NEW PORT CYBER RULES BECOME EFFECTIVE THIS JULY

The U.S. Coast Guard is advising ports and terminals regarding the effective date for the final rule for cyber security requirements effective July 16, 2025.  On January 17, the US Coast Guard released the final rule on cybersecurity in the US Marine Transportation System.  The rule establishes mandatory minimum cybersecurity requirements for the maritime sector which includes ports and terminals. In summary the rules are set up as follows:

1. Scope and Applicability

The new regulations establish minimum mandatory requirements for US flag vessels, Outer Continental Shelf (OCS) facilities, and facilities subject to the Maritime Transportation Security Act of 2002. The rule is set up to address the increasing risks posed by cyber threats due to the growing reliance on interconnected digital systems within the maritime industry. It emphasizes both preventing cyber incidents and preparing to respond to them effectively.  Of note in the industry is the expanding use of block chain technology. The application of the rules is as follows:

1. US flag vessels subject to 33 CFR part 104:

Cargo vessels greater than 100 gross tons

Commercial passenger vessels certified to carry more than 150 passengers

Offshore Supply Vessels (OSVs)

Mobile Offshore Drilling Units (MODUs)

Towing vessels more than 26 feet long engaged in towing certain dangerous cargo barges

Cruise ships and passenger vessels carrying more than 12 passengers on international voyages

1. Facilities subject to 33 CFR part 105:

Container terminals

Chemical facilities with waterfront access

Petroleum terminals

Cruise ship terminals

Bulk liquid transfer facilities

LNG/LPG terminals

Barge fleeting facilities handling dangerous cargo

Facilities that receive vessels carrying more than 150 passengers

Marine cargo terminals otherwise subject to the Maritime Transportation Security of 2002

1. OCS facilities subject to 33 CFR part 106:

Offshore oil and gas production platforms

Offshore drilling rigs

Floating production storage and offloading units (FPSOs)

Deepwater ports

Offshore wind energy facilities

Offshore loading/unloading terminals

1. Core Requirements

The cybersecurity plan must include measures for account security (e.g., automatic account lockout, strong passwords, multifactor authentication), device security (e.g., approved hardware/software lists, disabling executable code), and data security (e.g., secured logging, data encryption). The following is to be implemented:

1. Cybersecurity Officer

Each covered entity must designate a Cybersecurity Officer (CYSO) responsible for implementing and maintaining cybersecurity requirements. The rule allows for designation of alternate CYSOs and permits one individual to serve multiple vessels or facilities.

1. Cybersecurity Plans and Assessments — Organizations must develop and maintain the following:

A comprehensive Cybersecurity Plan

A separate Cyber Incident Response Plan

Regular cybersecurity assessments

Plans must be submitted to the Coast Guard for review within 24 months of the rule’s effective date.

1. Training and Exercises — The rule mandates the following:

Cybersecurity training for all personnel using IT/OT systems beginning July 17, 2025

Two cybersecurity drills annually

Regular penetration testing aligned with plan renewal cycles

1. Technical Controls — Required security measures include the following:

Account security controls including multifactor authentication

Device security measures and approved hardware/software lists

Data encryption and secure log management

Network segmentation and monitoring

Supply chain security requirements

III. Implementation Timeline

KEY DATES

Effective date: July 16, 2025

Training requirements begin: July 17, 2025

Initial cybersecurity assessment: Due by July 16, 2027

Cybersecurity Plan submission: Due by July 16, 2027

The Coast Guard is seeking comments on extending implementation periods for the new requirements by two to five years for US flag vessels. Comments are due no later than March 18, 2025. After review of these comments, the Coast Guard may issue a future rule to allow additional time for US flag vessels to implement the new regulations.

1. Harmonization with Other Requirements

The Coast Guard has worked to align these requirements with other cybersecurity regulations, including the Cybersecurity and Infrastructure Security Agency’s (CISA) Cyber Incident Reporting for Critical Infrastructure Act of 2022 reporting requirements. The rule establishes the National Response Center (NRC) as the primary reporting channel for maritime cyber incidents, simplifying compliance for regulated entities.

1. Basic Questions and Answers

What are the mandatory cybersecurity measures outlined in the rule?

Owners and operators must implement a range of cybersecurity measures that are based on “cybersecurity performance goals” developed by CISA. This includes vulnerability identification of critical IT and OT systems, addressing known exploited vulnerabilities in those critical systems, and conducting penetration testing in conjunction with renewing the Cybersecurity Plan.

What constitutes a reportable cyber incident, and to whom do I report it?

A reportable cyber incident is defined as any incident leading to substantial loss of confidentiality, integrity, or availability of a covered system; to disruption to business operations; to unauthorized access to nonpublic personal information of a large number of individuals; or to operational disruption of critical infrastructure. Such an incident also includes any event that may lead to a “transportation security incident.” Such incidents must be reported to the NRC.

What is the Coast Guard’s approach to compliance and enforcement of this new rule?

The rule takes a performance-based approach, meaning that it focuses on outcomes rather than prescribing specific technical solutions, thus providing some flexibility to the entities in meeting the requirements. However, the rule does not specify the methods of enforcement, and the Coast Guard is currently working with policymakers to define the compliance criteria. The Coast Guard will address those questions at upcoming symposiums. Noncompliance with the rule could lead to penalties, legal action, and financial losses.

Is there any flexibility or possibility of waivers in complying with this rule?

Yes. After completing a cybersecurity assessment, owners and operators can seek a waiver or an equivalence determination for the requirements, based on the waiver and equivalency provisions of 33 CFR parts 104, 105, and 106. Owners and operators must also notify the Coast Guard of temporary deviations from the requirements.