NIS2 is the European Union's updated cybersecurity law. It widened the net dramatically: many more organisations now count as essential or important entities, and with that status comes a duty to manage cyber risk continuously, and to evidence it.

It also makes management personally accountable. Leadership must understand the risks, approve the measures, oversee them and be trained. "We assumed IT had it covered" is no longer a defence.

In practice: understand your risks, secure your networks and devices, control access, keep working copies of your data, manage your suppliers, train your people, watch for trouble, and report significant incidents fast.

SeaDirect Protect is the platform we run for our own managed customers, packaged so the controls, not just the paperwork, come as standard.

Each capability does its job and leaves a trail. A blocked connection, a missing update, an account closed the day someone left, a supplier's remote session: all of it recorded, dated and exportable. The evidence becomes a by-product of staying secure.

And because everything reports into one place, you get one honest view of where you stand, ranked so the thing you fix first is the thing that matters most.

IACS UR E26 covers the cyber resilience of the ship; E27 covers the on-board systems and what their suppliers must provide. Both apply to vessels contracted for construction on or after 1 July 2024, and are verified at Classification-Society survey.

Most of what NIS2 asks for is common to both. E26/E27 add operational-technology and safety-of-life controls (safe-state behaviour, independent local control, security zones and conduits) while NIS2 keeps its own reporting deadlines and management liability. Turn on the maritime profile and both analyses run side by side.

That software makes you compliant. Compliance is a set of things an organisation does. Software can carry most of the weight, evidence almost all of it, and remove nearly all of the drudgery, but somebody still has to decide, approve and sign.

That you cannot be breached. Anyone who says that is selling a feeling. What we commit to is that the controls are deployed, operating and evidenced, and that when something happens, you find out fast and can prove what you did.

That your accountability transfers to us. Under NIS2 it sits with your management body and cannot be contracted away. Under our managed plan we make sure the work behind those signatures is genuinely done, and we sign ours alongside yours.

That you need all of it. Most organisations need less than the full catalogue. We would rather tell you which parts to skip than sell you a shelf.