Inspect four things first on a port crane: every remote access path, the vendor maintenance connections, the boundary between crane control and the terminal's IT network, and an inventory of the software and firmware on the crane. Those answer the questions that matter most: who can reach it, what runs on it and what it can reach.
Why start there?
A crane is a machine with controllers, drives, sensors and operator systems, often linked to terminal software that plans moves. Standards for operational technology emphasise that security must respect safety and reliability. NIST SP 800-82 Rev. 3 covers programmable systems that interact with the physical environment and recommends countermeasures that account for performance, reliability and safety. ISA/IEC 62443 defines requirements for industrial automation and control systems and addresses asset owners, integrators and product suppliers separately, which matches how cranes are bought and serviced.
We did not find crane-specific text in the sources we fetched, and we do not cite incidents here.
What does the US Coast Guard rule add?
The Coast Guard published a final rule on cybersecurity in the marine transportation system on 17 January 2025, effective 16 July 2025. It sets minimum requirements for US-flagged vessels, Outer Continental Shelf facilities and facilities regulated under the Maritime Transportation Security Act. Summaries describe a cybersecurity plan, a designated cybersecurity officer, training and prompt reporting of reportable incidents to the National Response Center, with phased deadlines. Our source for the phase dates is a secondary summary, and the rule discussed delays, so check current Coast Guard guidance. If you operate a regulated facility, ask your compliance lead how the rule applies to equipment such as cranes.
1. Remote access
List every way someone can reach crane systems from outside the cab: vendor remote support, engineer laptops, cellular modems, shared accounts and jump hosts. For each, ask who approves a session, how it is authenticated, whether it is logged and whether it can stay open. Remove paths nobody can justify. Prefer access that the terminal grants for a time window and records.
2. Vendor maintenance
Cranes are serviced by manufacturers and integrators. Ask for their connection method, the tools they bring and how they are checked. Under 62443, service suppliers have their own requirements; ask how they meet them. Update contracts so remote sessions, laptop hygiene and incident notification are explicit.
3. The OT and IT boundary
Find every link between crane control networks and terminal systems: databases, file shares, scheduling systems and time services. Document the allowed flows, block the rest and monitor the boundary. Many OT networks have grown links over years that nobody remembers adding.
4. Software and firmware inventory
For each controller, drive, HMI and gateway record vendor, model, firmware version and installed software. Ask suppliers for a software bill of materials. CISA describes an SBOM as a nested inventory of the components that make up software. When a library vulnerability is announced, the inventory tells you whether you own it.
Then what?
Back up configurations and keep offline copies. Test restoring a controller from a clean image. Rehearse operating with the terminal system degraded, and agree in advance what safe manual fallback looks like.
What to do
- Map all remote access paths and close the unjustified ones.
- Agree a vendor access procedure with approval, logging and time limits.
- Draw the OT and IT boundary, with allowed flows only.
- Build the firmware and software inventory and request SBOMs.
- Store offline backups and test a restore.
- Check with your compliance team how the Coast Guard rule applies to you.
Quick check
Do cranes need the same patching as office computers?
No. Patches may need testing and downtime windows, so compensating controls like segmentation and access limits matter more.
Is there a crane specific standard?
We did not confirm one in our sources. General OT standards such as NIST SP 800-82 and ISA/IEC 62443 apply.
Sources
- NIST SP 800-82 Rev. 3
- ISA/IEC 62443 series overview
- Federal Register, Cybersecurity in the Marine Transportation System, 17 January 2025
- US Coast Guard, final rule announcement
- CISA SBOM
Last reviewed: 18 October 2026.
