Posts

Showing posts from 2025

Cyber Regulatory Landscape and Industry Responses in the Shipbuilding and Maritime Sector – Part 8: R E26 is ship-level, while SCARP is fleet-level.

Image
Why SCARP Is an Owner’s Responsibility, Not a Newbuilding Document Whenever UR E26 comes up on site, there’s a reaction I hear all the time: “Isn’t that just something the yard prepares during newbuilding to satisfy Class?” That’s not entirely wrong. But it’s only half the story . If you look at International Association of Classification Societies (IACS) UR E26 purely as a documentation requirement , you miss the most important question for owners: “Who is responsible for this ship — and this fleet — for the next 20 years, and how?” This post reframes UR E26 from a shipowner responsibility perspective . 1️⃣ What question does UR E26 really ask? UR E26 is actually very straightforward. It asks only one thing: “Does this ship have cyber resilience?” That’s why UR E26 requires the following six Deliverables : No UR E26 Deliverable Nature 01 Ship Asset Inventory Technical document 02 Zones & Conduit Diagram Network architecture 03 CSDD Design description 04 Ris...

[Ship OT Security] Where and How OT Security Is Applied on a Ship?

Image
Where and How OT Security Is Applied on a Ship ? One of the most common misconceptions when discussing shipboard OT security is the belief that “security is something applied to a specific piece of equipment or system.” In reality, OT security is not about installing something inside a device. It is far closer to deciding where connections should exist, and where they must be restricted , within the overall structure of a ship. To understand OT security properly, we must first revisit a fundamental question: Where is OT security actually applied? 1. OT Security Is Applied at the “Boundaries,” Not Inside the Equipment Most shipboard OT systems function exactly as intended. Engines run, generators supply power, and control systems operate based on control logic that has been validated over decades. The problem rarely lies within the system itself. It emerges at the points where systems are connected to one another . This is why OT security is primarily applied at: The bou...

[Ship OT Security] Why is ship OT security so different from IT security?

Image
— Why E26/E27 Had to Emerge “Isn’t security just about installing a firewall?” This is often the first question that arises when people encounter shipboard OT security for the first time. Organizations with strong IT security experience tend to ask this question even more frequently. Install a firewall Deploy antivirus software Apply patches on a regular basis At first glance, this feels like sufficient security. However, in the context of shipboard OT security, this approach almost always fails. The reason is simple. A ship is not an IT system. It is a physically operating system . The Top Priority of Shipboard OT Security Is Not Confidentiality In IT security, the fundamental triad is CIA: Confidentiality Integrity Availability In typical IT environments, this order makes sense. In shipboard OT environments, however, the order is completely reversed. The highest priority in shipboard OT security is Availability — the ability to continue safe operation at this ...

Cyber Regulatory Landscape and Industry Responses in the Shipbuilding and Maritime Sector – Part 7. Four Future Scenarios for the Shipbuilding Industry under E26/E27

Image
— How the Choices of Owners, Shipyards, Suppliers, and Nations Will Shape Completely Different Futures 1. E26/E27 Is Not Just a “Regulation,” but a Structural Turning Point for the Industry Formally, E26/E27 is a regulation. However, its impact goes far beyond simple compliance. This is because E26/E27 functions as a common industrial language that connects design – construction – operation – maintenance – audit into a single, integrated structure. In other words, depending on how E26/E27 is interpreted and who takes leadership over it, the future of the shipbuilding and maritime industry will diverge in fundamentally different directions. As a result, the industry is now branching into four distinct future scenarios . 🌊 Scenario 1: Owner-Centered Standardization – The Rise of the “Golden Owner” ▶ When shipowners take control of regulatory leadership Key Characteristics Establishment of an integrated cyber standard based on Owner Policy Shipyard and supplier doc...

Returning to the Shipyard: Where My Past, Present, and Future Converge

Image
  🌊 Standing Once Again at Hanwha Ocean, Reflecting on Myself and Committing to the Future — A Record of Reflection and Vision — Today, I visited Hanwha Ocean with several members of my team to attend a safety training session. The purpose was practical—to reduce repetitive entry applications and waiting time when accessing the yard in the future. I expected it to be a brief visit. Yet the moment I set foot on site, emotions I had long buried deep inside resurfaced. The scent of the sea, the sound of steel, the glow of welding sparks, and the hands of workers moving briskly through their tasks— everything vividly brought me back to the very first day I arrived here. Back then, under the name Daewoo Shipbuilding , I was just one employee learning day by day what the shipbuilding industry truly was, what human skill and sweat could create amid steel and fire, and how many lives are intertwined in that process. Looking back now, I realize how inexperienced I was. But t...

Cyber Regulatory Landscape and Industry Responses in the Shipbuilding and Maritime Sector – Part 6: Structural Causes of Supplier Documentation Variability and the Direction the Industry Must Take

Image
The question “Why is the quality of E27 documents so poor?” has become one of the most frequently raised concerns across shipyards, classification societies, and vessel owners. Many stakeholders express frustration: “Supplier documentation is too inconsistent,” or “Even when we ask for E27, every supplier delivers something different.” At first glance, it may seem easy to attribute this problem to supplier capability. But field observations across multiple shipyards, integrators, and system vendors reveal a different reality: the variability is not caused by supplier skill gaps but by structural gaps in the maritime industry itself. Below is a detailed examination of why E27 documentation varies so widely and what the industry must do to solve it. E27 Variability Is Not a Supplier Capability Problem Across shipyards and owners, the assumption is common: “Suppliers are not trained enough.” “Their documentation quality is poor.” However, the truth uncovered in actual marine pro...

⚓ A Letter of Gratitude and Commitment – 2025 (EY MCH - SEASON 01)

Image
From Insung Lee, EY MCH - SEASON 01 2025 was the year we planted the seed of MCH within Global EY and watched it take root. Looking back on nearly 20 years of my professional career, I realize how rare and fortunate it is to pursue something I had dreamed of since I was young— to build it, shape it, and watch it grow with my own hands. And even more importantly, I know how difficult—and meaningful—it is to do this together with people I trust. As this year comes to a close, I would like to express my sincere gratitude to all colleagues, mentors, and partners who have supported us throughout 2025. This year, we looked toward the same direction and truly shared a long voyage on the same vessel. There were countless moments—many of them challenging, complicated, and exhausting. Yet despite all of this, MCH stands where it does today because of: the senior and junior colleagues at the shipyards, the dedicated EY MCH team, and the shipowners and classification societies wh...