USCG Cybersecurity in the Marine Transportation System control library
Every control CMDash tracks for USCG Cybersecurity in the Marine Transportation System, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history.
60 controls16 families41 mapped to other frameworksNo published text extract yet
Families
Owner or operator · 2Cybersecurity Officer · 5Cybersecurity Plan · 6Drills and exercises · 3Records and documentation · 1Communications · 2Cybersecurity measures: Account security · 8Cybersecurity measures: Device security · 5Cybersecurity measures: Data security · 3Cybersecurity measures: Training · 5Cybersecurity measures: Risk management · 4Cybersecurity measures: Supply chain · 4Cybersecurity measures: Resilience · 5Cybersecurity measures: Network segmentation · 3Cybersecurity measures: Physical security · 3Cybersecurity compliance dates · 1
Owner or operator · 2
| 101.620(a) | Owner or operator is responsible for compliance with subpart F |
| 101.620(b) | Owner or operator duties: plan, CySO, exercises, assessment, response plan, NRC reports Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity Officer · 5
| 101.625(a) | CySO may hold other roles if the CySO duties can still be performed Maps to ISO/IEC 27001:2022 |
| 101.625(b) | One CySO for several units: each unit named in each plan |
| 101.625(c) | CySO may delegate duties but keeps ultimate responsibility |
| 101.625(d) | CySO responsibilities: assessment, measures, audit, exercises, training, records, KEVs Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.625(e) | CySO has the required general knowledge, training or experience |
Cybersecurity Plan · 6
| 101.630(a) | CySO develops, implements and verifies a Cybersecurity Plan for each unit Maps to NIST Cybersecurity Framework 2.0 |
| 101.630(b) | Plan is Sensitive Security Information protected under 49 CFR part 1520 |
| 101.630(c) | Plan contains the 14 required sections, or an index to them |
| 101.630(d) | Plan is submitted to the Coast Guard, approved, and valid for 5 years |
| 101.630(e) | Plan amendments: initiation, 30-day notice, 96-hour owner and CySO change rules |
| 101.630(f) | Annual independent audit of the plan; amendments within 30 days of an audit Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Drills and exercises · 3
| 101.635(a) | Drills and exercises test personnel proficiency and plan implementation |
| 101.635(b) | Cybersecurity drills at least twice each calendar year Maps to NIST Cybersecurity Framework 2.0 |
| 101.635(c) | Cybersecurity exercises each calendar year, no more than 18 months apart Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Records and documentation · 1
| 101.640 | Records of training, drills, exercises, threats, incidents and plan audits are kept Maps to ISO/IEC 27001:2022 |
Communications · 2
| 101.645(a) | CySO can notify owners, operators and personnel of changes in cybersecurity conditions Maps to NIST Cybersecurity Framework 2.0 |
| 101.645(b) | Continuous communications with the unit, interfacing vessels, COTP and authorities Maps to ISO/IEC 27001:2022 |
Cybersecurity measures: Account security · 8
Cybersecurity measures: Device security · 5
| 101.650(b) | Device security measures are in place, in plan Section 6, and available to the Coast Guard |
| 101.650(b)(1) | Approved list of hardware, firmware and software for IT and OT systems Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(b)(2) | Executable-code applications disabled by default on critical IT and OT Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(b)(3) | Accurate inventory of network-connected systems with critical IT and OT designated Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(b)(4) | Accurate network map and OT device configuration documentation Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Data security · 3
| 101.650(c) | Data security measures are in place and documented in plan Section 4 |
| 101.650(c)(1) | Logs securely captured, stored and accessible only to privileged users Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(c)(2) | Effective encryption for sensitive data and IT and OT traffic where feasible Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Training · 5
| 101.650(d) | Personnel cybersecurity training programme documented in plan Sections 2 and 4 Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(d)(1) | All personnel with IT or OT access trained on the five listed topics Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(d)(2) | Key personnel trained on incident roles and current threats Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(d)(3) | Untrained personnel needing IT or OT access are accompanied or monitored |
| 101.650(d)(4) | Training deadlines: January 12, 2026, then annually; new users within 5 and 30 days Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Risk management · 4
| 101.650(e) | Risk management measures are in place and documented in plan Sections 11 and 12 |
| 101.650(e)(1) | Annual Cybersecurity Assessment, first by July 16, 2027, with KEV patching Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(e)(2) | Penetration test at plan renewal with certification letter in the security assessment Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(e)(3) | Routine system maintenance: KEV patching, disclosure intake, no exposed channels, scans Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Supply chain · 4
| 101.650(f) | Supply-chain measures are in place and documented in plan Section 4 |
| 101.650(f)(1) | Cybersecurity capability is a criterion when procuring IT and OT systems or services Maps to NIST Cybersecurity Framework 2.0 |
| 101.650(f)(2) | Vendors notify the owner or CySO of vulnerabilities and incidents without delay Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(f)(3) | Third-party remote connections monitored and documented Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Resilience · 5
| 101.650(g) | Resilience measures are in place and documented in plan Sections 3 and 9 |
| 101.650(g)(1) | Reportable cyber incidents reported to the NRC without delay Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(g)(2) | Cyber Incident Response Plan developed, implemented, maintained and exercised Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(g)(3) | Plan effectiveness validated by annual exercises or incident reviews Maps to NIST Cybersecurity Framework 2.0 |
| 101.650(g)(4) | Backups of critical IT and OT systems, protected and tested frequently Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Network segmentation · 3
| 101.650(h) | Network segmentation measures are in place and documented in plan Sections 7 and 8 |
| 101.650(h)(1) | Segmentation between IT and OT networks Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(h)(2) | All IT-to-OT connections logged and monitored for suspicious activity Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity measures: Physical security · 3
| 101.650(i) | Physical security measures are in place and documented in plan Sections 7 and 8 |
| 101.650(i)(1) | Physical access to OT and related IT limited to authorized personnel; HMIs logged Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
| 101.650(i)(2) | Unauthorized media and hardware blocked; unused ports closed; access by exception Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0 |
Cybersecurity compliance dates · 1
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for USCG Cybersecurity in the Marine Transportation System 33 CFR 101 subpart F (2025), published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.