Practical guide for shipowners and technical superintendents on shipboard IT/OT network segmentation (IACS UR E26/E27), satellite connectivity and PMS data flows.
← All technical guides · Category: Marine IT Support · Updated: · 8 min read
| Shipboard Network Zone | Connected Systems & Workstations | Allowed Outbound / Inbound Traffic | Typical Physical & Logical Controls |
|---|---|---|---|
| Zone 1 · Safety-Critical OT (Navigation, Propulsion, Cargo & Gas) | ECDIS, radar, VDR, main and auxiliary engine control and safety systems, GVU/FGSS controllers, cargo loading and ballast control | Air-gapped or strictly unidirectional hardware data diode / boundary firewall with zero direct internet or crew Wi-Fi routing | Physical mechanical USB & RJ45 port blockers, dedicated malware-scanning kiosk for ENC updates, role-based logins, and signed IT/OT work permits for visiting technicians |
| Zone 2 · Ship Operations & Maintenance IT | Master, Chief Engineer & Ship's Office workstations, Planned Maintenance System (PMS), electronic logbooks, and SeaReady inspection workspace | Encrypted HTTPS (TLS 1.3) sync to authorised company shore servers and approved cloud endpoints via managed firewall rules | Endpoint protection, automatic offline store-and-forward sync, daily encrypted local backups to NAS/fireproof safe, and no shared default passwords |
| Zone 3 · Shore Remote Diagnostics & Telemetry DMZ | Controlled telemetry gateway for engine performance trends, voyage reporting, and scheduled vendor remote support | Outbound-initiated VPN / TLS session enabled only by physical key-switch or Master/Chief Engineer authorisation | Full session logging, multi-factor authentication, time-bounded access windows, and immediate disconnect switch in ECR/Bridge |
| Zone 4 · Crew Welfare & Guest Wi-Fi | Crew personal smartphones, tablets, laptops, and cabin access points | Isolated VLAN routed directly to satellite/cellular WAN with bandwidth shaping and DNS content filtering; zero access to Zones 1, 2 or 3 | Separate physical switches or VLAN tags, client isolation enabled, and automatic captive-portal quota management |
As fleets adopt low Earth orbit (LEO) satellite services alongside traditional VSAT and 4G/5G coastal links, shipboard IT has grown far more complex, yet onboard teams still face a familiar problem: when a poorly configured firewall, DNS rule or Windows update blocks the ship’s office PC during a port turnaround, cargo documents, requisitions and inspection reports stall.
Marvel Solutionz approaches Marine IT support from an operational marine perspective. We start by identifying which onboard or shore-side workflow is being held up, verify the network boundary between business IT and machinery/navigation OT, and agree a clear, testable scope with your technical team.
A vessel’s Planned Maintenance System (PMS) is the official record of equipment running hours, work orders and maintenance history; where class has approved it under IACS UR Z20, it also supports machinery surveys under continuous survey (CSM). SeaReady complements the PMS by organising inspection preparation (SIRE 2.0, RightShip, CDI, OVID, PSC, USCG, class and flag State), photo evidence, AI mock-inspector practice and findings close-out.
Where a fleet operator wants to connect SeaReady or shore reporting dashboards with an existing PMS—for example, importing certificate expiry dates, running hours, or open defect lists—Marvel Solutionz scopes and delivers that connection as a dedicated Marine IT project matched to your system's supported interfaces and data permissions.
No. Your PMS manages equipment maintenance schedules, running hours, spare-part stock and class CSM service history. SeaReady supports inspection and certification preparation, photo evidence, AI mock-inspector practice and findings follow-up. A project-specific integration between your PMS and SeaReady can be scoped separately through Marvel Solutionz Marine IT support.
Questions vary by regime and inspector. Common topics are how removable media (USB) is controlled and scanned on navigation, cargo and engine control computers, whether default passwords have been changed, and whether the safety management system addresses cyber risk as IMO Resolution MSC.428(98) expects (for example through a cyber security plan and a network diagram).
Use our contact form (/contact/) to describe the onboard or shore-side system, connectivity issue or integration requirement, along with your vessel schedule and deadline. We confirm availability, scope, access requirements and commercial terms before work starts.
Try the LNG, Dual-Fuel & Spark-Gas simulator free for 5 minutes, then enrol in the Academy: Self-Paced $395 USD or 6-Week Cohort $995 USD (+ 5% sales tax). Or book a 1-hour consultancy for $350 USD (+ 5% sales tax).
Crew $39.99, Officer Pro $99.99 or Ship licence $899 per ship, USD a month (+ 5% sales tax). 14-day free trial, no card needed.
Enquiries welcome at any time. Book our daily 1-hour consultation at 12:00 PM Central Time (CT) ($350 USD + 5% sales tax) or send an enquiry about your vessel, power plant or project.
Have an Academy Access Key? Sign in on this page to send comments or questions straight to our instructors.
/guides/marine-it-ot-network-segmentation-and-pms-integration-guide/