IACS Unified Requirements E26/E27: every control, and what you already have

19 controls 89 frameworks share controls with it International (IACS — 12 classification societies) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	8	measure it →
BSI IT-Grundschutz	8	measure it →
FedRAMP Rev 5	8	measure it →
FISMA	8	measure it →
Ghana Cybersecurity Act	8	measure it →
MITRE D3FEND	8	measure it →
OWASP ASVS	8	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	7	measure it →
Annex 11 to EU GMP	6	measure it →
FDA 21 CFR Part 11	6	measure it →
FFIEC Cybersecurity Assessment Tool (CAT)	6	measure it →
ISO/IEC 27011:2024	6	measure it →

Every control

Code	Control	Also in
`IACS-UR-E26-Detect-Logging-Monitoring-Audit-Alerting`	IACS UR E26 Detect Goal - Logging + Network Monitoring + Audit Trail + Alerting + SIEM	19
`IACS-UR-E26-Identify-AssetInventory-CBS-NetworkArchitecture-Risk`	IACS UR E26 Identify Goal - Asset Inventory of Computer Based Systems + Network Architecture Documentation + Risk-Assessable Scope	6
`IACS-UR-E26-Identify-Plan-Risk-Survey-Documentation`	IACS UR E26 Identify Goal - Ship Cyber Resilience Plan + CBS Risk Assessment + Survey + Documentation	41
`IACS-UR-E26-Implementation-Training-Supplier-OEM-OnboardTraining`	IACS UR E26 Implementation - Training + Awareness + Supplier + OEM Management + Cyber Hygiene	0
`IACS-UR-E26-Protect-AccessControl-Authentication-IAM-Roles`	IACS UR E26 Protect Goal - Access Control + Identity + Authentication + Authorization + User Management	34
`IACS-UR-E26-Protect-Malware-Patch-VulnMgmt-Hardening`	IACS UR E26 Protect Goal - Malware Defence + Patch + Vulnerability Management + Hardening + Whitelisting	0
`IACS-UR-E26-Protect-NetworkSegmentation-Zones-Conduits-Boundary`	IACS UR E26 Protect Goal - Network Segmentation + Zones + Conduits + Boundary Defence + Data Diodes	14
`IACS-UR-E26-Protect-RemoteAccess-Wireless-Physical-Boundary`	IACS UR E26 Protect Goal - Remote Access + Wireless + Physical Security + Boundary Protection	32
`IACS-UR-E26-Respond-Recover-IncidentResponse-Recovery-Backup-Lessons`	IACS UR E26 Respond + Recover Goals - Incident Response + Communication + Recovery + Backup + Lessons Learned	49
`IACS-UR-E26-Scope-Applicability-2024-IMO-MSC-428`	IACS UR E26 - Scope + Applicability + Effective 1 July 2024 + Coordination IMO MSC.428(98) + Member Societies	0
`IACS-UR-E26-Survey-Approval-Documentation-OwnerPackage`	IACS UR E26 - Class Society Survey + Approval + Owner Documentation + Periodic Review	0
`IACS-UR-E27-Documentation-Owner-Package-Coordination-IMO-IEC-NIST`	IACS UR E27 - Documentation Package for Owner + Coordination IMO + IEC 62443 + NIST CSF + 2024-2025 Pipeline	0
`IACS-UR-E27-Equipment-Hardening-SecureConfig-Communications`	IACS UR E27 - Equipment Hardening + Secure Configuration + Secure Communications + Cryptography	20
`IACS-UR-E27-Equipment-UserAuth-Authentication-Authorization`	IACS UR E27 - Equipment User Authentication + Authorization + Session Management + Privileged Access	35
`IACS-UR-E27-Logging-Forensics-EventCapture`	IACS UR E27 - Equipment Logging + Forensic Readiness + Event Capture + Tamper Detection	51
`IACS-UR-E27-SBOM-SecureDev-TypeApproval-SoftwareIntegrity`	IACS UR E27 - Software Bill of Materials + Secure Development Lifecycle + Type Approval + Software Integrity	0
`IACS-UR-E27-Scope-System-Categorization-CategoryI-II-III`	IACS UR E27 - Scope + System-Level Applicability + Category I/II/III Classification + IEC 62443 Security Levels	0
`IACS-UR-E27-SecurityCapabilities-IEC62443-CategoryProfile`	IACS UR E27 - Security Capabilities by Category + IEC 62443-4-2 Foundational Requirements + Component Requirements	0
`IACS-UR-E27-Updates-Patch-Mechanisms-Maintenance`	IACS UR E27 - Equipment Update + Patch Mechanisms + Maintenance + Lifecycle Support	0

Tell me when IACS Unified Requirements E26/E27 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What this page is

A control-level reference for IACS Unified Requirements E26/E27, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition