Transport

Maritime

Ports and ships run the OT behind most of the world's trade: cranes, terminal systems, engines and navigation, more and more of it connected to shore.

Ports and terminalsVessels
Talk to an advisor For product makers

How the process runs

From berth to bridge

Ships are brought in, unloaded and loaded by cranes, and containers are stacked, tracked and sent out through the gate. On board, engines, power and navigation keep the ship safe at sea, connected to shore by satellite.

  1. Stage 1: Port approach

    Vessel traffic services and pilots bring ships to their berth.

    Control systems
    Vessel traffic service (VTS)AISPort community system

  2. Stage 2: Quay

    Ship-to-shore cranes load and unload containers or bulk cargo.

    Control systems
    STS crane controlRemote crane operation
    Challenge1

  3. Stage 3: Yard

    Yard cranes and vehicles stack, move and track containers.

    Control systems
    Yard crane automationTerminal operating system (TOS)Reefer monitoring
    Challenge1

  4. Stage 4: Gate and hinterland

    Trucks and trains collect and deliver through automated gates.

    Control systems
    Gate OCR and accessRail loading

  5. Stage 5: Engine room

    Engines, power management and ballast keep the ship moving and stable.

    Control systems
    Engine control and monitoringPower managementBallast water control
    Challenges23

  6. Stage 6: Bridge

    Integrated bridge systems plot, steer and communicate.

    Control systems
    ECDIS and radarAutopilotSatellite communications
    Challenges23
Across every stage

Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.

Satellite links to shoreOEM remote diagnosticsCrew and contractor USB useLinks to shipping lines and customs
Challenge4

For product makers

Building systems for ships and ports?

Ship systems are built by equipment makers, and IACS UR E27 now puts cybersecurity requirements on them directly.

What makers build
  • Integrated bridge and navigation systems
  • Engine and propulsion control
  • Power management systems
  • Ballast water and cargo control
  • Port cranes and terminal systems
What customers and regulators ask of the product
IACS UR E27

Onboard systems for new ships under UR E26 must meet E27, which builds on IEC 62443-3-3 and IEC 62443-4-1.

EU Cyber Resilience Act

Marine equipment under the Marine Equipment Directive is outside the CRA, but cranes, terminal systems and other port equipment sold in the EU are in.

IEC 62443-4-1

A certified development process answers the E27 lifecycle requirements and carries much of the CRA evidence.

Where product makers start
IEC 62443-4-1 SDLC CertificationYour way of working, audit-proofIEC 62443-4-2 CSA CertificationThe features your product is missingEU CRA ComplianceGap to conformity assessment

For plant owners

Where it gets hard, and how we tackle it

We start from how your process runs, fix what matters most first, and use what you already own wherever we can.

  1. 02 Quay03 Yard

    One attack can close a terminal

    Maersk put the cost of NotPetya in 2017 at USD 250 to 300 million. In 2023, ransomware stopped container handling at the Port of Nagoya for about two and a half days, and DP World Australia cut its ports off the internet for three days to contain an intrusion. Source: Maersk annual report

    How we tackle it

    We separate terminal OT from corporate IT, protect the TOS and crane systems, and plan how a terminal keeps working when IT is down.

    Cybersecurity Solutions
  2. 05 Engine room06 Bridge

    A ship is a remote network at sea

    Onboard systems connect to shore over satellite for monitoring and updates, set up by different suppliers, with the crew as the only IT staff.

    How we tackle it

    We assess the vessel as one system: every shore link, every supplier connection, and what the crew can realistically manage.

    Risk Assessment
  3. 05 Engine room06 Bridge

    New ships must meet IACS E26 and E27

    New ships contracted from 1 July 2024 that fall under IACS UR E26 must be designed for cyber resilience, and their onboard systems must meet UR E27, which builds on IEC 62443-3-3 and IEC 62443-4-1.

    How we tackle it

    For equipment makers, E27 is product cybersecurity: we map its requirements to your systems and build the development process and evidence classification societies ask for.

    IEC 62443-4-1 SDLC Certification
  4. Across every stage

    Cyber risk belongs in the safety management system

    IMO expects cyber risk to be handled in each company's safety management system, checked at company audits since 2021. India requires the same of Indian-flag ships.

    How we tackle it

    Policies, procedures and crew training that fit into your existing safety management system, not a separate binder nobody opens.

    Cybersecurity Program

Where plant owners usually start

Three ways in

01Gap AssessmentRapid maturity review02Risk AssessmentIEC 62443 / NIST, detailed findings03Cybersecurity ProgramPut everything in order

Rules and standards

What applies in maritime

  • IEC 62443International

    Zones and conduits for terminal, crane and onboard systems.

  • IMO MSC.428(98) and MSC-FAL.1/Circ.3/Rev.4International (IMO)

    Cyber risk handled in the safety management system. The latest IMO guidelines were issued in May 2026.

  • IACS UR E26 and E27Classification societies

    For ships in scope contracted from 1 July 2024. E27 builds on IEC 62443-3-3 and IEC 62443-4-1.

  • NIS2European Union

    Covers water transport companies, port managing bodies and vessel traffic services.

  • DG Shipping Circular No. 06 of 2017India

    Indian-flag ships must have cyber risk procedures in their safety management system, checked at company audits since 2021.

Talk to RelyBlue

Operating in maritime?

An honest conversation about your OT environment. No sales pressure, no fear tactics.

  • You talk to a senior advisor, never a salesperson