Pen testing cruise ships

This document describes a methodology for assessing cruise ship cybersecurity in alignment with IACS UR E26/E27, covering risk profiles, guest and crew attack perspectives, OT/IT segregation, risk-averse OT testing, physical security reviews, and SOC-driven purple team exercises. It lists critical OT systems to evaluate (e.g., IAMCS, navigation/ECDIS, safety systems, VDR, access control) and outlines practical tests for network segregation, credential hygiene, remote access, vulnerability assessments, and external attack surface reduction to ensure vessel safety and operational resilience.