The US Coast Guard (USCG) has issued guidance clarifying cybersecurity requirements for regulated vessels, port facilities and offshore installations, outlining how operators should assess cyber risks, develop security plans and demonstrate compliance ahead of the July 2027 deadline.
Issued on 19 October, the Navigation and Vessel Inspection Circular (NVIC) 02-26 provides implementation guidance for the cybersecurity regulations established under the Maritime Transportation Security Act (MTSA), covering US-flagged vessels, facilities and Outer Continental Shelf installations required to maintain security plans.
The regulations were published in January 2025 and entered into force on July 16, 2025. Covered entities must submit a Cybersecurity Plan (CSP) for Coast Guard evaluation and operate in accordance with applicable cybersecurity requirements and their submitted plans by July 16, 2027.
The USCG emphasizes that the circular does not introduce new regulatory obligations but clarifies existing requirements and the agency’s preferred approaches to compliance.
Cybersecurity plans must demonstrate effective risk management
A central element of the guidance is the requirement for operators to demonstrate that cybersecurity measures are implemented and effective, rather than simply documenting regulatory obligations.
According to the USCG, cybersecurity compliance follows a performance-based approach, allowing operators to select measures appropriate to their systems, operating environments and identified risks. However, cybersecurity plans must explain how each applicable requirement is being met, supported by documentation and evidence of implementation.
The guidance places particular emphasis on cybersecurity assessments covering both information technology (IT) and operational technology (OT), including systems supporting critical vessel and facility operations.
Assessments should consider external connections, remote access, cloud-based services and third-party dependencies that could expose maritime operations to cyber incidents or disruption. The circular also clarifies that owners and operators must designate a Cybersecurity Officer (CySO) responsible for developing, implementing and maintaining their cybersecurity plans.
Key requirements for maritime operators
Cybersecurity assessments: Identify and evaluate vulnerabilities affecting IT and OT systems, including external networks and dependencies that could disrupt maritime operations.
Cybersecurity plans: Document risk mitigation measures, assigned responsibilities, security controls and procedures for maintaining compliance.
Personnel training: Ensure personnel with access to IT or OT systems, including relevant contractors, receive appropriate cybersecurity training, with additional requirements for key personnel.
Access control and monitoring: Establish measures governing authorised system access, physical security, vulnerability management and the monitoring of cybersecurity threats.
Drills and exercises: Conduct cybersecurity drills twice per calendar year and exercises at least annually, with no more than 18 months between exercises.
Incident response: Maintain procedures for identifying, reporting, responding to and recovering from cybersecurity incidents affecting maritime operations.
Audits and testing: Conduct required assessments and audits, maintain supporting records and carry out penetration testing during the applicable cybersecurity plan renewal cycle.
The USCG clarifies that penetration testing is not required for the initial July 2027 CSP submission but must be undertaken as part of subsequent renewal requirements.
Shared port systems and third-party access require attention
The circular also addresses cybersecurity responsibilities where ports, terminals and other maritime businesses share infrastructure or rely on external service providers. The USCG recommends that port authorities and terminal operators jointly assess shared IT and OT systems to establish which organisation is responsible for securing each component.
Examples include shore power systems, cargo-handling equipment, access control systems and ship-to-shore network interfaces. The guidance stresses that outsourcing cybersecurity functions does not remove the owner’s or operator’s regulatory responsibility.
For vessels and facilities using contractors or external technicians, access to critical systems must also be managed in accordance with applicable training and supervision requirements.
The Coast Guard encourages operators to use established cybersecurity frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework, when developing and improving their programmes.
——————————————————-
Click Here For The Original Source.
