On January 17, 2025, the U.S. Coast Guard published a new final rule establishing baseline cybersecurity requirements to protect the Marine Transportation System (MTS) from cyber threats. The regulation applies to U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities that are required to have a security plan under 33 CFR parts 104, 105, and 106. However, foreign-flagged vessels subject to 33 CFR part 104 are not covered under this rule.
Implementation Timeline and Key Requirements
The final rule takes effect on July 16, 2025, with several key implementation deadlines:
Starting July 16, 2025:
Entities not previously required to report cyber incidents under 33 CFR 6.16-1 must begin reporting all cyber incidents to the National Response Center (NRC).
By January 12, 2026:
- All personnel must complete cybersecurity training covering threat detection, reporting procedures, and operational technology (OT) security.
- Key personnel must receive additional training on cyber incident response and evolving cyber threats.
- New employees must complete cybersecurity training within 5 days of system access (but no later than 30 days after hiring) and renew it annually.
By July 16, 2027:
- Owners and operators must designate a Cybersecurity Officer (CySO) in writing.
- A Cybersecurity Assessment must be conducted within 24 months and then annually.
- A Cybersecurity Plan must be submitted to the U.S. Coast Guard for approval.
After Cybersecurity Plan Approval:
- Owners and operators must conduct at least two cybersecurity drills per year.
- A cybersecurity exercise must be conducted at least once per year, with no more than 18 months between exercises.
- All personnel must complete additional training within 60 days of plan approval.
Possible Delays in Implementation for U.S.-Flagged Vessels
The U.S. Coast Guard is seeking public comments on whether the implementation period for U.S.-flagged vessels should be extended by an additional 2 to 5 years. Some stakeholders have requested extensions ranging from 36 to 48 months, arguing that ships may need more time than facilities to comply. The deadline for public comments is March 18, 2025.
Where to Find the Regulatory Text
The full regulatory text can be accessed at www.regulations.gov by searching for USCG-2022-0802. Questions regarding the rule can be sent to MTSCyberRule@uscg.mil.
This new cybersecurity regulation marks a significant step toward strengthening cyber resilience in the maritime industry, ensuring that the U.S. marine transportation system remains secure against evolving cyber threats.
Loading...
Reload document 
Open in new tab 
The 
