CSDD and SCRTP workflow against a project of your choosing.