Security that works when the link doesn't
A vessel is the hardest place to run security well: the connection is narrow, metered and intermittent, the crew rotates, the systems on board outlive the companies that made them, and the rules now expect you to prove all of it to a surveyor.
What makes a vessel different
These are not edge cases at sea. They are the normal operating condition.
The link is the constraint
Satellite bandwidth is limited and charged for. Anything that phones home constantly costs money on every vessel, every month.
Offline is normal
Protection cannot depend on reaching a cloud. The gateway has to keep deciding, and keep recording, while the connection is gone.
The crew rotates
Access has to be granted and revoked with the roster, and training has to be reassigned to whoever is aboard now.
Operational systems come first
Navigation, machinery and cargo systems must not be interrupted by a security measure. Separation matters more than blocking.
How the platform answers that
The gateway does the deciding on board. Blocking, inspection, segmentation and recording all happen locally, so nothing depends on the satellite being up. What crosses the link is a compact summary, deliberately budgeted: we treat vessel bandwidth as a cost to be managed, not as an assumption.
Multiple links are the norm rather than a luxury: satellite, a mobile connection in port, a fixed line alongside. The gateway watches all of them, moves traffic when one degrades, and ranks them by cost so bulk transfers wait for the cheap connection while a voice call does not. Where a satellite terminal is fitted, the vessel's position comes straight from the dish onto your fleet map.
Ship and shore are kept apart. Operational technology, business systems and crew Wi-Fi sit in separate zones with controlled paths between them, which is both good practice and precisely what E26 asks for. Crew and guest access is issued as time-limited vouchers that never touch the systems that run the ship.
And when the vessel comes back into contact, the record catches up: what was blocked, what changed, what was connected, when. That is the material a Classification Society survey and a flag-state inspection ask to see.
The rules, in one paragraph
IACS UR E26 and E27
E26 covers the cyber resilience of the ship as a whole: identification, protection, detection, response and recovery for the vessel's systems. E27 covers the on-board systems and equipment themselves, and what suppliers must provide with them. Both apply to vessels contracted for construction on or after 1 July 2024. In practice they ask for an inventory, security zones, controlled access, malicious-code protection, monitoring, an incident response with a safe fallback state, tested recovery, and documentation a surveyor can verify.
See the capability-by-capability mappingIf you also operate onshore in the EU (offices, terminals, logistics), those entities may separately be in scope for NIS2. The platform runs both analyses side by side rather than making you keep two programmes.
Where fleets usually start
Not everything at once. This is the order that tends to survive contact with a real vessel schedule.
One vessel, fully
Fit the gateway on a single ship, get the zones and links right, and learn what your fleet's traffic actually looks like.
Inventory the class
Discovery on board builds the systems inventory E26 and E27 both start from, usually the first thing missing.
Roll out by sister ship
The configuration that worked becomes the pattern, pushed to the rest of the class from shore.
Close the paperwork
Registers, drills and evidence assembled from what the fleet actually did, ready for survey.
Start with one vessel
Tell us the class, the systems on board and the link you have. We will scope a single-ship fit-out and what it would take to repeat it across the fleet.