US Coast Guard Releases New Maritime Cybersecurity Compliance Guidance

[By US Coast Guard]

The U.S. Coast Guard has published Navigation and Vessel Inspection Circular (NVIC) 02-26, Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities, to help owners and operators of regulated maritime entities understand and implement cybersecurity requirements under 33 CFR Part 101, Subpart F.

On January 17, 2025, the Coast Guard published a final rule in the Federal Register to update cybersecurity requirements for U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities, subject to MTSA. These cybersecurity regulations address current and emerging cybersecurity threats in the Marine Transportation System (MTS) by adding minimum cybersecurity requirements to help detect risks, mitigate threats and vulnerabilities, and respond to and recover from cybersecurity incidents.

This NVIC provides practical resources for documenting Cybersecurity Officer (CySO) designations, conducting Cybersecurity Assessments (CSA), and developing Cybersecurity Plans (CSP), all to be completed and submitted to the Coast Guard no later than July 16, 2027. It serves as a key roadmap to help entities successfully compile, format, and submit their completed CSPs for Coast Guard approval. The NVIC is intended to support regulatory compliance while recognizing the different operational environments and cybersecurity risks across the maritime industry. This NVIC follows previous guidance published by CG-MCP, which can be found, along with other cybersecurity resources, on the Coast Guard’s Maritime Industry Cybersecurity Resource Center website. The Coast Guard will continue to identify, develop, and update guidance as needed, to support stakeholders in compliance through their own efforts or in coordination with third-party providers. Note: Regulated entities are reminded that while there may be third-party services available to support cybersecurity initiatives, there is no requirement to hire a third-party to conduct the CSA or develop the CSP.

In alignment with existing maritime security standards, the Coast Guard’s cybersecurity requirements reflect a performance-based approach, in which the expected standard of performance is set, and the exact method of compliance is left up to the owner/operator in consideration of varied business needs, operating environments, vulnerabilities, risk environment, and risk tolerance.

NVIC 02-26 includes four enclosures to assist owners/operators with meeting regulatory requirements: 

Enclosure (1) - Cybersecurity Plan Development and Maintenance: Outlines the structure, content, and submission recommendations for CSPs. This includes section-by-section guidance aligned with the regulatory requirements. 

Enclosure (2) - Sample Cybersecurity Officer Designation Letter: Provides a template and guidance for documenting the designation of a qualified CySO. 

Enclosure (3) - Penetration Testing Guidance: Details expectations for periodic penetration testing conducted during five-year renewal cycles, including safety considerations for operational technology (OT). Penetration testing is not required as part of the initial CSP submission due July 16, 2027. 

Enclosure (4) - Scoping and Assessment Guidance: Presents an optional, structured "risk-filtering" methodology based on the NIST Cybersecurity Framework to help owners/operators scope their environment, identify critical IT/OT systems, and evaluate interdependencies. 

MTSA-regulated entities, Industry representatives, agencies, and other maritime stakeholders can find the NVIC on the Coast Guard’s Navigation and Vessel Inspection Circular website.     

For questions related to this NVIC, the cybersecurity regulations, or other maritime cybersecurity topics, please reach out to the Coast Guard’s Office of Maritime Cybersecurity Policy at [email protected].