Requirements checked on September 30, 2026.
Maritime cybersecurity connects digital protection with safe vessel and port operations. A compromised account can affect more than email: it can interrupt the information and access that crews, technical teams, and shoreside operators depend on.
For covered US operators, the immediate task is to separate obligations already in effect from the work due in 2027. Initial cybersecurity training was due on January 12, 2026. Cybersecurity plans must be submitted to the US Coast Guard by July 16, 2027. Waiting for the plan deadline does not postpone the training requirement.
This guide focuses on the US Coast Guard cybersecurity requirements and the practical records, responsibilities, and system checks that can help you prepare.
Who must comply
Under 33 CFR Part 101, Subpart F, the requirements apply to owners and operators of US-flagged vessels, facilities, and Outer Continental Shelf facilities that must have a security plan under 33 CFR Parts 104, 105, or 106.
The scope does not include every boat or maritime business. Subpart F explicitly excludes foreign-flagged vessels covered by Part 104. Those vessels can still have separate reporting, flag-state, and safety-management obligations.
Start with your existing vessel or facility security plan. Confirm which assets are covered and who owns the compliance work. If the scope is unclear, resolve it with the relevant Coast Guard authority before building a fleet-wide project around an assumption.
Key compliance dates
The Coast Guard’s implementation timeline separates reporting, training, and planning milestones.
| Date | Requirement | What it means now |
|---|---|---|
| July 16, 2025 | The rule took effect; reportable cyber incidents must be reported to the National Response Center. | Reporting is already an active responsibility. |
| January 12, 2026 | Initial required personnel training was due, with annual training thereafter. | Check completion records and recurring training dates. |
| July 16, 2027 | Designate a Cybersecurity Officer, complete the Cybersecurity Assessment, and submit the Cybersecurity Plan for approval. | Schedule assessment, remediation, and submission work before the deadline. |
The July 16, 2027 deadline is a plan submission deadline. Submission and approval are separate steps. Build time into your schedule for internal review and possible Coast Guard questions.
Build a useful cybersecurity plan
The Cybersecurity Plan requirements cover responsibilities, training, exercises, records, communications, equipment, access controls, monitoring, audits, vulnerabilities, incident reporting, and the assessment. A generic corporate IT policy will rarely describe how a particular vessel or terminal actually works.
A practical preparation file should let a reviewer answer these questions:
- Who is responsible? Record the Cybersecurity Officer, supporting personnel, and escalation contacts.
- What is connected? Keep an asset inventory and network map that match the equipment in service.
- Which risks remain? Record each issue, its owner, the planned treatment, and the reason for any accepted risk.
- How will people respond? Link incident procedures to vessel and shoreside responsibilities.
- What evidence exists? Keep training records, review results, and corrective-action records organized.
For US-flagged vessels, plans go to the Marine Safety Center. Facility and offshore-facility plans go to the appropriate Captain of the Port or Officer in Charge, Marine Inspections. The plan is Sensitive Security Information and requires appropriate protection. Keep detailed network maps and access instructions out of public project folders.
Protect vessel systems without disrupting operations
Information technology (IT) supports functions such as email and business records. Operational technology (OT) monitors or controls physical processes. On a vessel, the distinction matters because a security change can affect availability or safety. NIST’s Guide to Operational Technology Security addresses those constraints.
Treat security work on bridge, machinery, and cargo systems as an operational change. Have qualified technical personnel review the proposed work, manufacturer requirements, maintenance window, recovery method, and effect on connected equipment.
Map the connections that matter
Begin with the paths between the vessel, shore office, equipment suppliers, and remote support providers. For each connection, record its purpose, owner, access method, and systems reachable through it.
A useful review asks whether a remote dashboard only reads vessel data or can also change equipment settings. That distinction should be visible in the design and in the access granted to its users.
Control accounts and remote support
The required cybersecurity measures include multifactor authentication for password-protected IT and remotely accessible OT systems, with documented compensating controls when it is not feasible. They also address default passwords, privileged access, inventories, and the removal of credentials when users leave.
The January 2026 joint guidance on secure OT connectivity emphasizes controlled connections, monitoring, and an isolation plan. Apply that approach to supplier access: identify who connects, why access is needed, what they can reach, and how access ends.
For your operating procedure, consider an approved maintenance request, a named technician, an agreed access window, and a recorded closeout. Ask the equipment supplier to explain any connection that bypasses that process.
Make training specific to each role
Required training covers personnel with IT or OT access, including contractors. OT users need relevant OT training, and key personnel have additional responsibilities. New personnel generally need training within five days of gaining system access and no later than 30 days after hiring. Annual training also applies; plan-specific training follows plan approval.
Use examples that match the job. A crew member might need to recognize an unexpected maintenance USB drive. A purchasing employee might need to verify a changed bank account. A technical superintendent might need to challenge an unusual request for permanent remote access.
Record what was taught, who completed it, and when the next session is due. A completion certificate is more useful when you can connect it to the person’s actual responsibilities.
Test a realistic incident scenario
Consider this hypothetical exercise: a supplier requests emergency remote access while a vessel is alongside, but the account shows activity outside the agreed maintenance window. The exercise is to test decisions and communication, not to disconnect live equipment.
Ask the vessel and shoreside teams to work through these questions:
- Who verifies the request through a known supplier contact?
- Who determines whether the affected connection supports a safety-critical function?
- Who can authorize a safe restriction of access?
- Who preserves the relevant logs and records the timeline?
- Who evaluates reporting obligations and communicates with the authorities?
Record unclear responsibilities and assign corrective actions. The most useful result may be a missing contact, an untested recovery instruction, or a vendor account that nobody owns. Those findings give the next technical review a concrete starting point.
Use a 30-day preparation schedule
The following schedule is a suggested internal work plan, not a regulatory extension or a substitute for requirements already in effect. Adjust it to your fleet size and maintenance schedule.
| Period | Work | Evidence to produce |
|---|---|---|
| Week 1 | Confirm scope, review training status, and assign responsibility. | Covered-asset list, training gaps, and named owners. |
| Week 2 | Review vessel-to-shore connections and supplier access. | Connection map and prioritized access issues. |
| Week 3 | Review recovery procedures and run a discussion-based incident exercise. | Exercise notes, recovery gaps, and corrective actions. |
| Week 4 | Organize assessment and plan preparation. | Work schedule, evidence index, and internal review dates. |
Give each open action an owner and a due date. Track whether it is complete, waiting for a vendor, or dependent on a maintenance window. An unresolved issue should have a visible explanation and a next step.
Frequently asked questions
Does an IMO cyber risk process replace the US plan?
No. The International Maritime Organization’s cyber risk guidance supports incorporating cyber risk into existing safety-management processes. A covered US entity must still meet the applicable Coast Guard requirements. Existing records can support the work, but they should be checked against the US requirements.
Is cybersecurity software enough to demonstrate compliance?
A product cannot establish that your personnel are trained, your responsibilities are clear, or your response procedures work. Evaluate software against defined needs, then keep evidence showing how it supports the plan. Avoid treating a dashboard or a security score as proof that every obligation is met.
Should maritime cybersecurity include shoreside systems?
Yes, where those systems and connections affect covered operations. Reviewing only onboard equipment can miss supplier access, shared accounts, and data flows. For related physical and operational risks, see OrbitsHub’s guide to port security.
Plan security into maritime integrations
Before adding a remote monitoring portal, fleet dashboard, or vessel-data connection, define the access it needs and the operational limits it must respect. Make those decisions part of the project brief.
OrbitsHub works on maritime software, vessel-data integration, and shoreside visibility. If you are planning an integration, discuss its data flows, permissions, and operational requirements with the team alongside your cybersecurity and compliance specialists.
