By EJN Labs · 20 Oct 2026 · 6 min read
No, not by name. IACS UR E26 does not require penetration testing as a specific test method. It sets out verification testing carried out mainly by the supplier and systems integrator, showing shipboard systems were built as designed and checked by the classification society across design, construction, commissioning and operation. Many shipowners commission independent penetration testing anyway, for assurance the paperwork alone cannot give.
Why is IACS UR E26 suddenly showing up in shipowner conversations?
Charterers, insurers and class surveyors are asking because IACS‘s UR E26, in force for ships contracted from 1 July 2024, built cyber resilience into classification itself. A vessel without the right notation can face survey delays, and partners increasingly treat it as a proxy for real security.
Before UR E26, maritime cyber security sat largely in guidance rather than the classification process, and how far a shipowner went was mostly a commercial judgement. UR E26 changed that for new tonnage, and older fleets are following as charterers, flag states and insurers start asking for the same evidence on vessels that were never required to hold it.
What does IACS UR E26 actually require, and from whom?
UR E26 organises vessel cyber resilience around five functions: identify, protect, detect, respond and recover. Responsibility splits between the shipowner, systems integrator, supplier and classification society, each stakeholder demonstrating compliance at its own defined stage of design, build or operation.
UR E26 covers the vessel as a whole. The companion requirement, UR E27, sets the security profile for the individual computer-based systems fitted on board, from navigation to propulsion control. Scope is operational technology and safety-critical systems rather than everyday IT, though the boundary between the two is exactly where a lot of maritime cyber risk actually sits.
Does IACS UR E26 name penetration testing as a required test?
No, not as a named method. UR E26 is built around verification testing, defined and mostly run by the supplier and systems integrator, showing a system was implemented as designed and meets its assigned security profile. That is a compliance check, not an adversarial test of what an attacker could achieve.
The gap between the two is why penetration testing has become common practice for shipowners we work with, particularly on systems that are not yet type-approved to UR E27, or where crew and passenger networks connect to operational technology in ways the design documentation does not fully capture.
How does a penetration test of shipboard OT systems actually run?
A shipboard OT penetration test starts ashore, reviewing network diagrams, system inventories and existing E26 and E27 evidence before testing touches the vessel. Work is then scoped around zones already defined for classification, prioritising systems where a compromise could affect propulsion, steering or navigation.
- Documentation and zone review. We work from the systems inventory and zone diagrams already produced for E26 and E27 compliance, so testing targets the boundaries and remote access paths those documents describe rather than starting from nothing.
- Network segmentation testing. We test whether isolation between zones, and between IT and OT, actually holds under active probing, not just on paper.
- Remote access and removable media. Vendor remote support connections and USB or removable media paths are common ways OT systems get reached, so both are tested directly.
- Safe execution. Testing that could affect propulsion, steering or safety systems runs against a sister system, simulator or shore-based test environment rather than a vessel underway, agreed with the shipowner before work starts.
The report maps findings back to the same zones and stakeholders UR E26 already defines, so it sits alongside your existing compliance evidence rather than duplicating it. Our penetration testing checklist covers the preparation that makes a scoping call for this kind of engagement efficient.
What does a penetration test of shipboard OT systems cost in the UK market?
A single-vessel OT security review typically costs £3,300 to £7,000 in the UK market, covering 3 to 5 days of documentation, architecture and zone review. A fuller penetration test of shipboard OT systems typically runs £6,600 to £14,000 for 6 to 10 days, at UK day rates of £1,100 to £1,400.
| Scope | Typical effort | Typical UK cost |
|---|---|---|
| OT security and zone architecture review | 3 to 5 days | £3,300 to £7,000 |
| Shipboard OT penetration test | 6 to 10 days | £6,600 to £14,000 |
| Fleet or newbuild programme (multiple vessel classes) | 12 to 20 days | £13,200 to £28,000 |
| Retest after remediation | 1 to 2 days | £1,100 to £2,800 |
These are typical UK ranges rather than quotes; the right scope depends on the vessel’s systems, how much E26 and E27 documentation already exists, and how much of the fleet is in scope. For a wider view of how testing prices are built up, see our guide to penetration testing costs in the UK.
How EJN Labs approaches IACS UR E26 penetration testing
EJN Labs is a UK CREST-accredited penetration testing firm, also certified to ISO 27001 and ISO 9001, with every engagement delivered by UK-based testers. For maritime clients, we scope testing around the zones UR E26 defines, so findings map onto the compliance evidence already being produced.
We treat class compliance and independent testing as complementary, not competing. Where UR E27 certification is still in progress for a particular system, or where a vessel design brings crew Wi-Fi, passenger networks or third-party OT into the same zone, that is usually where we recommend starting. If you are comparing firms for maritime or wider infrastructure penetration testing, our guide to choosing a UK penetration testing provider sets out the questions worth asking any vendor, including us.
Frequently Asked Questions
Does IACS UR E26 require shipowners to commission penetration testing?
No. UR E26 does not require penetration testing as a named test method. It is built around verification testing, largely defined and run by the supplier and systems integrator, showing a system meets its assigned security profile. Independent testing is something shipowners commission on top of that.
Which vessels does IACS UR E26 apply to?
UR E26 applies to ships contracted for construction on or after 1 July 2024, covering the operational technology and safety-critical systems that make up the vessel. It works alongside UR E27, which sets requirements for the individual computer-based systems fitted on board, rather than the vessel as a whole.
What is the difference between IACS UR E26 and UR E27?
UR E26 covers the vessel as a whole: how systems are zoned, integrated and governed across design, construction, commissioning and operation. UR E27 covers the individual computer-based systems fitted to the vessel, such as navigation or propulsion control units, and the profile each must meet before going on board.
What does a penetration test of shipboard OT systems cost in the UK market?
A single-vessel OT security review typically costs £3,300 to £7,000 for 3 to 5 days. A fuller penetration test of shipboard OT systems typically runs £6,600 to £14,000 for 6 to 10 days, at UK day rates of £1,100 to £1,400. Fleet-wide or newbuild programmes are scoped and quoted individually through our quote form.
Can a shipowner rely on class society compliance alone, without penetration testing?
Class society compliance typically confirms a vessel meets the security profile UR E26 and E27 assign to its systems, which is a real and useful bar. It does not test what an adversary could achieve against those systems, so many shipowners test alongside it, particularly where systems are not yet type-approved.
Put your vessel’s cyber resilience to the test
If you are preparing a vessel for UR E26 survey, renewing a fleet-wide security programme, or want assurance beyond the paperwork, tell us about your systems and zones through our CREST pentesting quote form, and a scope built around your vessel is what you will get back.
Related research
For more on how this fits the wider transport and maritime picture: our guide to the pen test evidence IACS UR E27 asks of shipyards and suppliers, how penetration testing evidence is used with vehicle approval authorities elsewhere in transport, and the security testing transport operators are increasingly asked to evidence.
Leave a Reply