Ship Cyber Resilience Test Records: ClassNK 2026
The Test Is Complete. Where Is the Evidence?
Recording Onboard Cyber Resilience Test Results Under IACS UR E26
Who Is This Article For?
This article is intended primarily for Marine Commissioning Engineers, Systems Integration Engineers and technical specialists responsible for onboard cyber resilience testing.
It may also be relevant to shipyard technical teams, project engineers and managers coordinating the relevant testing documentation.
What will you learn?
What ClassNK clarified in 2026 about recording onboard cyber resilience test results, which information must be documented, and how those records can be organised without introducing an unnecessary reporting format.
1. What Was Clarified in 2026?
During August and September 2026, classification society ClassNK published several clarifications concerning onboard cyber resilience tests under IACS UR E26.
The relevant explanations appear in questions 139–143 of the ClassNK IACS UR E26/E27 Q&A.
They address five practical issues:
Recording test results
Onboard demonstration tests at the commissioning stage require results to be recorded during testing. The relevant demonstration is witnessed by a surveyor.
Documenting individual test items
For each test item, the record must include at least the Pass/Fail result and any findings identified during testing.
Submitting test results
The records are submitted to the local ClassNK office that witnessed the tests.
Recording format
ClassNK does not prescribe a specific form or require one particular recording method.
Tracking test status
The test procedure must provide a means to track the progress or handling status of individual test items.
These clarifications relate to the applicable ClassNK requirements for ship cyber resilience testing, rather than to all onboard commissioning activities.
2. What Must Be Recorded?
ClassNK’s answer to question 140 identifies the minimum information required for each test item:
Test result: Pass or Fail.
Findings: Observations or discrepancies identified during testing.
The result must correspond to the applicable test procedure.
That procedure must specify:
- Initial test conditions.
- Test methodology and steps.
- Expected results.
- Acceptance criteria.
Where evidence is maintained separately, it must be clearly associated with the corresponding test item.
Supporting evidence may include records of command execution or photographs of physical checks, depending on the approved procedure and the test being performed.
3. Is a Special Reporting Form Required?
No single recording format is prescribed by ClassNK.
Question 142 explains that results may be recorded electronically or on paper.
The essential requirement is that the approved Ship cyber resilience test procedure provides fields for recording results or clearly cross-references a separate record.
This distinction is important.
The requirements concern the information and its traceability, not the introduction of an additional reporting system.
4. A Practical Record Structure
The following example illustrates how a test result could be organised.
It is not an official ClassNK form and does not replace the project’s approved test procedure.
| Field | Information to record |
|---|---|
| Test ID | Unique reference to the test item |
| System | System being tested |
| Procedure Reference | Relevant approved procedure and test step |
| Expected Result | Result defined by the acceptance criteria |
| Actual Result | Observed outcome |
| Pass / Fail | Recorded test result |
| Findings | Observations or discrepancies |
| Evidence Reference | Link to supporting material, where applicable |
| Test Status | Current status of the test item |
The example includes additional fields to make the information easier to follow.
It should not be interpreted as a list of mandatory ClassNK form fields.
Illustrative Example
Consider a test item within an approved procedure intended to verify restrictions on communication between onboard computer-based systems.
The approved procedure defines the initial conditions, test steps and expected result.
A corresponding record might contain:
Test ID: CYB-014
System: Vessel Control Network
Procedure Reference: Approved procedure, test item CYB-014
Expected Result: Unauthorised communication is blocked under the specified test conditions.
Actual Result: To be recorded during the test.
Pass / Fail: To be determined from the observed result and acceptance criteria.
Findings: To be completed during testing.
Evidence Reference: To be added where supporting records are maintained separately.
Test Status: Not yet performed.
This example intentionally contains no fictional completed test result.
Its purpose is to demonstrate how an individual test item can be linked to the applicable procedure and how its outcome can subsequently be documented.
5. How Should Test Status Be Managed?
ClassNK question 143 clarifies the meaning of a mechanism for updating test status.
The status should allow the relevant parties to follow the progress or handling of individual test items.
Examples include:
- Not yet performed.
- In progress.
- Completed.
- Omitted.
- Non-conforming.
ClassNK notes that a field next to the result column, including a suitable remarks field, may be used for this purpose.
The important point is that the status can be entered and updated during the testing period.
6. What Happens to the Records?
According to ClassNK question 141, onboard test results are submitted to the local ClassNK office witnessing the relevant tests.
After vessel delivery, the shipowner must retain onboard copies of the test results and the updated Ship cyber resilience test procedure.
These documents must remain available to ClassNK.
7. Practical Conclusion
The 2026 ClassNK clarifications provide useful guidance for engineers responsible for onboard cyber resilience testing.
They identify what must be recorded, how results relate to the approved procedure, how test status should be tracked and where the resulting documentation must be submitted.
A project does not necessarily need an additional reporting platform to meet these documentation requirements.
A clearly structured recording method, incorporated into or referenced by the approved test procedure, can provide the required traceability.
The practical objective is straightforward: every recorded result should be identifiable, linked to its test item and supported by the relevant testing documentation.
At SlavaWorks, we focus on practical engineering knowledge and demonstrable technical responsibility in the maritime industry.
SlavaWorks — Connecting Maritime Expertise with Real Industry Needs.
Technical References
Primary source: ClassNK — IACS UR E26/E27 Q&A.
Relevant questions: 139, 140, 141, 142 and 143.
Clarification dates: 17 August–14 September 2026.
Source page: https://www.classnk.com/hp/en/activities/cybersecurity/ur-e26e27/faq.html
Source reviewed: 4 November 2026.
Applicable references: ClassNK Rules, Part X, including the provisions cited in the relevant Q&A.
Important: This article summarises published ClassNK clarifications and includes an illustrative documentation structure. It does not replace the applicable rules, approved testing procedures or project-specific requirements.
