THE NEWS

According to The Maritime Executive, NexusWave — the fully managed, bonded connectivity service operated by Inmarsat Maritime, a Viasat company — has received Cyber Security Type Approval from ClassNK. The certification aligns the service with IACS (International Association of Classification Societies) cyber security standards, a framework that has been gaining regulatory weight across the global maritime sector.

The approval covers NexusWave as a managed service offering, meaning the certification applies to the connectivity product as delivered to vessel operators rather than to individual shipboard hardware components in isolation. ClassNK, one of the major classification societies operating globally, issued the type approval following an assessment of the service against the applicable IACS unified requirements.

Inmarsat Maritime positions NexusWave as a bonded multi-network connectivity solution for commercial and offshore vessels. The ClassNK certification represents formal third-party validation of the service's cyber security posture under an internationally recognized framework.

WHY IT MATTERS

The IACS unified requirements on cyber security — commonly referenced as UR E26 and UR E27 — came into force for newbuildings contracted from January 2024 onward. Their scope covers both shipboard systems and the network services those systems rely on. Type approval of a managed connectivity service, as opposed to standalone hardware, reflects how classification societies are adapting their frameworks to account for the fact that modern vessel cyber risk does not stop at the hull.

For offshore operators in Brazil, this certification carries practical weight even if it does not generate immediate contractual obligations. Petrobras, as the dominant operator in Brazilian waters, maintains its own supplier qualification and cybersecurity governance requirements for vessels operating under its contracts. As IACS-aligned standards progressively influence flag state expectations and P&I club underwriting conditions, service providers holding recognized type approvals gain a measurable compliance advantage during vessel vetting and contract negotiation.

The Brazilian offshore fleet — spanning FPSOs, MODUs, PSVs, and anchor handlers — relies heavily on satellite connectivity for operational technology (OT) systems, crew welfare, and vessel management platforms. Bonded connectivity services that aggregate multiple network links are increasingly standard on this class of asset, precisely because redundancy and uptime are operationally critical in deepwater pre-salt operations. The cyber security governance of those links is therefore not a peripheral concern; it sits at the intersection of operational continuity and regulatory compliance.

From a supply chain perspective, Brazilian vessel owners and operators sourcing connectivity services now have an additional criterion to evaluate: whether the service holds recognized type approval under IACS cyber requirements. This does not make uncertified services non-compliant per se — the IACS requirements apply at the newbuilding contract level and phase in over time — but it does shift the risk calculus for operators managing aging fleets undergoing mid-life upgrades or connectivity contract renewals.

The classification society dimension is also worth noting for the Brazilian context. ClassNK, DNV, Bureau Veritas, and Lloyd's Register all maintain active relationships with the Brazilian offshore sector. Certifications issued by any of them carry weight with ANTAQ (Agência Nacional de Transportes Aquaviários) and are referenced in the broader regulatory ecosystem that ANP-licensed operators navigate. A type approval from ClassNK is therefore not merely a commercial differentiator; it functions as a credential within a regulatory chain that Brazilian operators and their insurers recognize.

The broader structural read is that cyber security is completing a transition from a voluntary best-practice domain to a formally governed one within maritime classification. Connectivity services — historically evaluated on bandwidth, latency, and price — are now subject to the same type of third-party technical scrutiny applied to navigation or safety systems. Vendors that move early to align with IACS frameworks position themselves ahead of a compliance curve that will likely tighten as flag states and port state control regimes incorporate cyber requirements into their inspection protocols.

CONTEXT

IACS adopted its cyber security unified requirements following years of consultation with flag states, operators, and technology vendors. The framework distinguishes between computer-based systems on board (UR E26) and cyber resilience of those systems (UR E27), and places obligations on both shipbuilders and equipment manufacturers. Extending that logic to managed services — where the cyber perimeter includes cloud infrastructure and shore-side network operations centers — represents a natural evolution of the framework's scope.

Inmarsat Maritime has operated in the Brazilian offshore sector for an extended period, with its VSAT and L-band services present across a broad cross-section of the fleet. The Viasat acquisition, completed in 2023, expanded the combined entity's multi-orbit and multi-band capabilities. NexusWave's ClassNK certification adds a regulatory credential to a product line that was already technically positioned for the managed connectivity segment of the offshore market.