FOR SHIPYARDS AND ONBOARD EQUIPMENT SUPPLIERS
IACS UR E26 and E27 compliance
you can prove to the surveyor
FuzzForge tests your suppliers' software, with or without the source code, and gives you proof the surveyor can replay.
Selected and Trusted by
OVERVIEW
What are IACS UR E26 and E27?
IACS UR E26 and E27 are the cyber resilience rules that classification societies apply to every ship contracted since 1 July 2024. UR E26 covers the ship, UR E27 each system on board. In practice, IACS UR E26 E27 compliance means an inventory of every system, a secure development lifecycle and security tests witnessed by the class surveyor.
WHO DOES WHAT
Who answers for what, and where FuzzForge fits
UR E26
Shipyard (systems integrator)
The ship test procedure and commissioning tests.
Flaws beyond the published CVE list.
UR E27
Equipment supplier
A secure development lifecycle and tested updates.
The same campaign, rerun in your CI on every release.
UR E26
Shipowner
Records at every annual survey.
A findings history per system and per version.
FuzzForge does not issue certificates. Your class society assesses compliance.
PROOF
Proof from the code ships run on
Selected for GICAN SeaStart.
6 CVEs in GNSS, AIS and NMEA 2000 code.
4 Pwn2Own wins.
1,500+ vulnerabilities found.
FAQ
Questions from shipyards and suppliers on IACS UR E26 and E27
Do IACS UR E26 and E27 require fuzzing or penetration testing?
No technique is named. Both rules ask you to demonstrate compliance by “testing and/or analytic evaluation”. Fuzzing, emulation and binary analysis are ways to produce that evidence, for example for the verification phase of the secure development lifecycle in UR E27.
Does type approval replace testing?
Type approval is voluntary and applies to standard, routinely manufactured systems. With a valid certificate, the supplier submits a reduced set of vessel-specific documents and skips the vessel-specific factory test. The secure development lifecycle still applies to every update of the product.
Can FuzzForge test our systems, with or without the source code, inside our own environment?
Yes. FuzzForge works on source code, compiled binaries and firmware images, and writes the fuzzing harness itself. It runs on-premise, with an air-gapped option, as well as in SaaS or a private cloud.
Build the evidence your class surveyor will ask for
A real campaign on one of your systems, run inside your environment. Results your engineers can replay in front of the surveyor.
MEET US
