US Coast Guard Sets 2027 Deadline for Maritime Cybersecurity Plans
MTSA-regulated entities must submit Cybersecurity Plans, Officer designations and Assessments by July 16, 2027.
The U.S. Coast Guard has released Navigation and Vessel Inspection Circular (NVIC) 02-26, providing critical guidance for maritime entities regulated under the Maritime Transportation Security Act (MTSA) to comply with updated cybersecurity requirements. The new directive sets a July 16, 2027, deadline for submitting Cybersecurity Plans (CSPs), Cybersecurity Officer (CySO) designations, and Cybersecurity Assessments (CSAs).
The NVIC, published on October 20, 2026, aims to help owners and operators of U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities address emerging cybersecurity threats within the Marine Transportation System (MTS).
What the What the New Guidance Requires: Coast Guard
NVIC 02-26 outlines a structured approach to compliance, offering practical resources for documenting CySO designations, conducting CSAs, and developing CSPs. The circular includes four key enclosures to assist regulated entities.
1. Cybersecurity Plan Development and Maintenance: Provides a section-by-section guide for structuring and submitting CSPs, aligning with regulatory requirements.
2. The designation letter must be submitted to the Coast Guard by the deadline.
3. Penetration Testing Guidance: Details expectations for periodic penetration testing, which will be required during five-year renewal cycles. The guidance emphasises safety considerations for operational technology (OT), ensuring that testing does not disrupt critical maritime operations. Notably, penetration testing is not required for the initial CSP submission due in 2027.
4. Scoping and Assessment Guidance: Presents an optional, structured methodology based on the NIST Cybersecurity Framework to help owners and operators identify critical IT and OT systems and evaluate their interdependencies. This enclosure is designed to streamline the assessment process, enabling entities to prioritise assets based on risk.
The Coast Guard’s approach is performance-based, allowing flexibility for entities to tailor compliance methods to their specific operational environments, vulnerabilities, and risk tolerances. This flexibility acknowledges the diverse nature of the maritime industry, where cybersecurity risks can vary significantly between vessel operators, port facilities, and offshore platforms.
Why This Matters for the Maritime Industry
The Coast Guard’s regulations aim to create a baseline of cybersecurity resilience across the MTS, ensuring that entities can detect, respond to, and recover from cyber incidents effectively.
For MTSA-regulated entities, the deadline of July 16, 2027, is a critical milestone. However, the Coast Guard has emphasised that entities are not required to hire third-party providers to conduct CSAs or develop CSPs, though such services are available for those who prefer external support.
The guidance also underscores the importance of operational technology (OT) safety. The Coast Guard’s focus on OT safety in penetration testing ensures that cybersecurity measures do not inadvertently compromise the safety or reliability of these critical systems.
Entities seeking additional resources can visit the Coast Guard’s Maritime Industry Cybersecurity Resource Center, which offers tools, templates, and further guidance on compliance. The Coast Guard’s Office of Maritime Cybersecurity Policy is also available for inquiries at [email protected].
As the maritime industry continues to digitise, cybersecurity will remain a top priority. The Coast Guard has indicated that it will continue to update its guidance as new threats emerge and technologies evolve. For now, MTSA-regulated entities must focus on meeting the 2027 deadline, ensuring that their cybersecurity measures are robust, adaptable, and aligned with the latest regulatory expectations.
With no applicable (dato no verificable en fuente) until the deadline, MTSA-regulated entities should take immediate steps to ensure compliance. Here’s what operators and owners need to do.
1. Designate a Cybersecurity Officer (CySO): Identify and formally designate a qualified individual to oversee cybersecurity efforts. Use the sample designation letter provided in NVIC 02-26 as a template.
2. Conduct a Cybersecurity Assessment (CSA): Evaluate current cybersecurity measures, identify vulnerabilities, and document critical IT and OT systems. The optional scoping methodology in Enclosure (4) can help streamline this process.
3. Develop a Cybersecurity Plan (CSP): Create a comprehensive CSP that outlines risk detection, mitigation, and incident response strategies. Follow the section-by-section guidance in Enclosure (1) to ensure the plan meets regulatory requirements.
4. Submit Documentation by July 16, 2027: Ensure all required documents, CySO designation, CSA, and CSP, are submitted to the Coast Guard by the deadline. Entities can submit their plans electronically via the Coast Guard’s Navigation and Vessel Inspection Circular website.
4. Prepare for Future Penetration Testing: While not required for the initial submission, entities should begin planning for penetration testing, which will be mandatory during five-year renewal cycles. The guidance in Enclosure (3) provides detailed expectations for safe and effective testing.
The Coast Guard’s NVIC 02-26 is a significant step toward enhancing cybersecurity resilience in the maritime sector. By providing clear, actionable guidance, the Coast Guard is empowering entities to proactively address cyber threats while maintaining the safety and efficiency of maritime operations. For the industry, the message is clear: cybersecurity is no longer optional, it is a regulatory imperative.
Sign up free to ask CAMAL AI for a summary, the key points or anything else about this story.
Related stories
CAMAL AI
Financial Ports Newsletter
The maritime economy, every morning
Ports, shipping and freight markets in one short email. Free.
