Maritime lawyers assemble!

This report analyzes how increasing ship connectivity and new IACS cyber requirements (UR E26/E27) are reshaping maritime cyber risk, potentially rendering non-compliant vessels out of class and uninsured. It outlines delays to implementation (to July 1) and significant enforcement challenges due to widespread technical debt and limited cyber expertise among classification assessors, illustrated by findings such as backdoors, undocumented remote access, default credentials, and NAC bypasses during installations. While major cyber incidents at sea remain rare, the report underscores strong criminal incentives (e.g., fraud and cargo theft) and urges owners and operators to contractually enforce vendor security, validate installations against secure designs, and engage experienced maritime-focused penetration testers.