The United States Coast Guard (USCG) has published Navigation and Vessel Inspection Circular (NVIC) No. 02-26, titled Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities. The document provides detailed guidance for implementing the cybersecurity regulations established under 33 CFR Part 101, Subpart F.
The circular is intended to clarify existing regulatory requirements, support maritime cyber risk management, and explain the Coast Guard’s preferred approaches to compliance. It supersedes NVIC 01-20, which addressed cyber risks at MTSA-regulated facilities under the previous guidance framework.
1. July 16, 2027: The Compliance Deadline
MTSA-regulated entities must operate in accordance with the applicable cybersecurity regulations and their submitted Cybersecurity Plan (CSP) by 16 July 2027. The Coast Guard’s guidance emphasizes the importance of preparing and submitting the required CSP in time for regulatory evaluation.
2. Cybersecurity Assessments and Documented Risk Management
The guidance provides detailed instructions for conducting Cybersecurity Assessments (CSAs). These assessments should identify relevant IT and Operational Technology (OT) assets, network connections, external dependencies, vulnerabilities, and associated risks. The assessment findings inform the scope and content of the CSP.
3. A structured Cybersecurity Plan
NVIC 02-26 provides guidance for developing and maintaining a CSP covering key areas, including:
- Cybersecurity governance and designation of a Cybersecurity Officer (CySO)
- Personnel cybersecurity training
- Cybersecurity drills and exercises
- Records, documentation, and communications
- Cybersecurity systems, access controls, and physical protection of IT and OT
- Monitoring, audits, and vulnerability management
- Cyber incident reporting and response procedures
- Cybersecurity assessments and continuous improvement
The circular includes a cross-reference table linking regulatory provisions to the relevant CSP sections, helping owners and operators structure their compliance documentation.
4. Guidance on Penetration Testing
The document includes a dedicated enclosure on penetration testing. It addresses test planning, scope, tester qualifications, reporting, and frequency. Penetration testing must be conducted at least once during each CSP renewal cycle, while the guidance recommends conducting it within the 24 months preceding renewal. Penetration testing is not required for the initial CSP submission due in July 2027.
The Coast Guard also recognizes that testing live OT and industrial control systems may create operational and safety risks. Testing scope should therefore reflect the findings of the cybersecurity assessment and the operational context.
5. Compliance is based on Demonstrated Effectiveness
The guidance emphasizes that the regulations are performance-based. Rather than prescribing particular cybersecurity products or technical solutions, the Coast Guard expects owners and operators to demonstrate that their security measures address identified risks and satisfy applicable requirements. Documentation and observable evidence of implementation and effectiveness are therefore essential.
What Does This Mean for the Maritime Industry?
NVIC 02-26 is an important reference for organisations preparing for the new US maritime cybersecurity regulatory regime. Its practical guidance can help ship operators, facility operators, cybersecurity professionals, and other relevant stakeholders understand the relationship between regulatory requirements, risk assessments, cybersecurity planning, personnel training, and operational resilience.
Although the regulations apply to the entities specified under the MTSA framework, the guidance also provides useful insights for the wider maritime industry. In particular, its treatment of IT/OT dependencies, risk-based assessments, incident response, and evidence-based compliance highlights the importance of integrating cybersecurity into maritime operations and management.
How Can Maritime Organisations Prepare?
Organisations within the scope of the regulations should consider the following steps:
- Determine regulatory applicability by reviewing the relevant MTSA requirements and the entity’s operational status.
- Designate a Cybersecurity Officer and establish clear cybersecurity responsibilities.
- Conduct a Cybersecurity Assessment covering relevant IT/OT assets, interfaces, dependencies, and risks.
- Develop and submit a Cybersecurity Plan that addresses the applicable regulatory provisions and assessment findings.
- Prepare personnel training, drills, audits, and incident response arrangements to support implementation and demonstrate compliance.
- Establish a continuous improvement process for maintaining the effectiveness of cybersecurity measures as operational conditions and threats evolve.
Early preparation will give affected organisations more time to identify gaps, allocate resources, and implement appropriate risk mitigation measures before the compliance deadline.
Loading...
Reload document 
Open in new tab 
