Every vessel is a door.
Do you know who has a key?
Because ungoverned remote access does not care whether you run a fleet, a platform, or a port.
Two decades of uncovering ungoverned remote access in maritime and critical environments.
Maritime operations connect shore teams to vessel systems, offshore installations to control centres, port infrastructure to remote administrators. Every one of those connections crosses a boundary that most organisations have never formally governed. Not because they chose not to. Because nobody told them that the remote access application on the bridge had seventeen active credentials from contractors who finished their work two years ago.
CyberPlus has spent two decades finding that gap in maritime environments specifically. On vessels where crew rotations happen every four months and nobody revokes the outgoing engineer’s access. On offshore installations where third-party OEM connections persist long after the commissioning visit. In port operations where the audit trail for a P&I Club inspection does not exist in any retrievable form.
The difference between CyberPlus and a software licence is the governance layer that sits on top of it. We were appointed as TeamViewer’s first global MSP not because we resell the platform but because we built the architecture to govern it in environments where ungoverned access has physical consequences, not just compliance ones.
We authored the IASME Maritime Cyber Baseline. We understand what IMO 2021, IACS UR E26, and a flag state auditor actually look for. And we have been in the engine rooms, the bridge consoles, and the shore control centres where remote access was the vulnerability nobody had closed.
What follows is how we close it.
Four controls. Here is how we govern it.
Mandatory for all vessels contracted from 1 July 2024. UR E26 requires documented cyber resilience across five functions: identification, protection, detection, response, and recovery. It mandates network segmentation between IT and OT and a Cyber Resilience Test Procedure covering the entire operational life of the vessel. DNV, Bureau Veritas, ABS, and Lloyd's Register have all aligned their class notations to it. Non-compliance is not a fine. It is loss of class.
Where E26 governs the vessel, E27 governs every individual computer-based system on board. Navigation, propulsion, ballast, SCADA, dynamic positioning, fire detection. Third-party suppliers must prove their systems are cyber resilient before installation. As of late 2024, fewer than 25 systems globally held E27 type approval. That scarcity is the reason why equipment going near your OT network must be verified, not assumed.
Not every firewall is built for a vessel engine room or offshore control cabinet. CyberPlus deploys the Fortinet FortiGate Rugged series, purpose-built for OT environments and rated for the temperature, vibration, humidity, and electromagnetic conditions of maritime operation. The FortiGate Rugged 70F delivers deep packet inspection of ICS, OT, and SCADA protocols and enforces zero-trust segmentation between security zones. It prevents lateral movement between a compromised IT segment and critical vessel systems. Built for where you actually operate.
200+ entries. Every regulation, every classification society requirement, every acronym a maritime operator will encounter. IMO 2021, IACS UR E26/E27, ISM Code, ISPS, MLC, NIS2, ISO 27001, P&I Club requirements, flag state obligations. Written by the team that authored the IASME Maritime Cyber Baseline. Free. No form. No gate.
"We didn't find a breach. We found seventeen doors that had never been closed."CyberPlus maritime estate audit · 2025
A typical North Sea installation manager could not account for three active credentials following a contractor rotation. No incident. No audit trail. CyberPlus audited the estate, revoked seventeen stale credentials, and implemented lifecycle governance across the entire remote access perimeter.
Zero unattributed credentials. Full audit trail operational within 48 hours. No downtime.A typical terminal operator faced a P&I Club audit requiring 90 days of remote access logs across six operational systems. The logs did not exist. CyberPlus implemented session audit infrastructure and credential governance before the follow-up audit window closed.
Audit passed. 90-day access log now generated automatically. No manual assembly required.A typical ship manager operating across multiple flag states could not demonstrate that shore-based access to vessel systems was restricted to named, authorised individuals. No attributable access logs existed beyond the TeamViewer install itself. CyberPlus took over governance, implemented credential lifecycle management, and delivered full audit trail coverage within one operational cycle.
ISM Code compliance demonstrated at next audit. Shore-to-vessel access fully attributed across all flag states.