The USCG cyber rule: dates that apply now (2026-01-12 training, 2027-07-16 assessment and plan)
The US Coast Guard's final rule on cybersecurity in the Marine Transportation System was published on 17 January 2025 (90 FR 6298, docket USCG-2022-0802) and is codified at 33 CFR part 101, subpart F, sections 101.600 to 101.670. We read the eCFR text on 1 November 2026. Those sections carry a 16 July 2025 version date and no later amendment. Here is what the text says, and which of its dates have already passed.
This is a summary, not legal advice. The rule text is the authority, and the Coast Guard's own guidance is where a question about how it will be applied is answered.
Who it covers
Owners and operators of:
- US-flagged vessels that are required to have a vessel security plan under 33 CFR part 104;
- facilities regulated under the Maritime Transportation Security Act, part 105;
- Outer Continental Shelf facilities, part 106.
A foreign-flagged ship is not covered as a vessel, although the US facilities it calls at may be. If you are a US-flagged vessel with no part 104 plan, the rule's scope test does not reach you. Confirm which side you are on before anything else.
The dates in the text
| What | Date | Where |
|---|---|---|
| Report reportable cyber incidents to the National Response Center "without delay" | In force since 16 July 2025 | Subpart F reporting section |
| General and key-personnel training, then annually | 12 January 2026 | 33 CFR 101.650(d)(1)(ii) to (v) and (d)(4) |
| Plan-specific training | Within 60 days of Cybersecurity Plan approval | 33 CFR 101.650(d)(1)(i) |
| Cybersecurity Assessment, then annually | No later than 16 July 2027 | 33 CFR 101.650(e) |
| Cybersecurity Plan submission | No later than 16 July 2027 | 33 CFR 101.655, compliance dates |
So as of this post, the reporting duty and the first training date are already behind you, and the assessment and plan are the next hard dates. The compliance dates live in section 101.655. Section 101.665 is about waivers and equivalents, which is easy to confuse with it.
A designated Cybersecurity Officer is also part of the rule. We found a 16 July 2027 date for that designation only in the Coast Guard's preamble and fact sheet, not in the eCFR text, so treat it as a secondary reading and check it.
Is any of this delayed?
The final rule asked for comment on a possible two to five year delay for US-flagged vessels, and comments closed on 18 March 2025. When we checked the Federal Register's record for the docket on 1 November 2026, it listed only the two proposed rules (22 February 2024 and 9 April 2024) and the final rule. We found no delay rule. A request for comment is not a rulemaking, so plan to the dates in the text and re-check before each one.
What the dates imply for planning
- Reporting is a process question: who decides an event is reportable, and who calls the National Response Center. Having that written down is the part you can do any day.
- Training recurs annually, so the January date is a cycle, not a one-off.
- The assessment and plan are the large pieces. The assessment is repeated each year after the first, and the plan is the document the Coast Guard reviews, so a gap list started early is cheaper than one started in spring 2027.
A quick screen
The free maritime cyber applicability check tells you whether a vessel is likely in scope of this rule from its flag and part 104 status, and cites the rule. It runs in your browser and is not legal advice.
Dated 1 November 2026. Primary source: 33 CFR part 101, subpart F, on the eCFR.
Sources and further reading:
docs/research/maritime-ot-cruise-2026-11.md(repository)packages/shared/src/maritime/applicability.ts(repository)
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.