USCG Issues Cybersecurity Compliance Guidance for MTSA

New Circular Supports MTSA Cybersecurity Rule

The U.S. Coast Guard has issued Navigation and Vessel Inspection Circular (NVIC) 02-26, titled “Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities.” According to the Coast Guard, the circular is designed to help owners and operators of MTSA-regulated vessels, facilities, and Outer Continental Shelf facilities understand and apply the cybersecurity requirements set out in 33 CFR Part 101, Subpart F.

Those requirements stem from a final rule published in the Federal Register on January 17, 2025, which updated cybersecurity requirements for U.S.-flagged vessels, facilities and Outer Continental Shelf facilities subject to MTSA. The rule was introduced to address both current and emerging cybersecurity threats across the Marine Transportation System by setting minimum standards for detecting risks, mitigating vulnerabilities, and responding to and recovering from incidents.

Key Deadlines and Deliverables

NVIC 02-26 lays out practical steps for documenting Cybersecurity Officer (CySO) designations, carrying out Cybersecurity Assessments (CSA), and developing Cybersecurity Plans (CSP). Regulated entities must complete and submit these items to the Coast Guard no later than July 16, 2027. The circular is meant to act as a roadmap for compiling, formatting, and submitting CSPs for Coast Guard approval.

The Coast Guard noted that the guidance takes a performance-based approach, meaning the expected standard is defined but the specific method of compliance is left to the owner or operator, depending on business needs, operating environment, and risk tolerance.

Four Supporting Enclosures

NVIC 02-26 includes four enclosures:

• Enclosure (1) covers Cybersecurity Plan development and maintenance, with section-by-section guidance tied to the regulatory text.
• Enclosure (2) offers a sample Cybersecurity Officer designation letter and related guidance.
• Enclosure (3) addresses penetration testing expectations during five-year renewal cycles, including safety considerations for operational technology. The Coast Guard clarified that penetration testing is not required for the initial CSP submission due in July 2027.
• Enclosure (4) presents an optional “risk-filtering” methodology, based on the NIST Cybersecurity Framework, to help operators scope their environment and identify critical IT/OT systems and interdependencies.

No Third-Party Requirement

The Coast Guard reminded regulated entities that while third-party services may be available to support cybersecurity work, there is no requirement to hire outside providers to conduct the CSA or develop the CSP. The circular builds on earlier guidance issued by the Coast Guard’s Office of Maritime Cybersecurity Policy (CG-MCP), which is available alongside other resources on the agency’s Maritime Industry Cybersecurity Resource Center. The Coast Guard said it will continue developing and updating guidance to support stakeholders in meeting these requirements, whether independently or with third-party assistance. Questions on the NVIC or related cybersecurity topics can be directed to CG-MCP.

Apeks view — The performance-based structure here puts the burden on documentation, not just defense. Owners and operators now need a Cybersecurity Officer designation, a documented assessment, and a plan that can withstand Coast Guard review by July 2027 — built on evidence of process, not a vendor’s assurance. The explicit note that third parties aren’t required cuts both ways: in-house teams can meet the bar, but only if their assessment work is structured, dated, and defensible on paper.