The U.S. Coast Guard’s New Cybersecurity Rule for the Marine Transportation System: Strengthening Maritime Security

Modern threats have necessitated the adaptation of security measures to include those against cyber-attacks, as physical security is no longer a stand-alone option for critical infrastructure. Recognizing the urgent need to bolster cybersecurity measures in the Marine Transportation System (MTS), the U.S. Coast Guard (USCG) has issued a final rule mandating that Maritime Transportation Security Act (MTSA)-regulated facilities incorporate cybersecurity protections into their Facility Security Plans (FSPs). The Coast Guard’s new rule establishes a much-needed framework to mitigate potential disruptions and reinforce the resilience of maritime operations. So, what does this mean for your organization?

Key Provisions of the New Cybersecurity Rule

Under the final rule, facilities subject to MTSA regulations must implement comprehensive cybersecurity measures within their FSPs. The rule includes the following key requirements:

1. Cybersecurity Officer (CySO) Designation and Cybersecurity Plan (CSP) Submission

Each MTSA-regulated facility will be required to appoint a CySO designated in writing, who must meet the necessary qualification standards of education, training, and experience. The CySO should have understanding of various cybersecurity issues, as well as knowledge of facility operations. Additionally, these facilities will be required to complete a CSP that includes details on risk management, account, device, and data security. These plans will be required to be renewed every five years. The CySO will be the point of contact for the facility and can recognize and take required actions as indicated in the CSP and CIRP.

2. Integration of Cybersecurity into Facility Security Plans (FSPs)

Previously, FSPs primarily addressed physical security concerns such as perimeter controls, personnel screening, and access management. Under the new regulation, cybersecurity must be seamlessly integrated into these plans to account for cyber-related vulnerabilities in operational technology (OT) and information technology (IT) systems.

3. Cyber Risk Assessments and Mitigation Strategies

Facilities must conduct regular cyber risk assessments to identify potential threats and vulnerabilities. These assessments should evaluate risks associated with network security, access control systems, industrial control systems (ICS), automated cargo handling, and communication networks. Based on these assessments, facilities are required to develop risk mitigation strategies that align with industry best practices and federal cybersecurity guidelines.

4. Implementation of Protective Cybersecurity Measures

Facilities must deploy safeguards to prevent, detect, and respond to cyber incidents. These measures include:

• Network segmentation to prevent unauthorized access to critical systems
• Intrusion detection and monitoring for anomalous activities
• Access controls and authentication protocols to protect sensitive systems
• Regular software updates and patch management to close security gaps
• Encryption and secure communications for data transmission

5. Cybersecurity Incident Response and Recovery Plans (CIRP)

Just as physical security incidents require clear response protocols, cybersecurity incidents must also have structured response and recovery plans. MTSA-regulated facilities must establish and maintain incident response procedures to minimize operational disruptions in the event of a cyberattack. These plans should outline:

• Detection and reporting mechanisms for cyber incidents
• Roles and responsibilities of personnel in response efforts
• Containment and mitigation strategies to prevent escalation
• Recovery and restoration processes for affected systems
• Post-incident analysis and reporting for continuous improvement

6. Alignment with Coast Guard and Federal Cybersecurity Standards

The rule aligns with cybersecurity best practices recommended by the Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), and the National Institute of Standards and Technology (NIST). MTSA-regulated facilities are expected to adhere to these guidelines while continuously assessing and updating their cybersecurity protocols to adapt to emerging threats.

7. Drills and Exercise

Drills are required to be conducted at least twice each calendar year and annual exercises are required no more than 18 months apart. These may be full-scale or live, tabletop simulations or combined with other exercises. All facilities are required to test communication and notification procedures as well. Records must be kept regarding training, drills, exercises, cybersecurity threats, reportable cyber incidents, and audits of the CSP.

Why This Rule Matters: Growing Cybersecurity Threats to Maritime Operations

The maritime industry is a vital component of the global economy, with U.S. ports handling approximately $5.4 trillion in economic activity annually. However, as ports, shipping companies, and logistics providers become increasingly reliant on digital infrastructure, they face rising cyber risks that could result in:

• Disruptions to cargo movement and supply chains
• Tampering with vessel navigation and tracking systems
• Data breaches exposing sensitive shipping information
• Manipulation of industrial control systems affecting port operations
• Financial losses and reputational damage

Cyberattacks targeting maritime entities, such as the 2017 NotPetya attack on Maersk, have demonstrated the devastating financial and operational consequences of inadequate cybersecurity defenses. By requiring structured cybersecurity policies and risk management strategies, the Coast Guard’s new rule aims to enhance national security and maritime resilience against evolving digital threats.

The Implementation timeline for the new rule is as follows:

16 July 2025- rule becomes effective

12 January 2026- all training must be completed

16 July 2027- CySO designation in writing, Cyber Assessment, and CSP submission must be completed

After the CSP is approved by USCG, drills and exercises will commence.

Final Thoughts

The USCG final rule on cybersecurity marks a pivotal moment for the maritime sector’s digital security evolution. As cyber threats continue to grow, integrating comprehensive cybersecurity measures into FSPs ensures that MTSA-regulated facilities are well-prepared to prevent, detect, and mitigate cyber incidents that could impact maritime operations and national security. Compliance with this rule is not merely a regulatory obligation—it is a strategic imperative for safeguarding supply chains, protecting critical infrastructure, and ensuring the resilience of the Marine Transportation System.

As maritime facilities work toward meeting these cybersecurity requirements, partnering with cybersecurity specialists and industry experts can provide invaluable support in navigating compliance challenges and enhancing overall security posture.

Need Assistance with Cybersecurity Compliance?

At Allied IT Systems, we specialize in maritime cybersecurity solutions to help MTSA-regulated facilities meet Coast Guard requirements and protect their operations from cyber threats.

Contact us today for a complimentary consultation to learn how we can support your compliance efforts and strengthen your cybersecurity defenses.