USCG Cybersecurity in the Marine Transportation System

The US Coast Guard cybersecurity rule for US-flagged vessels, MTSA facilities and OCS facilities: the cybersecurity plan and officer, training, assessment, drills and incident reporting, with the regulation text on every row. Assessed per vessel or facility.

What USCG Cybersecurity in the Marine Transportation System is

Subpart F of 33 CFR part 101 is the Coast Guard's cybersecurity rule for the marine transportation system. The final rule, published at 90 FR 6298, took effect on 16 July 2025. It applies to US-flagged vessels, to facilities regulated under the Maritime Transportation Security Act and to facilities on the outer continental shelf, and it adds cybersecurity to the security plans those units already keep.

The owner or operator of each unit has to keep an approved Cybersecurity Plan, designate a Cybersecurity Officer who can be reached at all times, and run a Cybersecurity Assessment. The plan has to show the technical measures: account security including multi-factor authentication, device security, data security including logging, training, risk management, supply chain, resilience, network segmentation and physical security. It also has to describe how the unit drills, keeps records, communicates, and reports cyber incidents to the National Response Center.

Two dates anchor the rollout. Training under the rule was due on 12 January 2026, and the Cybersecurity Assessment and the Cybersecurity Plan are due for submission on 16 July 2027. The Coast Guard, through the plan approval and its inspections, decides what it accepts.

Who it applies to

• Owners and operators of US-flagged vessels covered by the rule, which the applicability sections of the rule define.
• Owners and operators of facilities regulated under the Maritime Transportation Security Act, such as terminals and cruise ship terminals.
• Owners and operators of outer continental shelf facilities.
• The Cybersecurity Officer named for each unit, and the shore teams who support the plan, drills and training.

How it is structured in CMDash

CMDash seeds one row for each lettered paragraph of sections 101.620 to 101.650, one row for each numbered measure under 101.650(a) to (i), the 101.640 records section and the 101.655 compliance dates. Control ids are the CFR citations (for example 101.650(a)(4)). The regulation text is attached to each row verbatim, as US federal law; the titles, statements and evidence lines are CMDash's own wording. Because the plan is kept for each vessel or facility, the framework is assessed per unit.

Scope: Sections 101.620 to 101.655, with the regulation text verbatim (US federal law). Applicability, definitions, waivers and the administrative sections are not seeded. Your approved plan and Coast Guard direction govern.

The control text

What CMDash does for USCG Cybersecurity in the Marine Transportation System

• Each paragraph is a tracked row with an owner, a status, reviewer notes and dated evidence, with the regulation text shown beside it, and scored per vessel or facility.
• A seeded crosswalk to NIST CSF 2.0 and ISO/IEC 27001 Annex A. Many edges are close matches, such as multi-factor authentication, log management, training and backups.
• Two connector rules reach this framework through that crosswalk, both labeled as derived: the Okta multi-factor coverage rule on the multi-factor authentication row (101.650(a)(4)) and the AWS audit-logging check on the log security row (101.650(c)(1)).
• The vessel and facility units, asset inventory and zones and conduits sit next to these rows in the maritime module.

What it shares with your other frameworks

CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artifact being gathered twice, and they are how a second framework costs a fraction of the first.

Where CMDash stops

Know the boundaries before you plan the work.

• Your approved Cybersecurity Plan and Coast Guard direction govern. CMDash does not submit plans, assessments or reports to the Coast Guard or the National Response Center; it keeps the records and evidence.
• The applicability sections (101.600 to 101.615), waivers and equivalents, and the administrative sections are not seeded as controls. Whether the rule applies to a unit is for the owner or operator to determine from the regulation text.
• The wording of the titles, statements and evidence lines is CMDash's; only the attached regulation text is the Coast Guard's.
• CMDash does not connect to shipboard or terminal OT networks to test them.
• Nothing here is legal advice.

Common questions

Also in Maritime & OT

Paid plans cap how many frameworks you run at once, never which ones — USCG Cybersecurity in the Marine Transportation System is available on every paid plan.