The US Coast Guard published its Cybersecurity in the Marine Transportation System final rule on 17 January 2025, effective 16 July 2025. It covers US-flagged vessels, Outer Continental Shelf facilities and facilities under the Maritime Transportation Security Act. Reportable incidents go to the National Response Center immediately upon discovery.
Who is covered
Per a Jones Walker summary, the rule applies to US-flagged vessels, OCS facilities and MTSA-regulated facilities. Foreign-flagged vessels are not covered by the rule itself, but the same summary says they face closer Port State Control scrutiny if they lack adequate cybersecurity.
The dates
- 16 July 2025: rule effective; incident reporting to the National Response Center begins.
- 12 January 2026: personnel complete training under 33 CFR 101.650, then annually.
- 16 July 2027: Cybersecurity Officer designated; Cybersecurity Assessment and Plan submitted for approval.
New personnel have 30 days from gaining system access to complete training.
Reporting
Reportable incidents include unauthorized access, malware and denial of service. Before the rule, reporting was voluntary. The summary says the duty is to report immediately upon discovery, so decide in advance who may make that call and how.
What the summary does not cover
The article we read does not discuss specific technical controls such as passwords, multifactor authentication or patching. Read the final rule, 90 FR 6298, for those. Also, the rule text discussed a possible delay for US-flagged vessels. We did not confirm the outcome, so check the Coast Guard's current guidance.
Questions a facility manager should settle early
Who owns the Cybersecurity Assessment? It touches operations, IT and security, and it tends to stall when nobody is named. Which systems count as part of the assessment? Start from anything that carries cargo data, access control or navigation inputs, then widen. How will you prove the training happened? Keep a roster and dates, because an inspector will ask for records, not recollections.
It also helps to separate the three clocks in your head. Reporting is already live. Training has a date in the past for this cycle and repeats yearly. The plan and the officer are the long lead items, and 2027 arrives faster than a budget cycle suggests.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a single control can be mapped to several requirements, a useful habit when a facility meets more than one regime.
Getting ready
- List the systems on each vessel or facility that connect to a network.
- Name a person for the Cybersecurity Officer role before the 2027 date.
- Schedule training now, not in the last month.
- Write one page on who reports an incident and how.
Safeguard offers asset discovery and compliance evidence automation, which can support the assessment file. It is not a maritime control system product.
Quick check
Does the rule cover foreign-flagged ships?
Not directly, per the summary, though Port State Control may scrutinize their cybersecurity.
When must a Cybersecurity Officer be named?
By 16 July 2027, per the summary.
Sources
Last reviewed: 19 October 2026.
