US Coast Guard issues NVIC 02-26 guidance on maritime cybersecurity plans and IT/OT risk assessments, with a July 16, 2027 deadline
The U.S. Coast Guard released Navigation and Vessel Inspection Circular (NVIC) 02-26 to help operators of U.S.-flagged vessels, port facilities and Outer Continental Shelf facilities regulated under the Maritime Transportation Security Act (MTSA) comply with the cybersecurity requirements in 33 CFR Part 101, Subpart F. Regulated entities must designate a Cybersecurity Officer (CySO), complete a Cybersecurity Assessment (CSA) and submit a Cybersecurity Plan (CSP) to the Coast Guard by July 16, 2027. The Coast Guard takes a performance-based approach: owners and operators choose how to comply, must document and evidence implementation, and need not hire third-party providers. The circular follows the recent creation of the Office of Maritime Cybersecurity Policy, the Coast Guard's central authority for cybersecurity policy across the Marine Transportation System. It is a compliance and policy item with no direct threat activity.
Detalhes técnicos
- Enclosure (1): CSP development and maintenance, with section-by-section guidance aligned to the regulations.
- Enclosure (2): sample CySO designation letter.
- Enclosure (3): penetration testing expectations for five-year renewal cycles, including OT safety considerations. Penetration testing is not required for the initial CSP submission.
- Enclosure (4): optional risk-filtering methodology based on the NIST Cybersecurity Framework to scope the environment, identify critical IT and OT systems and assess interdependencies.
- The Coast Guard will not prescribe specific products or solutions. Restating regulatory text in a CSP is not enough; entities must document how they meet each requirement.
Remediação
- Designate a qualified CySO and document the designation.
- Conduct a cybersecurity assessment covering IT and OT systems and their interdependencies.
- Develop and submit the CSP by July 16, 2027, and prepare for Coast Guard compliance inspections using Enclosures 1-4.
Linha do tempo
-
US Coast Guard issues NVIC 02-26 guidance on maritime cybersecurity plans and IT/OT risk assessments, with a July 16, 2027 deadline
ler a análise desta fonte ocultar
The U.S. Coast Guard released Navigation and Vessel Inspection Circular (NVIC) 02-26 to help operators of U.S.-flagged vessels, port facilities and Outer Continental Shelf facilities regulated under the Maritime Transportation Security Act (MTSA) comply with the cybersecurity requirements in 33 CFR Part 101, Subpart F. Regulated entities must designate a Cybersecurity Officer (CySO), complete a Cybersecurity Assessment (CSA) and submit a Cybersecurity Plan (CSP) to the Coast Guard by July 16, 2027. The Coast Guard takes a performance-based approach: owners and operators choose how to comply, must document and evidence implementation, and need not hire third-party providers. The circular follows the recent creation of the Office of Maritime Cybersecurity Policy, the Coast Guard's central authority for cybersecurity policy across the Marine Transportation System. It is a compliance and policy item with no direct threat activity.
Technical Details
- Enclosure (1): CSP development and maintenance, with section-by-section guidance aligned to the regulations.
- Enclosure (2): sample CySO designation letter.
- Enclosure (3): penetration testing expectations for five-year renewal cycles, including OT safety considerations. Penetration testing is not required for the initial CSP submission.
- Enclosure (4): optional risk-filtering methodology based on the NIST Cybersecurity Framework to scope the environment, identify critical IT and OT systems and assess interdependencies.
- The Coast Guard will not prescribe specific products or solutions. Restating regulatory text in a CSP is not enough; entities must document how they meet each requirement.
Remediation
- Designate a qualified CySO and document the designation.
- Conduct a cybersecurity assessment covering IT and OT systems and their interdependencies.
- Develop and submit the CSP by July 16, 2027, and prepare for Coast Guard compliance inspections using Enclosures 1-4.