Page 30 - 2022 - Q4 - Minerva in Focus

TURN
MARINE TECHNOLOGY IACS cyber security requirements: UNCERTAINTY

Yards and vendors must act promptly

The International Association of Classifica- New URs ensure holistic cyber those actions, followed by testing and getting
tion Societies’ (IACS’) unified requirements security of onboard equipment type approval. To keep systems safe, they will
for cyber security, due to come into force need to look at attack surfaces, log-in security
on 1 January 2024, herald a shake-up for Firstly, UR E26 targets the ship as a collective barriers, and configuration protection. They
the supply industry. They will require the entity for cyber resilience and covers five key will also need to protect device interfaces
compliance of the full spectrum of critical aspects: equipment identification, protection, and network interfaces, especially the links
onboard control and navigation systems. attack detection, response, and recovery. to shore, and implement consistent patching
Secondly, UR E27 aims to ensure system in- so that software is continually up to date.
tegrity is secured and hardened by third-par- “They should also ensure that back-up and
New IACS unified requirements focus ty equipment suppliers. This UR provides recovery procedures are in place to return
on cyber risks of onboard systems requirements for cyber resilience of onboard the system to a safe state.”, says Blomhoff.
systems and equipment, additional require-
While regulations like the 2021 IMO cyber ments relating to the interface between users DNV is ready to apply IACS-compliant
resolution require owners, operators, and and computer-based systems onboard, and Cyber secure rules to newbuilds
managers to consider overall cyber risks, product design and development of new de-
there are no concrete requirements at the vices before their implementation onboard. “We are fortunate to be the preferred class
systems level. However, this is now changing, partner major suppliers choose to work with
as the International Association of Classifi- Steps vendors should take in view of on type approvals. We take the process very
cation Societies (IACS) just published new the time pressure seriously, as it reflects our brand value. In
unified requirements (URs) that will oblige The fact that yards and vendors will have addition, when vendors choose to get a sys-
both yards as system integrators and system to verify critical systems to meet the re- tem type approved by us, it will reduce risks
vendors to build cyber security barriers into quirements represents a big change for the and uncertainties of newbuild projects, as
their systems and vessels. industry, given that control systems have a well as reduce the documentation that each
“The URs will apply to everything comput- long lifespan and development processes are vendor needs to provide for each vessel,”
er-based on board such as main-engine time consuming. says Blomhoff.
control systems, steering, cooling systems, “There are less than two years left, and ven- “With more than 100 vessels contracted so
fire detection, communications systems dors and yards will need this period to assess far for voluntary approval, as well as a larger
including public address systems, and nav- and verify that their control systems are com- range of automation and navigation system
igation systems – basically anything that is pliant. First, we encourage all vendors to go suppliers type-approving their systems with
integral to making the ship move, navigate through their portfolios and systematically DNV, we believe DNV and the industry are on INTO
and operate safely,” says Blomhoff. assess which products/systems they can a good path,” says Blomhoff.
The URs will apply to all newbuilds contract- make cyber secure enough to still be in use
ed after 1 January 2024 and also serve as after 1 January 2024.
non-mandatory guidance for existing ships Vendors should then make a detailed anal- CONFIDENCE
and new vessels contracted before that date. ysis of what needs to be done and execute

For the maritime industry, this is more than a moment of change. It’s a time for transformation.
Never have the decisions it faces been so complex. Nor their consequences ever mattered more.
As a trusted voice of the industry, we help decision-makers throughout the maritime world to make
purposeful and assured choices. From regulatory compliance, next generation fuels, vessel and
by Jarle Coll Blomhoff,
Head of Maritime Service Centre, operational optimization, to in-depth advice and insight, explore our solutions.
DNV Maritime

Learn more:
30 MINERVA IN FOCUS – ISSUE 22 / Q4 2022
dnv.com/maritime