The United States Coast Guard (U.S. Coast Guard) has released new guidance titled NVIC 02-26 regarding cybersecurity requirements for entities under the Maritime Transportation Security Act (MTSA). This guidance assists owners and operators of maritime entities in understanding and implementing cybersecurity requirements according to Section 101, Subsection F of 33 CFR.
History and Background
On January 17, 2025, the Coast Guard published a final rule in the Federal Register updating cybersecurity requirements for U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities under MTSA. These new requirements are designed to address existing and emerging cybersecurity threats in the Maritime Transportation System (MTS) and provide minimum cybersecurity requirements for identifying hazards, mitigating threats and vulnerabilities, and responding to cybersecurity incidents.
Read more: Minesto received a €20.2 million grant for a 10-megawatt tidal farm project in Ireland
Guidance Details and Requirements
The NVIC 02-26 guidance includes practical resources for documenting cybersecurity officer (CySO) designations, conducting cybersecurity assessments (CSA), and developing cybersecurity plans (CSP) that must be submitted to the Coast Guard by July 16, 2027. This guidance serves as a key roadmap to assist entities in collecting, formatting, and submitting completed CSPs for Coast Guard approval. The NVIC is designed to aid compliance with regulations while considering the differences in operational environments and cybersecurity risks in the maritime industry.
NVIC 02-26 includes four appendices that assist owners and operators in meeting regulatory requirements:
- Appendix (1) - Development and Maintenance of Cybersecurity Program: Specifies the structure, content, and submission recommendations for CSPs.
- Appendix (2) - Cybersecurity Officer Designation Letter Template: Provides a template and guidance for documenting the designation of a qualified CySO.
- Appendix (3) - Penetration Testing Guidance: Outlines expectations for periodic penetration testing during five-year renewal periods.
- Appendix (4) - Guidance for Scope and Assessment: Offers an optional structured approach for "filtering risks" based on the NIST cybersecurity framework.
Entities under MTSA, industry representatives, agencies, and other maritime stakeholders can view the NVIC on the Coast Guard's website. For questions regarding this NVIC, cybersecurity requirements, or other maritime cybersecurity topics, they can contact the Coast Guard's Maritime Cybersecurity Policy Office.
Read more: Fugro signed a seabed mapping contract with NOAA · Petros Panagiotidis acquired a stake in Volar Transport
