CSP (Critical Service Provider)

A critical service provider is a third party whose products or services are material to the safe operation of a ship’s operational-technology systems, so that a compromise at the provider could propagate to the vessel. The concept is formalized in IACS UR E26 (cyber resilience of ships), which requires the shipowner and yard to identify CSPs in the supply chain and obtain evidence that their delivered systems meet the security requirements. It captures OEMs, integrators, remote-maintenance vendors, and software suppliers handling onboard computer-based systems.