UR E27 Equipment Procurement Checker

August 3, 2026

UR E27 Equipment Procurement Checker

UR E27 is turning cyber resilience into a newbuild procurement issue. Owners, yards and ship managers can no longer buy a control system, navigation system, cargo system, power-management system, monitoring platform or connected onboard device based only on price, delivery time and technical performance. The supplier also needs to prove that the system is cyber-ready, documented, maintainable, recoverable and suitable for safe integration into the vessel network.

Subscribe to the ShipUniverse Weekly Newsletter

Use the simple checker for a fast buying-screen before requesting quotes. Use the in-depth checker when comparing suppliers, preparing an RFP, reviewing a yard package or checking whether a manufacturer’s compliance file is strong enough for class review.

Open Simple Checker Open In-Depth Checker

Important: This tool is a procurement screening aid, not a class approval, type approval, legal opinion or substitute for the vessel’s classification society. Use it to identify gaps before purchase orders, FAT, SAT, commissioning or newbuild delivery.

In-Depth UR E27 Equipment Procurement Checker

Use this version for supplier comparison, newbuild maker-list review, cyber-secure equipment procurement, RFP scoring, FAT readiness and class-document package planning.

Project and equipment profile

Newbuild contract scope

Equipment category

Network and external connection risk

Supplier approval evidence

Supplier documentation package

CBS asset inventoryHardware, software, firmware, serials, versions, interfaces and system boundary are identified.

Network topology and data flowsDiagrams show connections, protocols, ports, zones, firewalls and external links.

Secure development lifecycleSupplier shows security planning, design, implementation, verification, release, maintenance and end-of-life controls.

Maintenance and change planUpdates, patches, verification steps, change records and support responsibilities are defined.

Recovery planBackup, restore, rollback, reset, fallback and safe restart instructions are available.

System test planFAT, SAT, commissioning, security-function tests and acceptance criteria are documented.

Manuals and incident-response supportUser guidance, admin guidance, log handling and incident support information are included.

Technical cyber capability screen

Access control and authenticationUser IDs, admin roles, password policy, account removal and remote access are controlled.

Malicious-code protectionProtection from malware, unauthorized software, unsafe portable media and unauthenticated updates is addressed.

Security event loggingThe system logs security events, protects logs and supports incident analysis.

Communication integrityData flows, network traffic, remote sessions and external interfaces are protected.

Network segregation and hardeningPorts, services, firewall rules, unused functions and boundary devices are controlled.

Recoverable operationSystem can be backed up, restored, rolled back or restarted without unsafe vessel impact.

Remote access controlVendor access, service laptops, VPNs, modems, wireless paths and session logs are controlled.

Commercial and integration cost screen

Equipment package price

Cyber documentation and supplier support

Class review, testing, FAT and SAT support

Yard integration, network design and commissioning

Annual patching, support and vulnerability service

Delay exposure if package fails review

Procurement readiness score

Not ready

Complete the project profile, documentation and cyber capability screen to see the procurement recommendation.

Estimated cyber procurement exposure

Missing supplier evidence

Select the supplier evidence available above to build the gap list.

Procurement recommendation

Request the supplier’s UR E27 compliance matrix and class approval route before accepting the equipment package.

Buyer checkpoint	Pass signal	Commercial risk if missing	Procurement action
Approval path	Type approval, statement of compliance, class review or clear matrix.	Late redesign, class comments, FAT delay or substitute equipment.	Make approval evidence a bid requirement.
Asset inventory	Hardware, software, firmware, interfaces and versions are listed.	Ship asset inventory and cyber commissioning file become incomplete.	Reject vague “standard package” responses.
Network flows	Ports, protocols, data flows, zones and external links are documented.	Yard cannot integrate system cleanly into E26 vessel architecture.	Require topology diagrams before maker approval.
Security capabilities	Access, malware protection, logging, communication integrity and recovery are demonstrated.	Supplier sells hardware, but cyber functions are unproven.	Ask for tested capability evidence, not marketing language.
Lifecycle support	Patch, vulnerability, change, end-of-life and recovery procedures exist.	Owner inherits unsupported cyber risk after delivery.	Include support period and update obligations in the contract.
FAT and SAT readiness	Cyber test plan and acceptance criteria are included.	Cyber compliance becomes a commissioning surprise.	Put cyber tests into FAT, SAT and delivery milestones.

Copy-ready RFP clause for suppliers

Supplier shall confirm whether the proposed onboard computer-based system, equipment, software, firmware, network component, gateway, control system, monitoring system or connected service is within the scope of IACS UR E27 or the applicable class society equivalent. Supplier shall provide a UR E27 compliance matrix and evidence package including, as applicable: system boundary description, asset inventory, hardware list, software and firmware list, network topology, network flow list, network security equipment list, access-control design, malicious-code protection approach, security event logging details, communications integrity controls, remote-access procedure, secure configuration and hardening details, secure development lifecycle documentation, vulnerability and patch-management process, maintenance and change-management plan, backup and recovery plan, incident-response support information, system test plan, FAT and SAT cyber test criteria, user and administrator manuals, class type approval or statement of compliance, and any known limitations, exclusions or vessel-integration requirements. Supplier shall identify all external connections, untrusted network interfaces, cloud services, SOC connections, wireless paths, portable-media procedures and vendor service access methods before purchase order acceptance.

Feedback Welcome

We welcome your feedback, suggestions, corrections, and ideas for enhancements.

Please click here to get in touch

By the ShipUniverse Editorial Team — About Us | Contact

UR E27 Equipment Procurement Checker