Maritime OT vs IT security
Every modern ship runs two entirely different network families: Operational Technology (OT — the systems that control the physical vessel) and Information Technology (IT — the systems that support crew + business). Understanding the segmentation between them is the single most important concept in maritime cyber security today, and — since IACS UR E26 + E27 became mandatory for new-build contracts from 1 July 2024 — a first-order regulatory requirement.
Operational Technology (OT) — the physical control layer
OT systems physically control the vessel. If OT fails or is compromised, the vessel loses navigational or mechanical control.
- ECDIS + integrated bridge — Electronic Chart Display and Information System + radar overlay + AIS + heading gyro. Navigational safety critical.
- VDR — Voyage Data Recorder. Legally significant on casualty investigation.
- Engine + alarm monitoring — engine control room (ECR) + IAS (Integrated Alarm System) + Kongsberg/Wärtsilä/MAN control panels.
- Cargo control — tanker CCR + gas-carrier cargo system + container-lashing computers.
- Ballast water management — treatment system control.
- DP + steering — dynamic positioning + auto-pilot + steering gear.
Information Technology (IT) — the crew + business layer
IT systems support the crew and business functions. Compromise is inconvenient but doesn't (typically) put the vessel physically at risk.
- Crew WiFi + welfare — Starlink + Inmarsat crew allowance networks.
- Business email — Master + officers + ship-management-side communication.
- Cargo planning + reporting — noon-report software, cargo manifest systems.
- Crew payroll + accounting — shipboard financial software.
- Maintenance management — planned maintenance systems (AMOS, ShipSure, etc.).
The segmentation principle
The core cyber-security control is physical + logical segmentationbetween OT and IT networks. A compromised crew laptop on the WiFi network should not be able to reach the ECDIS network. This is enforced via:
- Physically separate cable runs + switches.
- DMZ (demilitarised zone) firewall between OT and IT with strict allow-list.
- USB port control on OT equipment (ECDIS updates must go through a controlled process, not a crew USB stick).
- Vendor-remote-support access via jump-host + logged sessions only.
IACS UR E26 + E27 (mandatory from 1 July 2024)
IACS Unified Requirement E26 (Cyber resilience of ships) + E27 (Cyber resilience of onboard systems and equipment) are mandatory for new-build contracts signed on or after 1 July 2024. Practical implications:
- UR E26 (ship-level): requires cyber-security type approval at class survey, including OT/IT segmentation architecture, incident response plan, and vendor security assurance.
- UR E27 (equipment-level): requires cyber-security capability declarations from every OT system supplier (ECDIS vendor, engine-control vendor, etc.). Vendors publish CBOM (Cyber Bill of Materials) to enable ship-level integration assessment.
- Retrofit implications: existing vessels not immediately affected but charterer + insurer expectations converging on E26/E27 standard by 2028-2030.
Chief Officer + ETO practical checklist
- Know which network you're on. Never plug a personal USB stick into an ECDIS or engine-alarm computer.
- ECDIS chart updates: use only vendor-approved distribution channels + verify the update signature.
- Vendor remote-access requests: require documented change-control + Master approval.
- Report any unusual behaviour (unexpected reboots, alarm-network noise, unauthorised access attempts) to the Company Security Officer.
- Cyber-incident drills should include: ECDIS failure procedure, VDR chain-of-custody, and rollback to paper charts.