Cyber compliance for ports and terminals
Port facilities mix terminal operating systems, cranes and gate systems with corporate IT. CMDash tracks the cyber rules that reach a facility, with the owner, status and evidence behind each requirement.
Maritime cyber compliance overview
Regulatory and customer pressure
The Coast Guard cyber rule for facilities
If your facility is regulated under 33 CFR part 105 or the offshore facility rules of part 106, the rule requires incident reports to the National Response Center without delay since 16 July 2025, general cybersecurity training from 12 January 2026, and a cybersecurity assessment and plan by 16 July 2027.
NIS2 for port managing bodies
NIS2 Annex I lists the managing bodies of ports, including their port facilities, the entities that operate works and equipment within ports, and operators of vessel traffic services. If your organization is one of them and is established in the EU, national transposing laws set the detail.
The Cyber Resilience Act for the equipment you buy
Regulation (EU) 2024/2847 puts duties on manufacturers of products with digital elements: Article 14 reporting from 11 September 2026 and most of the rest from 11 December 2027. Equipment covered by the marine equipment Directive 2014/90/EU is outside it, and for the rest you can ask your suppliers what they document.
Threats that target this industry
Ransomware on terminal operating systems
Systems that schedule berths, yards and gates stop cargo moving when they stop, so recovery readiness is an operating question as well as a compliance one.
Remote access by equipment vendors
Crane, conveyor and gate vendors service their equipment over remote links, and each one is a path into the facility’s networks.
Operational technology joined to corporate IT
Where terminal systems share networks with office systems, a compromise on one side reaches the other unless the separation is designed and checked.
The frameworks CMDash tracks for you
- USCG Cybersecurity in the Marine Transportation SystemThe Coast Guard cyber rule for facilities, with the regulation text on every row.
- NIS2The management-body, risk-management and incident-reporting duties for port managing bodies in the EU.
- NIST Cybersecurity Framework 2.0A structure that operations, security and the board share.
- ISO/IEC 27001:2022A certifiable management system for the enterprise.
- CIS Controls v8.1Prioritized safeguards for the IT side of the facility.
Crosswalked, so one piece of evidence counts twice: USCG Cybersecurity in the Marine Transportation System ↔ NIST Cybersecurity Framework 2.0 · USCG Cybersecurity in the Marine Transportation System ↔ ISO/IEC 27001:2022 · ISO/IEC 27001:2022 ↔ NIST Cybersecurity Framework 2.0
Capabilities that matter most here
Fleet and facility view
Each port facility as a unit with its own profile and control status, rolled up across sites.
Framework tracking and crosswalk
Work once against the Coast Guard rule and carry the status to the NIST CSF 2.0 and ISO 27001 controls that overlap.
Evidence from your tools
Evidence from the tools you run, collected on a schedule.
Incident reporting clocks
Put the deadlines of the regimes you choose, the National Response Center report among them, on the incident record.
Vendor register
Keep the equipment vendors and contractors with access in one register.
Risk register and FAIR
Dollar-denominated loss estimates for outage and breach scenarios.
POA&M tracking
Findings become tracked actions with owners and dates.
Sources
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free: free forever, one framework (CMMC Level 1, Level 2 or NIST CSF 2.0) for a small team, no credit card.