AI, Security Assessments, Security Plans, and Sensitive Security Information (SSI)

Our contacts with the U.S. Coast Guard have recently told us that they have been getting numerous questions about the use of AI to conduct Cybersecurity Assessments, or to write Cybersecurity Plans or Facility Security Plans. THE ANSWER IS NO!!!

As I’m sure most of you will recognize, using AI for these activities is not a wise choice.

Because AI systems rely on existing material, your AI model would need to start with a large body of existing security assessments or plans. Hopefully, if everyone has been following proper SSI procedures (see below), there are few if any existing such documents floating out there on the internet. And if there are, they would certainly not reflect your operations, business activity, physical layout, or computer systems and networks. Any AI generated assessment or plan would have no relationship with your security needs or operations and would provide no value to you. Also, it is a good bet that the Coast Guard can easily detect AI written documents.

Any existing plans or assessments you may have, along with the raw information needed to produce new assessments and plans is Sensitive Security Information. Deliberately feeding an AI model those materials would be a direct violation of SSI regulations found in 49 CFR 1520. TSA even specifically addresses this at: https://www.tsa.gov/for-industry/sensitive-security-information.

So, while AI is a powerful tool for many business activities, smart assessments and effective security plans require smart people – let Seebald & Associates and CyberSurv be part of your smart team and I promise you will like the results!

Cybersecurity Assessment – Make the Most of It!

We are now just over a year from the date when facility and vessel operators must have an approved Cybersecurity Plan (CSP) as required by the Coast Guard’s new Subchapter F Cybersecurity regulations. We at Seebald & Associates are in contact with the U.S. Coast Guard, officials, and they tell us that the service is hard at work on appropriate policy guidance to help us all meet those requirements on time.

While we wait on that guidance, we can review the existing regulations, including the requirement to perform a Cybersecurity Assessment (CSA) before submitting the first CSP. This process is similar to that of performing a Facility or Vessel Security Assessment to serve as the foundation for a Facility Security Plan or Vessel Security Plan.

A number of small companies are already grumbling that they have “zero cyber exposure” and should therefore be exempt from these requirements. There are certainly waterfront facilities where the only technology present is the FSO’s mobile phone. However, those same waterfront facilities are probably supported by a larger IT network that, if compromised, might disrupt critical business activities, such as scheduling vessels and workers, communicating critical information, or otherwise enabling seamless operations.

While Coast Guard regulations list many individual subtopics to consider in the Facility Security Assessment process, Cybersecurity Subchapter F lists only two subtopics which speak directly to CSA technical requirements. They are:

• Analyze all networks to identify vulnerabilities to critical IT and OT systems and the risk posed by each digital asset.
• Document and ensure patching or implementing of documented compensating controls for all KEVs in critical IT or OT systems, without delay.

This list is short, but powerful. And if done right, a good initial CSA can limit your overall regulatory exposure and improve your company’s cyber resilience.

Let’s start with limited regulatory exposure.

So to determine if your exposure is really as little as you think, do what the regulation says and analyze all networks to identify vulnerabilities to critical IT and OT systems. Many, perhaps most of your networks and systems will not be “critical”. In those cases, you simply must document that they are segregated from genuinely critical systems by appropriate technical and administrative means. What’s left is what your CSP will address, so congratulations, you have just limited your regulatory exposure.

In some cases, “what’s left” will be so limited that you will be a good candidate for an exemption from all Subchapter F requirements. But the key to that decision is a robust, detailed CSA with plenty of documentation. Take the time to do it well, and you will benefit.

Now let’s talk about how to use the CSA to improve your cyber resilience, regardless of Coast Guard requirements.

Again, I take you back to the requirement to analyze all networks. As we know, many of those networks will not be critical or could not cause or contribute to a Transportation Security Incident, even taking the broadest possible interpretation. That doesn’t mean they are not important to your business. Done properly, a CSA will likely find all manner of systems that have avoided the notice of busy IT and OT managers. Software that is no longer used or supported. User accounts for employees who left the company months ago. Wireless printers or other low-drama hardware that lacks the protection it should have. Connections between systems that don’t need to be connected, or that should at least be better monitored. Lurking spyware or levels of data transmission orders of magnitude beyond what normal business activity requires. If you look, you will find.

Most of these issues may not require immediate attention, but a well-done CSA gives you the chance to identify them and discuss risk management (and budget!) with company senior leadership. Once you’ve identified and discussed potential vulnerabilities, your CySO can “document and ensure patching or implementing of documented compensating controls”, as the CSA regulations require. The process will lead to changes that will improve your cybersecurity for both Coast Guard and non-Coast Guard regulated systems.

If you have any questions regarding your cyber regulatory exposure, please contact Rich Sundland at: richsundland@seebald.com

Seebald and Associates and The SRI Group LLC Establish Strategic Partnership to Bolster Port Security Against UAS Threats

Leading Firms Unite to Integrate Comprehensive Counter-Drone Solutions into Maritime Security Programs

Seebald and Associates, recognized as a premier consulting firm in port security and operations, is pleased to announce the establishment of a strategic partnership with The SRI Group LLC, a distinguished provider of detailed Counter Unmanned Aircraft Systems (C/UAS) threat assessments. This collaboration is designed to significantly enhance port security programs through the integration of SRI Group’s advanced counter-drone assessment capabilities.

The SRI Group LLC possesses substantial expertise in the field of C/UAS and has developed a highly thorough methodology for identifying, evaluating, and mitigating drone-related threats. Their assessment solutions address the increasingly complex risks associated with unmanned aerial systems, thereby ensuring that ports are equipped to prevent potential disruptions and security breaches. Through this partnership, Seebald and Associates will incorporate SRI Group’s rigorous assessment protocols into its established port security frameworks, providing clients with a comprehensive and robust approach to operational safety.

Richard T. Sundland, President of Seebald and Associates stated, “Our partnership with The SRI Group LLC marks a pivotal advancement in port security. By leveraging their specialized knowledge and innovative counter-drone technologies, we are positioned to deliver a security program that effectively addresses the most urgent threats facing port operations today.”

This partnership reaffirms the commitment of both organizations to fostering innovation, safety, and operational excellence within the maritime industry. Seebald and Associates and The SRI Group LLC will jointly offer unparalleled expertise and assurance to port operators throughout the nation.

FOR IMMEDIATE RELEASE

Seebald & Associates International and CyberSurv Form Strategic Alliance to Strengthen Maritime Cybersecurity

Dewittville, NY — March 23, 2026 — Seebald & Associates International, a maritime security consulting firm founded by retired U.S. Coast Guard Commander Edward P. Seebald, today announced an exclusive strategic alliance with cybersecurity advisory firm CyberSurv to help ports, maritime facilities, and vessel operators strengthen cybersecurity and prepare for expanding regulatory expectations across the U.S. Maritime Transportation System.

The partnership comes as cybersecurity oversight continues to expand under 33 CFR Part 101 Subpart F, extending maritime security requirements beyond traditional physical protections to include cyber risk governance, workforce awareness, incident readiness, and ongoing cyber oversight. Maritime organizations are increasingly expected to demonstrate structured cyber risk management as part of their operational security programs.

By combining Seebald’s expertise in maritime security planning, audits, and regulatory compliance with CyberSurv’s cybersecurity governance and risk management capabilities, the alliance provides maritime operators with an integrated approach to managing both physical and cyber risk.

“Maritime security today requires a coordinated strategy that addresses both physical and cyber threats,” said Edward P. Seebald, CDR, USCG (Ret.), Founder and CEO of Seebald & Associates International. “CyberSurv brings the cybersecurity expertise needed to help maritime operators strengthen resilience while maintaining safe and efficient operations.”

Maritime operations increasingly rely on interconnected IT systems, operational technology, logistics platforms, and third-party networks, creating new cyber exposure across ports, vessels, and supply chains.

“Cyber threats targeting maritime infrastructure continue to evolve,” said Ron Frechette, Founder of CyberSurv and a U.S. Coast Guard veteran. “Working alongside Ed and the Seebald team allows us to bring together physical and cyber risk expertise to help maritime organizations strengthen resilience and operational security.”

As part of the initiative, the firms will conduct Maritime Cyber Threat Readiness Assessments designed to quickly identify critical cybersecurity gaps across IT and operational technology environments and strengthen readiness for emerging regulatory oversight.

Organizations interested in learning more can contact Maritime@seebald.com or visit www.seebald.com and www.cybersurv.com.

About Seebald & Associates International

Seebald & Associates International provides maritime security consulting services including security audits, vessel and facility security plans, training, and risk management solutions supporting ports, vessels, and maritime facilities worldwide.

About CyberSurv

CyberSurv is a cybersecurity advisory firm led by seasoned security professionals with decades of experience across federal investigations, regulatory assessments, enterprise security leadership, consulting, and military service. The firm delivers AI-enhanced cybersecurity governance, compliance readiness, and continuous cyber hygiene solutions to help regulated organizations protect critical infrastructure and maintain operational resilience.

MARITIME CYBER THREAT READINESS

Rapid PLC Exposure Assessment for Maritime Infrastructure

Overview

Recent federal advisories highlight increased targeting of maritime and port infrastructure, including industrial control systems (ICS) and PLC environments supporting terminal operations, vessel systems, and logistics platforms.

Common risks include weak network segmentation, exposed remote access, credential vulnerabilities, and legacy system configurations. As maritime cybersecurity oversight continues to expand under 33 CFR Part 101 Subpart F, organizations must be able to quickly identify exposure and take action.

Rapid PLC Exposure Assessment

A targeted assessment designed to quickly identify and prioritize PLC and ICS risks.

• PLC & ICS Exposure Identification – Detect externally exposed and vulnerable
• Segmentation & Access Review – Evaluate IT/OT separation, remote access, and vendor
• Credential & Remote Access Risk Analysis – Identify authentication and access control
• External Attack Surface Review – Assess internet-facing assets and entry
• Executive Risk Briefing – Clear findings, prioritized actions, and next

Continuous Cyber Oversight

Organizations can extend this assessment through RiskGuard 365℠, CyberSurv’s AI-enhanced cybersecurity oversight program, providing; continuous visibility into PLC/ICS exposure, credential and identity risk monitoring, external attack surface tracking, and compliance & governance alignment.

Move from point-in-time assessments to continuous risk management.

Client Focus • Port Authorities • Terminal Operators • Facility Operators • Logistics Providers

• Offshore & Energy Maritime Operators

About CyberSurv

CyberSurv is a cybersecurity advisory and AI-enhanced security solutions firm helping organizations manage cyber risk with greater clarity and confidence. Our team brings decades of experience across cybersecurity, regulatory compliance, and critical infrastructure protection, including maritime environments.

We combine experienced advisory with intelligent automation to deliver modern, continuous, and cost-effective cybersecurity solutions that reduce risk, strengthen resilience, and support evolving regulatory requirements.

EMPOWER. INNOVATE. FORTIFY.

CONTACT US TODAY FOR A FREE CONSULTATION

info@cybersurv.com | (877) 940-4344 | www.cybersurv.com

MTS-ISAC Cybersecurity Advisory: 030226

Stakeholders Share Activity Possibly Tied to Iranian Reconnaissance against Maritime

Summary

On Monday, March 2, 2026, maritime transportation system (MTS) stakeholders shared reconnaissance threat activity potentially linked to Iranian-nexus threat clusters, including those associated with Charming Kitten (also known as Mint Sandstorm). The reported activity includes scanning and probing of externally exposed services, typosquatted domains, and phishing attempts.

We appreciate these shares. If your organization has seen activity related to this advisory or other suspicious activity, please contact the MTS-ISAC.

Identified Threat Activity Information

Indicators: Domains:

CIDRs: (Limited Network LTD) (Limited Network LTD)

IPs: (Limited Network LTD) (Limited Network LTD)

bytl[.]ink

services-activities[.]site bytli[.]ink lnked[.]inkfylor[.]cyou 185[.]186[.]244[.]0/24

172[.]94[.]9[.]0/24

185[.]93[.]89[.]37

185[.]93[.]89[.]138

MITRE ATTACK Techniques Seen/Used

T Code	Technique Name	Why It Applies
T1595	Active Scanning	Scanning and probing of externally exposed services.
T1046	Network Service Scanning	Probing externally exposed services is network service scanning.
T1583.001	Acquire Infrastructure: Domains	“typosquatted domains,” which requires domain acquisition.
T1566	Phishing	Phishing attempts.

Recommended Actions

The following are some of the best practices to counter malicious email attacks:

• Provide regular phishing awareness training to all employees and crew; help them understand how to identify and report suspicious emails and messages to the security team (including how to handle links & attachments).
• Consider implementing additional email security technologies / tools to detect and filter spam, phishing attacks, and potentially malicious attachments or
• As a best practice, do not respond to the sender of a suspicious email using email – even if the user is known. A compromised email account may be monitored by an adversary who may redirect the email and respond on-behalf-of the Use an alternate contact method, such as calling the sender.

It is recommended that you block or monitor the shared threat indicators, and report sightings back to the MTS-ISAC. Prepare your organization for distributed denial of service (DDoS) attacks, ransomware, and espionage campaigns.

Continue to conduct vulnerability scans and monitor for geolocation anomalies.

Please share firewall logs, phishing emails, other suspicious activity, and sightings with the MTS-ISAC for further analysis, trending, and reporting to the maritime community.

All maritime transportation system (MTS) organizations are encouraged to consider implementing NIST 800-53 (Rev. 5) security controls¹, or another security framework, to help manage risk to within their organization’s acceptable limits.

Additional guidance can be found at CISA’s Shield-Up website: https://www.cisa.gov/shields-up. Furthermore, CISA has a page dedicated to Iran: https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/iran.

Contact Us

Please continue to use heightened awareness and contact the MTS-ISAC if there are questions or your organization has similar activity to report: https://www.mtsisac.org/contact. We appreciate the shares!

1 Security Controls

Security Advisory – Threats from Iran

On February 28, 2026, U.S. forces launched Operation Epic Fury against the government of Iran. Extensive combat operations are taking place across Iran and the surrounding region. Iran and its proxies have attacked shipping and energy infrastructure. The United States has said that combat operations may continue for several weeks or more.

Some facility operators have asked if the Coast Guard will change the MARSEC Level, or if there are other actions they should take.

Seebald & Associates is not aware of any active threats in the United States, but we note with concern that the recent shooting in Austin may have been inspired by Iran, according to the FBI. While further investigation may conclude otherwise, it is a reminder that deadly security incidents can occur anywhere, and that malicious actors may choose to act on their own, choosing targets of opportunity.

Seebald & Associates advises the following:

• Stay in close contact with your local Coast Guard office and respond quickly if they ask for information, put out any advisories, or direct specific actions.
• Review your MARSEC procedures to be sure you are fully prepared to implement them if necessary.
• Remind all personnel to be alert for suspicious activity of any kind. This could include persons or activities near your facility, behavior by employees, contractors, or visitors, drone sightings, or cyber activity.
• Reach out to your cybersecurity counterparts and be sure they are taking appropriate action. Iran has considerable cyber capabilities. It is reasonable to assume that they will employ them against the United States, including America interests and businesses.
• Remind all personnel to follow established access control and other security procedures. This is a great time to conduct a drill, hold a short training session, and do a check of gates, fencing, lights, and alarms.

Summary: NVIC 02-24 Change 1 (November 12, 2025)

Overview

The updated U.S. Coast Guard Navigation and Vessel Inspection Circular (NVIC) 02-24 Change 1, issued on November 12, 2025, provides comprehensive guidance regarding mandatory reporting requirements for security and cyber incidents within the U.S. Maritime Transportation System (MTS). This revision consolidates and clarifies three overlapping regulations that became effective between 2024 and 2025, aiming to harmonize requirements and reduce duplicate reporting. The NVIC emphasizes a “when in doubt — report” approach for stakeholders.

Key Regulations for NVIC 02-24 Change 1

• 33 CFR 101.305: Requires MTSA-regulated vessels and facilities to report any Breach of Security (BOS), Suspicious Activity (SA), or Transportation Security Incident (TSI).
• 33 CFR 6.16-1 (Executive Order 14116): Mandates all MTS stakeholders—including vessels, harbors, ports, and waterfront facilities, but excluding OCS facilities—to immediately report any actual or threatened cyber incident to the Captain of the Port (COTP), FBI, and CISA.
• 33 CFR 101.620: Directs OCS facilities, and any MTSA entity not already covered by 33 CFR 6, to report Reportable Cyber Incidents (RCI) to the National Response Center (NRC).

Reporting Requirements by Entity

Entity	BOS / SA / TSI	Cyber Incident (33 CFR 6)	Reportable Cyber Incident (RCI) (33 CFR 101.620)
MTSA-regulated vessels & facilities (33 CFR 104/105)	Yes → NRC (mandatory)	Yes → NRC (covers COTP + FBI) + CISA	No (already covered by 33 CFR 6)
Waterfront facilities, harbors, ports (non-MTSA)	No (unless MTSA-regulated)	Yes → NRC + CISA	No
OCS facilities (33 CFR 106)	Yes → NRC	No	Yes → NRC

Mandatory Actions Checklist

1. Breach of Security (BOS) or Suspicious Activity (SA) – MTSA Entities

• Report without delay to the National Response Center (NRC) at 1-800-424-8802.
• Optional: Notify the local Captain of the Port (COTP) directly, but NRC notification remains mandatory.

2. Transportation Security Incident (TSI) – MTSA Entities

• Vessels and facilities (104/105): Immediately notify the local COTP, then follow Vessel/Facility Security Plan procedures, which may include NRC notification.
• OCS facilities (106): Immediately notify the cognizant District Commander, then follow the facility’s security plan.

3. Cyber Incident (Actual or Threatened) – All Vessels, Harbors, Ports, Waterfront Facilities (Excluding OCS)

• Report immediately (without delay, as soon as safely possible) to the NRC at 1-800-424-8802. This single call satisfies reporting to both COTP and FBI, as NRC forwards reports to FBI CyWatch (cywatch@fbi.gov).
• Separately report to CISA via phone at (844) 729-2472 (844-Say-CISA), email at SayCISA@cisa.dhs.gov, or through the CISA Service Portal.

4. Reportable Cyber Incident (RCI) – OCS Facilities or MTSA Entities Not Subject to 33 CFR 6

• Report without delay to NRC at 1-800-424-8802.
• Do not report under 33 CFR 6 to avoid double reporting.

5. Criteria for a Reportable Cyber Incident/RCI

• Substantial loss of confidentiality, integrity, or availability of IT/OT systems.
• Disruption or significant adverse impact on operational capabilities or delivery of goods/services.
• Potential for serious injury, death, or major public health/safety impact.
• Disclosure or unauthorized access to large amounts of non-public personal information.
• Potential operational disruption to critical infrastructure.
• Any incident that may become a TSI.

Routine spam, normal port scans, or accidental plugging in of a USB stick are not reportable incidents.

6. Minimum Information Required in Every Report

• Identity of the reporting party (name and company).
• Exact location (address or latitude/longitude).
• Type of entity (vessel, facility, port, harbor).
• Brief description of the incident and actual or potential consequences.

7. Special Cases

• Unauthorized drone (UAS) over a facility or vessel should be reported as SA to NRC; if the drone lands, crashes, or flies below perimeter fence height, report as BOS.
• Prohibited item found after passenger/cargo screening at a cruise terminal should be reported as BOS.
• Loose ammunition found during screening (without a firearm) is generally not considered SA or BOS unless local law enforcement directs otherwise.

8. Recommended Actions (Not Mandatory)

• Participate in the local Area Maritime Security Committee (AMSC).
• Become familiar with the local Coast Guard Marine Transportation System Specialist – Cyber (MTSS-C).
• For free incident-response assistance, request Coast Guard Cyber Protection Team via NRC or email MaritimeCyber@uscg.mil.
• Consider joining FBI InfraGard.

Summary: One-Phone-Call Rule

For most entities in the maritime sector, except OCS facilities, a single call to the NRC at 1-800-424-8802 followed by notification to CISA fulfills all federal cyber-incident reporting obligations to the USCG, FBI, and CISA. It is recommended to keep this NVIC guidance and the one-page reporting flowchart in the Vessel/Facility Security Officer’s binder and ensure all watchstanders are trained accordingly.

DHS FEMA 2025 Port Security Grant Program

Executive Summary: The PSGP is focused on enhancing security of Maritime Facilities within U.S. navigable waterways. Funding is prioritized towards terrorism prevention, response, recovery, and mitigation based on port area risk through implementation of Area Maritime Transportation Security Plans and facility security plans among port authorities, facility operators, and state and local government agencies required to provide port security services and to train public safety personnel under section 70132 of Title 46.

Funding Opportunity Number: DHS-25-GPD-056-00-99

Expected Total Funding: $90,000,000

Anticipated Number of Awards: 200

Expected Award Range: $10,000 – $6,500,000

Application Start Date: August 1, 2025

Projected Application End Date: August 15, 2025 5:00pm Eastern Time

Anticipated Funding Selection: No Later Than August 23, 2025

Anticipated Award Date: No Later Than September 30, 2025

Projected Performance Start Date: September 1, 2025

Projected Performance End Date: August 31, 2028

For more information pertaining to this notice of funding opportunity contact your Area Maritime Security Committee or your local Coast Guard Sector Port Security Grant Specialist.

For Assistance go to: Department of Homeland Security FEMA Port Security Grant Program website.

Final Rule: Cybersecurity in the Marine Transportation System Questions

* In response to questions received from affected stakeholders, and to provide information while future guidance is considered, the Coast Guard is announcing the publication of the Cybersecurity in the MTS final rule Frequently Asked Questions (FAQ). The questions below are representative of those submitted by stakeholders and may have been reworded or combined with others for clarity and organization of topics. They have been grouped under the relevant regulatory cite or the relevant regulatory cite is provided. Nothing in these FAQs represents regulations themselves but support the published regulations. If you have a question that is not reflected here, or you have questions regarding the information presented in the FAQs, please reach out to the Coast Guard at MTSCyberRule@uscg.mil*

General (Last Updated 07/22/2025)

Will the Coast Guard accept and review the submission of a cyber plan in accordance with the final rule right now? Plans are not being approved yet: The Coast Guard is not currently approving plans for these regulations. We are currently developing review and approval procedures to ensure consistent application of standards for the maritime industry. Previously submitted plans: If a plan has already been submitted, it will be securely retained until the review and approval process is finalized.

How do I demonstrate compliance with training requirements (101.650(d)) before having an approved cybersecurity plan (effective January 2026)? Documentation: Use the existing documentation process outlined in the approved FSP/OCS FSP/VSP for other MTSA-related training. Record Keeping: Ensure training records explicitly state the topics covered that comply with 101.650(d). Qualifications: The entity providing the training should meet or exceed the knowledge standards for a Cybersecurity Officer (CySO) as outlined in 101.625(e)(2), (5), (8), (10), (11). No Amendment Required: No FSP/OCS FSP/VSP amendment is needed as long as the cyber training is documented as additional security training within the existing plan.

Does the Coast Guard intend to release guidance clarifying how compliance with cybersecurity requirements will be inspected or enforced? The USCG is determining the best way forward to meet stakeholder needs.

Should MTSA facilities/vessels without Operational Technology (OT) be exempt from these cybersecurity regulations? No. MTSA regulation implies Transportation Security Incident (TSI) risk regardless of OT presence. All regulated entities must conduct the cybersecurity assessment. After assessment, waivers or equivalence determinations can be requested if warranted.

What is the appeals process for cybersecurity deficiencies? First, request reconsideration from the cognizant Captain of the Port (COTP). If unresolved, appeals are handled in accordance with 33 CFR 101.420.

101.605(a) Are Maritime Academies under the Maritime Administration (MARAD) required to adopt the new Coast Guard cybersecurity regulations? Applicability depends on whether their operations meet MTSA-regulated entity criteria. The rule doesn’t expand MTSA applicability but adds cybersecurity requirements to the existing framework. If they operate vessels under 33 CFR Part 104 or facilities under 33 CFR Part 105, they may be subject to the requirements. If a vessel already has a Vessel Security Plan (VSP) and complies with MTSA, it will likely need to comply with the new cybersecurity provision. Consult the MARAD/USCG Memorandum of Understanding for further guidance.

101.620 – Owner or operator (Last Updated 07/22/2025)

101.620(b)(3) Are there specific licensing or certification requirements for the CySO? No. For details about CySO requirements, see 33 CFR 101.625(e).

101.625 – Cybersecurity Officer (Last Updated 07/22/2025)

101.625(a) May a company outsource their CySO to a third-party company? Yes. CySO requirements may be met through third-party services.

101.625(b) Are there any limits to how many vessels/terminals can fall under a CySO? No. For details, see 33 CFR 101.625(b).

101.625(d)(6) What are the cybersecurity inspection expectations? Timing: Inspections can be combined with other inspections or separate. Format: In-person review, like existing facility/vessel inspections. CySO Remote Participation: The CySO may be able to participate remotely at the discretion of the COTP or OCMI.

101.630 – Cybersecurity Plan (Last Updated 07/22/2025)

101.630 What IT/OT systems should be considered in complying with these regulations? Purpose: The Cybersecurity assessment must identify IT/OT that impact maritime operations or could lead to a TSI. It is not limited to FSP/VSP identified assets.

Approach: Owners/operators should take a holistic approach to include all necessary systems. Questions: Direct specific IT/OT questions to MTSCyberRule@uscg.mil.

101.630 Can similar vessels share one Cyber Plan? Yes, owners/operators may submit one Cybersecurity Plan for two or more U.S.- flagged vessels with similar operations. The Plan must address any specific cybersecurity risk differences between individual vessels.

101.630(a) Can the cybersecurity plan be combined with the Vessel Security Plan (VSP) or FSP, and harmonized? Yes. For details, see 33 CFR 101.630(a).

101.630(a), (c), (e), (f) What is the purpose of Audits vs. Assessments? Cybersecurity Plan (CSP) Audits: Internal verification to ensure CSP/assessment validity or identify amendments. Required annually, or more often with changes (owner/operator, cyber measures). CSP amendments may necessitate separate FSP/VSP amendments if related topics or impacted measures become outdated. Cybersecurity Assessment: Vital for CSP development: complete assessment first, then tailor plan to identified vulnerabilities. Plan effectiveness rooted in accurate/comprehensive assessment. Not static; threats evolve rapidly, so regular assessment and plan updates are recommended.

101.630(d) Does the CSP renewal have to align with the current FSP/VSP schedule? Owner/operator Choice: That decision is left to the company about whether to request alignment of submission dates. CSP Schedule: Initial approval date sets the CSP’s 5-year schedule. Alignment: On request, the Coast Guard will work with submitters to align approval dates, where able, between the FSP/VSP and their CSP.

101.635 – Drills and exercises (Last Updated 07/22/2025)

101.635(b), (c) Cybersecurity Drills (bi-annual) vs. Exercises (annual): What’s the difference? Cybersecurity Drill: Tests individual aspects of the cybersecurity plan. Cybersecurity Exercise: Full test of the cybersecurity plan.

101.635(a), (b), (c) Can more than one facility/vessel get credit for the same cybersecurity drill and exercise? Yes, an owner/operator may conduct a drill that spans more than one facility/vessel simultaneously. However, all requirements per 33 CFR 101.635 must be met for each specific facility/vessel involved. The same scenario may be used for multiple facilities at different times, provided it remains applicable to each. Each successive drill should test a different part of the security plan, as feasible.

101.635(a), (b), (c) Can IT phishing tests or simulated cyber incidents count as drills? Yes, phishing awareness emails, such as simulated link-click response can potentially count as drills. However, they should not be the only types of drills conducted. Drills should vary the elements of the plan tested over time.

Real-world events can also serve as drills/exercises.

101.635 Can cybersecurity drills and exercises be combined with physical security drills and exercises? Yes, cybersecurity drills and annual exercises can be combined with existing MTSA-required physical security drills/exercises. For combined exercises, the scenario must: Fully test both the Cybersecurity Plan (CSP) and the Physical Security Plan (FSP/VSP/OCS FSP). Meet all requirements of each respective regulatory provision.

101.650 – Cybersecurity measures (Last Updated 07/22/2025)

101.650(d) What cybersecurity training requirements will be mandated for personnel in maritime operations? For details about cybersecurity training requirements, see 33 CFR 101.650(d).

101.650(d) What defines “access” for IT/OT cybersecurity training? The ability and means to: Communicate with or interact with a system. Use system resources to handle information. Gain knowledge of system information. Control system components and functions. Typically granted via user credentials and permissions. Can be physical access (for example, plugging in a USB) or logical access (for example, logging into a network).

Personnel with unrestricted physical access to IT/OT equipment housing areas are considered to have “access” for this requirement, even without logical access.

101.650(d)(2) What defines “Key Personnel”? “Key Personnel” may be defined by the owner/operator based on the operational conditions and cybersecurity risks, but in general are individuals whose duties involve: A direct role or leadership in cyber incident response and/or disaster recovery. Being critical to the operations of the covered IT/OT systems. Other personnel as designated by the owner/operator. Identification of these positions/persons is up to the owner/operator and must be documented by position and/or name in the security plan.

101.650(e)(1) What are the expected frequency of mandatory cyber assessments/audits? Cybersecurity Assessments: Initial: No later than July 16, 2027. Frequency: Annually thereafter. Sooner if: Change in ownership. Purpose: Inform plan development/maintenance by identifying risks and vulnerabilities. Note: Assessment must be conducted before developing the Cybersecurity Plan. Cybersecurity Audits (Internal): Frequency: At least annually. More frequently if: Change in owner/operator, or modifications to cybersecurity measures (per 33 CFR 101.630(f)). Purpose: Identify issues or changes since the last audit and initiate Cybersecurity Plan (CSP) amendments.

101.650(e)(1) Can a fleet of vessels with identical IT/OT footprint be covered by a single Cybersecurity Assessment (CSA)? Yes, however, if there is any deviation in configuration on one or more vessels, a Cybersecurity Assessment (CSA) is required for each individual vessel, addressing its unique IT/OT footprint.

101.650(g) Does the Coast Guard have capabilities and resources that can aid companies in their response to cyber incidents? Yes, the USCG can provide guidance and assistance. Resources: Sector Marine Transportation System Specialist -Cyber (MTSS-C), stationed in local COTP Zones. U.S. Coast Guard’s Cyber Protection Team (CPT). Coast Guard Maritime Industry Cybersecurity Resource Website: Coast Guard Maritime Industry Cybersecurity Resource Website How to Request Assistance: During an NRC report. Directly through the Sector Command Center. Through the MTSS-C. Via email: maritimecyber@uscg.mil

101.660 – Cybersecurity compliance documentation (Last Updated 07/22/2025)

Can TSA CIP/CAP compliance fulfill new cybersecurity requirements? If regulatory overlap exists, entities may identify where requirements are being simultaneously satisfied and bring this to the attention of the Coast Guard during submission or inspection.

Part 160 – Ports and Waterways Safety – General (Last Updated 07/22/2025)

“Cyber incident” (160.202) vs. 101.615 definitions? The use of the term “cyber incident” in the definition of “hazardous condition” in 33 CFR 160.202 is treated the same as the definition of “cyber incident” in 33 CFR 101.615.

Do foreign vessels have to report cyber incidents via ENOA and to NRC/COTP? Yes, hazardous conditions (now including cyber incidents) must be reported on the Notice of Arrival (NOA) per 33 CFR 160.206. Immediate notification to the nearest COTP or OCMI is required for any hazardous condition (33 CFR 160.216).