MTSA Cybersecurity

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-07-16 in 249 days Deadline for the first Cybersecurity Assessment and for submitting Cybersecurity Plans to the Coast Guard for review and approval
2. 2026-01-12 All personnel and key personnel must have completed the required cybersecurity training (then annually)
3. 2025-07-16 The final rule takes effect
4. 2025-01-17 Final rule published in the Federal Register (90 FR 6298)

1. 2025-07-16
   33 CFR part 101, subpart F (final rule of 17 January 2025) Major versionCurrent

   The final rule took effect, adding minimum cybersecurity requirements to the maritime security regulations. source

   More

   • Owners and operators must designate a Cybersecurity Officer and keep a Cybersecurity Plan.
   • It sets account, device, data and network security measures, drills and exercises, and reporting of reportable cyber incidents to the National Response Center.
   • The Coast Guard also sought comments on a possible delay of the implementation periods for U.S.-flagged vessels.
2. 2024-02-22
   Proposed rule (22 February 2024) Draft

   The Coast Guard proposed minimum cybersecurity requirements for U.S.-flagged vessels, OCS facilities and MTSA-regulated facilities; the comment period was later extended to 22 May 2024. source

The owners and operators of U.S.-flagged vessels, facilities and OCS facilities that already keep MTSA security plans.

Covered

Owners and operators of U.S.-flagged vessels, facilities and OCS facilities required to have a security plan under 33 CFR parts 104, 105 and 106 (section 101.605(a)). source

Not covered

Foreign-flagged vessels subject to 33 CFR part 104 (section 101.605(b)). source

State law

For facilities under 33 CFR part 105, the subpart preempts a conflicting State or local law or regulation (section 101.610). source

Cybersecurity Officer

Each owner or operator designates a Cybersecurity Officer, who may serve several vessels or facilities and must ensure known exploited vulnerabilities in critical IT and OT systems are identified and mitigated without delay. source

The Coast Guard reviews and approves each Cybersecurity Plan; the assessment and the plan audit are repeated every year, and a penetration test comes with each plan renewal.

Plan approval

Cybersecurity Plans are submitted for review and approval no later than 16 July 2027 (section 101.655); an approved plan is valid for 5 years. source

Annual assessment

A Cybersecurity Assessment must be conducted no later than 16 July 2027 and annually thereafter, and sooner after a change in ownership. source

Annual audit

The Cybersecurity Officer must ensure the plan and its implementation are audited annually, beginning no later than 1 year after the plan is first approved. source

Penetration test

In conjunction with plan renewal, a penetration test must be completed and its results included in the security assessment; plan and test results are available to the Coast Guard on request. source

Waivers

After completing the Cybersecurity Assessment, an owner or operator may seek a waiver or an equivalence determination (section 101.665). source

Enforced by the Coast Guard under the MTSA penalty provisions, with a statutory civil penalty per violation that is adjusted for inflation.

Incident reporting

Reportable cyber incidents must be reported to the National Response Center by entities that have not reported them under 33 CFR 6.16-1. source

1. Law text 33 CFR part 101, subpart F — Cybersecurity (eCFR)
2. Law text Cybersecurity in the Marine Transportation System — final rule (90 FR 6298)
3. Law text Cybersecurity in the Marine Transportation System — proposed rule (2024)

1. TSA SD 1580/82

   TSA's security directive for railroads, a renewable order with a TSA-approved implementation plan, rather than a codified Coast Guard rule.

2. NIST CSF

   A voluntary framework of cybersecurity outcomes; the Coast Guard rule sets binding minimum measures and deadlines.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to MTSA Cybersecurity (RSS)