Is a private yacht under any cybersecurity obligation?

Not under resolution MSC.428(98), which works through the ISM Code: a strictly private yacht outside ISM has no SMS to audit. IACS class requirements UR E26 and E27 also list it under non-mandatory guidance. What remains is the flag, which may require a safety management system on large private units, the insurer, whose hull policy often excludes cyber losses, and common sense: the captain's mailbox and the guest network are attacked the same way whether the yacht charters or not.

What does an ISM auditor ask about cyber risk?

Since 1 January 2021 the auditor checks that the SMS treats cyber risk like any other risk: a documented assessment of the systems on board (bridge, propulsion, networks, satellite links), an inventory, defined roles ashore and on board, procedures for access, backups and incident response, and evidence of crew training and familiarisation. The MSC-FAL.1/Circ.3/Rev.4 guidelines of 28 May 2026 list the minimum controls expected; they are the simplest checklist for preparing an audit.

Is a foreign-flagged yacht calling in the United States covered by the Coast Guard rule?

Not directly. The rule at 33 CFR Part 101, Subpart F, in force since 16 July 2025, covers US-flagged vessels subject to the MTSA, port facilities and Outer Continental Shelf installations. A Cayman, Maltese or Marshall Islands yacht meets it through port State control: the US Coast Guard checks the SMS, cyber included, and keeps the power to detain or turn away a vessel whose cyber risk management is found wanting. The tanker boardings of summer 2026 show that power is no longer theoretical.

Cybersecurity on board yachts: what the rules require in 2026

On 21 August 2026 a team from the US Coast Guard and the FBI boarded the VL Prosperity, a Liberian-flagged tanker bound for Texas whose network had been compromised by a foreign actor. They stayed four days. A second tanker was boarded in the same weeks. On 28 May the IMO had issued the fourth revision of its guidelines on maritime cyber risk management. On 19 October the US Coast Guard published NVIC 02-26, which explains how to meet its cybersecurity rule before the 16 July 2027 deadline.

None of this targets a yacht in particular. All of it concerns one. A superyacht today is an integrated bridge, a propulsion plant run by controllers, a guest network, a crew network, one or two satellite links, and a captain’s mailbox through which payment orders travel. The question is not whether it will be attacked. It is what the rules ask of it, and who comes to check.

The foundation: cyber risk inside the SMS

The base rule fits in one resolution. By resolution MSC.428(98) of June 2017, the IMO affirmed that an approved safety management system should take cyber risk into account in accordance with the ISM Code, and asked administrations to ensure this no later than the first annual verification of the Document of Compliance after 1 January 2021. Since that date, cyber risk has been an audit item like any other.

The scope is therefore that of ISM itself. A commercial yacht of 500 GT or more on international voyages is bound by SOLAS chapter IX: its company holds a DOC, the ship an SMC, and the flag or recognised organisation auditor checks that the SMS addresses cyber risk. Below 500 GT, the Red Ensign Group flags and their counterparts require a scaled-down management system and expect it to cover the subject in proportion to the systems on board. The ISM & ISPS guide for superyachts sets out those thresholds.

The resolution does not say how. That is the role of the MSC-FAL.1/Circ.3 guidelines, revised for the fourth time by the Facilitation Committee in March 2026 and the Maritime Safety Committee in May, and dated 28 May 2026. They remain recommendations, but they are the ones administrations and auditors have in front of them. Six functional elements, to be run concurrently:

Govern: designate a person or entity accountable for planning, resourcing and executing cybersecurity, with the authority and expertise to do it;
Identify: keep an inventory of the digital systems on board and their connections, and assess the risk on those whose sudden failure creates a hazardous situation;
Protect: unique credentials, default passwords changed, multi-factor authentication, OT networks segmented from IT networks, removable media controlled, backups, updates, a supply chain policy;
Detect: monitor systems against a maintained list of threats;
Respond: report incidents within the time frames set by the administration, and keep records;
Recover: a recovery plan for critical systems, root cause analysis.

Two points in this version deserve a captain’s attention. Training: annual basic training for all personnel, OT-specific training for OT users, and cyber familiarisation of every seafarer on joining, tested from time to time by drills. And the explicit listing of “passenger, crew and subcontracted service personnel facing public networks” among vulnerable systems: the guest wifi is in scope, just like the ECDIS.

Newbuilds: class requirements E26 and E27

For new construction, the International Association of Classification Societies has turned these principles into rules. Unified Requirements UR E26, cyber resilience of ships, and UR E27, cyber resilience of on-board systems and equipment, apply to ships contracted for construction on or after 1 July 2024. They require, from the design stage, segmentation into zones, a systems inventory, controlled remote access, a local or manual mode of operation, a response plan and a recovery plan, all verified by tests before delivery and at class surveys.

Their mandatory scope is that of SOLAS: passenger ships on international voyages, cargo ships, high-speed craft and drilling units of 500 GT and above. “Passenger yachts (passengers not more than 12)” and “pleasure yachts not engaged in trade” appear in the list of vessels for which the UR may be used as non-mandatory guidance. In plain terms, a new yacht is subject to it only if its classification society has written it into its own yacht rules, if the flag asks for it, or if the owner orders a cyber notation. In practice, yards delivering above 500 GT see E27-certified equipment arrive through their suppliers, and several societies offer a notation aligned with E26, mandatory for new merchant ships and optional for yachts. An owner signing a build contract in 2026 is better off raising the question in the specification before the integrator raises it for them.

The United States: a rule for its own vessels, a check for the others

The US Coast Guard rule published on 17 January 2025, codified at 33 CFR Part 101, Subpart F, took effect on 16 July 2025. It covers US-flagged vessels subject to the Maritime Transportation Security Act, port facilities and Outer Continental Shelf installations. Its timeline: training for all personnel with access to IT or OT systems by 12 January 2026, then designation of a Cybersecurity Officer, a cybersecurity assessment and a plan submitted for approval by 16 July 2027, drills twice a year, penetration testing required from the first renewal. NVIC 02-26 of 19 October 2026 adds no obligation; it details what inspectors expect under each heading of the plan, and recalls that outsourcing IT does not transfer regulatory responsibility.

Few yachts fly the US flag under MTSA. A Cayman, Maltese or Marshall Islands yacht meets this rule another way: through port State control. Since 2021 the Coast Guard checks during its inspections that the SMS addresses cyber risk, and the Captain of the Port keeps the power to detain, restrict or turn away a vessel whose risk management is found inadequate. The boardings of summer 2026 showed what that power becomes when a ship’s network is actually compromised: a cyber team on board for four days, investigators worried first about the links between the office network and the propulsion and navigation controls. For a yacht on a Caribbean or Florida season, an SMS silent on cyber risk is a deficiency waiting to be written.

Europe: NIS2 targets the company, not the ship

The European NIS2 directive lists water transport among highly critical sectors, but it addresses entities, not ships: passenger or freight carriers, port managing bodies, vessel traffic services, from medium size upwards, meaning fifty employees or ten million euros of turnover. A yacht management company, a family office or a single-ship owning company rarely fall within it. France, moreover, has still not transposed the directive: the Commission referred it to the Court of Justice on 8 July 2026, and the critical infrastructure resilience bill is still waiting for its reading in the National Assembly.

The effect on a yacht is indirect but real. Connectivity providers, ports, yards and IT contractors that fall under NIS2 pass their obligations down through their contracts, and an owner will see security, audit and incident notification clauses appear where there used to be a subscription.

Flags, class and insurers: what a yacht actually sees

For a commercial yacht under the UK or Red Ensign Group flags, the practical reference is the Department for Transport’s Code of Practice: Cyber Security for Ships, in its July 2023 edition, which turns the IMO guidelines into an assessment method and a set of measures. The other major yacht flags have not published a text of their own: they apply MSC.428(98) in their ISM audits and expect the SMS to answer the IMO guidelines and, for classed vessels, the society’s rules.

The insurer reads the policy. Most hull and machinery policies carry an exclusion of losses caused by a cyber attack, and dedicated cyber covers require documented basic measures before they respond. A navigation or propulsion casualty traced back to a poorly segmented network can end up between two policies.

What a yacht does now

The IMO’s six elements translate into a short list that the DPA can keep with the captain and the ETO:

A named person. Someone, ashore or on board, designated in writing in the SMS for cybersecurity, with the means to match.
An inventory. The systems on board, their connections, suppliers’ remote access, satellite links, and whatever links the guest network to the rest.
A risk assessment of the systems whose failure creates a hazard: bridge, propulsion, alarms, stabilisers, fire detection.
Network separation. Guests, crew, administration and OT on distinct segments; bridge and communications in their own zone.
Clean access. Individual accounts, default passwords replaced, two-factor authentication on email and remote access, accounts disabled on sign-off.
Removable media and updates under control, backups tested.
Training and familiarisation. One session a year for everyone, cyber familiarisation on every joining, one drill a year, all recorded.
An incident plan. Who isolates what, who calls the flag and the DPA, how the ship is navigated in degraded mode, and an incident log.

Nothing on this list goes beyond the shipboard procedures a well-kept SMS already contains. The difference, in 2026, is that the auditor, the port inspector and the insurer ask for it with the same precision as a muster list. An ISM & ISPS audit before the season checks it before they do.

Cybersecurity on board yachts: what the rules require in 2026

The foundation: cyber risk inside the SMS

Newbuilds: class requirements E26 and E27

The United States: a rule for its own vessels, a check for the others

Europe: NIS2 targets the company, not the ship

Flags, class and insurers: what a yacht actually sees

What a yacht does now

Sources

Frequently asked questions

A question about this topic?

Talk to a Master Mariner