Cruise Vessel Security and Safety Act
The records and IT duties of the Cruise Vessel Security and Safety Act: video surveillance and retention, the crew stateroom-access log, the crime log and reporting, medical confidentiality and crime-scene training, with the statute text on every row. Assessed per vessel.
What Cruise Vessel Security and Safety Act is
The Cruise Vessel Security and Safety Act, codified at 46 U.S.C. 3507 and 3508, sets security and safety duties for passenger vessels that carry 250 or more passengers and call at a US port. Most of it is physical, such as rails, peep holes and latches. A smaller part is records and systems, and that is the part CMDash tracks.
The records duties include a video surveillance system with signs, access limited to law enforcement and to the subject of the video, retention for at least 20 days, and a longer four-year hold on footage the FBI identifies for a reported incident. A 2025 amendment added a system that electronically records the date, time and identity of each crew member who enters a passenger stateroom, with the access procedures reviewed every year. The statute also requires a log book and crime reporting, confidentiality of sexual assault examination and counseling information, and crime-scene preservation training.
There is no implementing regulation for the Act, so the statute text itself is what an auditor reads.
Who it applies to
- Owners of passenger vessels covered by the Act, which the statute defines by passenger capacity, US-port calls and voyage length.
- The company security officer and the ship's security staff who keep the video, access and crime records.
- Ship IT teams who run the video, stateroom lock and reporting systems.
- Medical staff and managers responsible for examination records and their confidentiality.
How it is structured in CMDash
CMDash seeds the records- and IT-relevant paragraphs of 46 U.S.C. 3507 and 3508, one row each, with the statute citation as the control id (for example 3507(f)(1)(C)). The statute text is attached to each row verbatim, as US federal law; the titles, statements and evidence lines are CMDash's own wording. The Act is assessed per vessel.
| Video surveillance | 4 |
| Sexual assault examination and medical confidentiality | 2 |
| Crew access to passenger staterooms | 2 |
| Log book and crime reporting | 3 |
| Crime scene preservation training | 2 |
Control rows ready to assign, track, and evidence from your first sign-in.
Scope: The records-relevant duties of 46 U.S.C. 3507 and 3508, with the statute text verbatim (US federal law). Vessel design and equipment, the passenger security guide and agency duties are not seeded.
The control text
13 of the 13 seeded controls carry the publisher’s own wording, taken from 46 U.S.C. 3507 and 3508 (U.S. Code). It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for Cruise Vessel Security and Safety Act
- Each paragraph is a tracked row with an owner, a status, reviewer notes and dated evidence, with the statute text beside it, and scored per vessel.
- A seeded crosswalk to ISO/IEC 27001 Annex A and NIST CSF 2.0, so video, access log and incident reporting evidence you already hold shows where it applies.
- A link from the cruise IT obligation register, so the privacy and records obligations of a cruise line sit in one program with the per-vessel statute duties.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artifact being gathered twice, and they are how a second framework costs a fraction of the first.
Where CMDash stops
Know the boundaries before you plan the work.
- Vessel design and equipment duties (rails, latches, peep holes, key technology and similar), the passenger security guide, and agency duties are not seeded, because they are physical or not duties of the operator's systems.
- Whether the Act applies to a vessel depends on its passenger capacity, port calls and voyages, and is not decided by CMDash.
- CMDash does not file reports with the FBI or the Department of Transportation; it tracks the procedure and keeps the evidence.
- Nothing here is legal advice.
Common questions
How long must cruise video be kept?
The Act requires video surveillance records to be kept for at least 20 days after the footage is obtained, and footage the FBI identifies for a reported incident to be preserved for at least four years from the date of the alleged incident. The statute text is attached to the rows.
What is the stateroom-access log?
A 2025 amendment requires a system that electronically records the date, time and identity of each crew member who accesses a passenger stateroom, with the access procedures reviewed every year. CMDash tracks it as a row with evidence of the lock system configuration and sample extracts.
Does the Act have implementing regulations?
No implementing regulation exists, so the statute text itself is the reference.
Also in Privacy & Sector Regulation
Paid plans cap how many frameworks you run at once, never which ones — Cruise Vessel Security and Safety Act is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.