ShipORB maps every technical requirement from MARPOL Annex I, MEPC.312(74), and IACS UR E26/E27 to specific features in the platform.
ShipORB addresses every regulatory framework that governs electronic Oil Record Books.
Regulation 17 - Oil Record Book
The foundational international convention requiring every ship of 400 GT and above to maintain an Oil Record Book documenting all machinery space and cargo/ballast operations involving oil.
Guidelines for Electronic Record Books
The IMO resolution establishing specific requirements for electronic ORBs: tamper-evident records, digital signatures, access control, data backup, and the ability to produce printed copies matching the prescribed format.
Maritime Cybersecurity
Unified Requirements from the International Association of Classification Societies mandating cybersecurity measures for onboard systems, including network security, access control, and intrusion detection.
How each MEPC.312(74) requirement maps to ShipORB's implementation.
| Requirement | Description | ShipORB Implementation | Status |
|---|---|---|---|
| MEPC.312(74) - Record Integrity | |||
| §3.1 | Tamper-evident recording | SHA-256 hash chain + append-only SQL triggers | ✓ Full |
| §3.2 | Digital signature per entry | ECDSA P-256 per-officer signatures | ✓ Full |
| §3.3 | Prevent unauthorised modification | Immutable append-only log, RBAC enforcement | ✓ Full |
| §3.4 | Record amendments with audit trail | Amendment entries linked to original via hash reference | ✓ Full |
| MEPC.312(74) - Access Control & Authentication | |||
| §4.1 | Unique user identification | Per-officer credentials with TOTP 2FA | ✓ Full |
| §4.2 | Role-based access | Officer → C/E review → Master verification workflow | ✓ Full |
| §4.3 | Master's page-by-page signing | Dual-auth Master verification per page | ✓ Full |
| MEPC.312(74) - Data Management | |||
| §5.1 | Data backup and recovery | Automated backup to NAS + USB export scripts | ✓ Full |
| §5.2 | Minimum 3-year data retention | SQLite + PostgreSQL with configurable retention | ✓ Full |
| §5.3 | Produce printed copy in prescribed format | IMO-format PDF export on-vessel and shore-side | ✓ Full |
| MEPC.312(74) - System Requirements | |||
| §6.1 | Operate in shipboard conditions | Offline-first, runs on ruggedised shipboard hardware | ✓ Full |
| §6.2 | Flag state approval mechanism | Type approval planned under DNV-CG-0339; no certificate held | Planned |
| IACS UR E26/E27 - Cybersecurity | |||
| E26 §4 | Network segmentation & monitoring | Wazuh SIEM + dedicated VLAN configuration | ✓ Full |
| E27 §5 | Secure communications | Netbird WireGuard VPN + TLS 1.3 everywhere | ✓ Full |
| E27 §6 | Vulnerability management | Automated scanning, patching, log rotation | ✓ Full |
Detailed technical mapping from regulation to code.
Every ORB entry contains a SHA-256 hash of the previous entry, creating an unbreakable chain. If any entry is modified, all subsequent hashes become invalid, immediately revealing tampering.
Each officer has a unique ECDSA P-256 key pair. When signing an entry, the officer's private key signs the entry hash, producing a cryptographic proof that this specific officer approved this specific record.
The system enforces a three-stage workflow: the responsible officer creates and signs the entry, the Chief Engineer or Chief Mate reviews and countersigns, and the Master provides final verification with dual authentication.
All functionality operates without internet connectivity. SQLite provides on-vessel storage, and NATS JetStream handles reliable ship-to-shore synchronisation when connectivity returns.
PDFs generated in the exact IMO-prescribed Oil Record Book format, including operation codes, item numbers, tank details, and signature blocks. Available from both vessel and shore.
Automated daily backups to NAS with hash verification on restore. Shore-side PostgreSQL provides long-term retention. Minimum 3-year archival with configurable policies.
Full compliance with IACS Unified Requirements E26 (system resilience) and E27 (onboard communication security) through defence-in-depth architecture.
The route to a certificate under DNV-CG-0339, and what is finished before it starts. Phase timings are relative to submission, which has not been made.
Every requirement in the resolution traced to a platform feature and recorded as a checklist against DNV-CG-0339.
The SHA-256 hash chain and the ECDSA P-256 signatures run inside the FIPS 140-3 validated Go Cryptographic Module v1.0.0, CMVP certificate #5247.
Software development plan and software requirements specification submitted under DNV-CG-0339, opening a programme of roughly twelve months.
Software design description, security architecture, source code and test results reviewed by the society.
Three months of trial operation on two vessels, following factory acceptance testing.
Issue of the type approval certificate, which is the precondition for flag state acceptance rather than the acceptance itself.
Acceptance sought from the flag Administrations of the vessels in scope, each of which decides for itself under MEPC.312(74).
ShipORB is designed against the type approval requirements these societies publish. It holds no type approval certificate today, and none is described here as issued or in progress.
Type approval planned
Type approval planned
Type approval planned
Type approval planned
Our maritime compliance team can walk you through the full regulatory mapping for your flag state.