US-flagged vessels, port facilities and offshore platforms now have a binding federal cybersecurity rule with fixed deadlines, and most operators still have to build the plan, the assessment and the controls it requires. The US Coast Guard final rule "Cybersecurity in the Marine Transportation System", codified at 33 CFR Part 101 Subpart F, sets minimum measures for owners and operators already regulated under the Maritime Transportation Security Act (MTSA). It took effect on 16 July 2025, training was due on 12 January 2026, and the Cybersecurity Officer, Cybersecurity Assessment and Cybersecurity Plan are due by 16 July 2027. This guide covers who is in scope, each obligation with its section number, incident reporting routes, penalties, how the rule treats accounts and remote access, and a phased compliance plan. It is written for security officers, OT and IT teams, and compliance staff in maritime organisations and their vendors.
Status line (checked 27 October 2026): the eCFR text of 33 CFR 101 Subpart F, up to date as of 22 October 2026, still shows the 12 January 2026 training date and the 16 July 2027 plan and assessment date. The Coast Guard asked in the final rule for comment on delaying implementation for US-flagged vessels by two to five years; no delay appears in the current eCFR text. Check the eCFR and Coast Guard Maritime Commons before relying on these dates.
Key takeaways
- Scope follows MTSA security plans. Owners and operators of US-flagged vessels, facilities and Outer Continental Shelf (OCS) facilities that must hold security plans under 33 CFR Parts 104, 105 and 106 are covered; foreign-flagged vessels are excluded from Subpart F.
- Reporting started first. Since 16 July 2025, reportable cyber incidents go to the National Response Center (NRC) without delay, unless already reported under 33 CFR 6.16-1, which requires immediate reports to the FBI, CISA and the Captain of the Port.
- Controls are prescriptive. Section 101.650 lists account, device, data, training, risk management, supply chain, resilience, segmentation and physical security measures, including MFA, least privilege, approved software lists, log protection and patching of known exploited vulnerabilities without delay.
- The big deliverables land in July 2027. A designated Cybersecurity Officer (CySO), a Cybersecurity Assessment and a Cybersecurity Plan submitted for approval, followed by annual audits, two drills and one exercise a year.
- Penalties are modest per violation but stack. The 2025 adjusted maximum under 46 U.S.C. 70119 is USD 43,527 per violation and USD 78,210 for continuing violations, alongside Captain of the Port control measures.
Scope: who and what is covered
Subpart F applies to owners and operators of US-flagged vessels, facilities and OCS facilities that are required to have security plans under 33 CFR Parts 104 (vessels), 105 (facilities) and 106 (OCS facilities) (101.605). Foreign-flagged vessels subject to Part 104 are excluded; the Coast Guard said it may revisit that as international standards develop and will increase Port State Control scrutiny of poor cyber practices on foreign vessels. For Part 105 facilities, Subpart F can pre-empt conflicting state or local rules (101.610).
| Term (101.615) | Meaning in practice |
|---|---|
| Critical IT or OT systems | The systems whose loss or compromise could affect safety, security or operations; most measures bite hardest here |
| Reportable cyber incident | An incident that leads, or could reasonably lead, to a substantial loss of confidentiality, integrity or availability, or to a transportation security incident |
| Cybersecurity Officer (CySO) | The person designated in writing to run the programme, accessible 24 hours a day, 7 days a week |
| Cybersecurity Plan | The Coast Guard-approved plan, treated as sensitive security information under 49 CFR Part 1520 |
| Known exploited vulnerability (KEV) | A vulnerability in CISA's Known Exploited Vulnerabilities Catalog |
The Coast Guard declined a tiered or risk-based applicability model: a small terminal and a large container port face the same measure list, with waivers and equivalence determinations (101.665) as the relief route once the assessment is done. The rule also added "cyber incident" to the definition of hazardous condition.
Key obligations
Governance and plans
- Owner or operator (101.620): ensure a Cybersecurity Plan is developed, approved and maintained; designate a CySO in writing; maintain a Cyber Incident Response Plan; report reportable cyber incidents.
- CySO (101.625): conducts the Cybersecurity Assessment, annual audits, drills and exercises, training oversight and incident reporting, and makes sure KEVs in critical IT and OT systems are identified and mitigated without delay. An alternate may be designated.
- Plan (101.630): follows the required section structure (training, drills, access control, monitoring, incident reporting and the assessment among them); approval lasts five years; amendments go in at least 30 days before they take effect; annual audits begin within one year of approval; audit-driven amendments are due within 30 days of the audit; a CySO or ownership change needs an amendment or notice within 96 hours.
- Drills and exercises (101.635): drills at least twice per calendar year; exercises at least once per calendar year with no more than 18 months between them.
- Records and documentation (101.640, 101.660): keep training, drill, exercise, threat, incident and audit records under the existing Part 104, 105 or 106 record rules; make plan portions and penetration test results available on request. The Alternative Security Program applies to cybersecurity documentation.
Cybersecurity measures (101.650)
| Paragraph | Measures | NIST SP 800-53 Rev 5 analogue |
|---|---|---|
| (a) Account security | Automatic lockout after failed logins; change default passwords or use compensating controls; minimum password strength; MFA on password-protected IT systems and remotely accessible OT systems (or compensating controls); least privilege for privileged accounts; separate credentials for critical systems; remove credentials when users leave | AC-7, IA-5, IA-2, AC-6, AC-2 |
| (b) Device security | Approved list for hardware, firmware and software; executable code disabled by default on critical systems; inventory of network-connected systems; network maps and OT configuration documentation | CM-7, CM-8 |
| (c) Data security | Logs captured, stored securely and accessible only to privileged users; encryption where technically feasible | AU-9, SC-28 |
| (d) Training | Plan provisions, threat recognition, reporting procedures, OT-specific training; extra incident-role training for key personnel; untrained staff accompanied | AT-2 |
| (e) Risk management | Cybersecurity Assessment by 16 July 2027 and annually after; penetration testing with plan renewal; KEVs patched or compensating controls documented without delay; vulnerability scans; limits on internet exposure of OT | RA-5, SI-2, CA-8 |
| (f) Supply chain | Cyber capability in procurement; vendors notify vulnerabilities and incidents without delay; third-party remote connections documented | SR-6 |
| (g) Resilience | Report incidents to the NRC; maintain and exercise the Cyber Incident Response Plan; validate plan effectiveness; back up critical systems and test backups | IR-8, IR-6, CP-9 |
| (h) Network segmentation | Segment IT and OT networks; log and monitor IT and OT connections | SC-7 |
| (i) Physical security | Limit physical access to OT equipment; secure and log human-machine interfaces; disable unused ports and block unauthorised media | PE-3 |
The Coast Guard based the technical baseline on CISA's Cybersecurity Performance Goals, so organisations already measuring against the CPGs have a head start. The analogue column is NHI Mgmt Group's mapping, not part of the rule.
Incident reporting
- Classify: decide whether the event meets the reportable cyber incident definition; when in doubt, treat a substantial loss of availability on a critical OT system as reportable.
- Report: notify the NRC without delay under 101.620 and 101.650(g), unless reporting under 33 CFR 6.16-1, which requires evidence of an actual or threatened cyber incident involving or endangering any vessel, harbour, port or waterfront facility to be reported immediately to the FBI, CISA and the Captain of the Port. OCS facilities do not report under Part 6.
- Respond: run the Cyber Incident Response Plan and preserve logs.
- Record and review: keep the incident record and feed lessons into the next audit and plan amendment.
See the Cyber Incident Reporting Requirements Map and the CIRCIA Incident Reporting Guide for how these routes fit with other US duties.
Timeline and current status
| Date | Milestone | Source |
|---|---|---|
| 17 January 2025 | Final rule published (90 FR 6298) | Federal Register, GAO |
| 18 March 2025 | Comment deadline on a possible two to five year delay for US-flagged vessels | Federal Register |
| 1 May 2025 | GAO major rule report (B-337400) | GAO |
| 16 July 2025 | Rule effective; NRC reporting applies | 33 CFR 101 Subpart F; USCG |
| 29 December 2025 | 2025 inflation-adjusted penalties apply to assessments after this date | 33 CFR 27.3 |
| 12 January 2026 | Personnel and key personnel training complete, then annually | 101.650(d); USCG |
| Ongoing | New personnel trained within 5 days of system access and no later than 30 days after hiring | 101.650(d)(4) |
| 16 July 2027 | CySO designated, Cybersecurity Assessment complete, Cybersecurity Plan submitted for approval | 101.650(e), 101.655; USCG |
| Within 60 days of plan approval | Basic training on the approved plan | 101.650(d)(1)(i) |
| Within 1 year of approval | First annual plan audit | 101.630(f) |
The Coast Guard said it would publish further guidance on waivers and the Alternative Security Program. A delay for US-flagged vessels was consulted on but, as of the eCFR date above, not adopted. Plan for the published dates.
Enforcement and penalties
- Civil penalties (101.415): failing to comply with a requirement of Subchapter H makes a person liable under 46 U.S.C. 70119. The statute sets USD 25,000 per violation; the 2025 inflation-adjusted maxima in 33 CFR 27.3 are USD 43,527 per violation and USD 78,210 for continuing violations.
- Orders: violating an order or other requirement imposed under 101.405 carries civil or criminal penalties under 46 U.S.C. 70036 or 70052.
- Plan review: plans are submitted for Coast Guard approval, and plan portions and penetration test results must be available on request (101.660).
- Foreign vessels: outside Subpart F, but Port State Control may record deficiencies, detain, deny entry or take Captain of the Port action over poor cyber practices.
The final rule estimated total costs of about USD 1.2 billion (USD 138.7 million annualised at a 2% discount rate, 2022 dollars), a sign that the Coast Guard expects real investment rather than paperwork.
What it means for AI agents and non-human identities
Maritime OT runs on machine accounts: vendor remote support connections, shared HMI logins, PLC programming credentials, terminal operating system integrations and service accounts that move data between IT and OT. Section 101.650 applies to them as much as to people.
- Default and shared credentials (a): changing default passwords and separating credentials on critical systems means replacing vendor-default and shared machine logins, or documenting compensating controls. See the Service Account Security Guide.
- Remote access MFA (a): remotely accessible OT needs MFA or a compensating control, which covers vendor jump hosts and support tunnels. See the OT Remote Access Guide.
- Third-party connections (f): every vendor remote connection must be documented; include the machine credentials, API keys and certificates it uses, their owner and expiry. See the Third-Party Access Guide.
- Credential removal (a): when a contractor or vendor relationship ends, remove the service accounts and keys they used, not only their personal logins.
- AI agents and automation: any agent or script given access to critical IT or OT systems is an account for (a), a device or software item for the approved list in (b), and a log source for (c). Restrict it to least privilege and keep it off OT networks unless the assessment justifies it. See the Agentic AI Identity Guide.
Compliance steps
- Appoint the CySO now: do not wait for July 2027; the CySO owns training, reporting and the assessment, and a 24/7 contact is needed for reporting today.
- Confirm reporting: publish the NRC and 6.16-1 reporting procedure, test it in a drill and record the result.
- Keep training current: confirm the 12 January 2026 training was completed and recorded, and that new starters are trained within 5 days of system access.
- Inventory and map: build the inventory of network-connected systems, IT and OT network maps and the list of third-party remote connections, including machine credentials.
- Close quick wins in account security: default passwords, MFA on remote access, lockout and removal of leavers' accounts. Pilot on one terminal or vessel class first, keep break-glass access documented, and roll back to a compensating control if an OT system cannot support MFA.
- Run the Cybersecurity Assessment: score each 101.650 measure, record gaps and compensating controls, and identify where waivers or equivalence are justified.
- Write and submit the plan: follow the 101.630 structure, mark it as sensitive security information and submit by 16 July 2027.
- Operate the cycle: twice-yearly drills, an annual exercise, an annual audit within a year of approval, penetration testing with renewal and amendments within the deadlines.
| Organisation | Practical emphasis | Watch out for |
|---|---|---|
| Small terminal or single vessel operator | Shared CySO arrangements, a vendor-supported assessment, compensating controls documented carefully | No tiering relief: every measure must be addressed or waived |
| Fleet operator | Standard controls per vessel class, central logging where connectivity allows, fleet-wide training records | Satellite links and limited bandwidth for logs and MFA |
| Large port or OCS facility | Formal IT and OT segmentation, SOC monitoring of IT-OT conduits, penetration test programme | Many third-party remote connections and integrations |
Framework mapping and measurement
| 101.650 area | NIST CSF 2.0 |
|---|---|
| Account security | PR.AA-03, PR.AA-05 |
| Device security | ID.AM-01, ID.AM-03 |
| Data security | PR.DS-01, PR.PS-04 |
| Training | PR.AT-01 |
| Risk management and KEVs | ID.RA-01, ID.RA-08 |
| Supply chain | GV.SC-05, GV.SC-07 |
| Resilience | RS.MA-01, PR.DS-11 |
| Network segmentation | PR.IR-01 |
Metrics to report to the CySO and leadership:
- Share of critical IT and OT systems with MFA or a documented compensating control.
- KEVs on critical systems open longer than the plan's "without delay" target, with compensating controls recorded.
- Third-party remote connections documented, with owner and credential expiry, against the number observed on the network.
- New starters trained within 5 days of system access.
- Drills and exercises completed against the twice-yearly and annual requirement.
- Time from detection to NRC or 6.16-1 report in drills and real incidents.
Common failure patterns
- Treating July 2027 as the start date: reporting and training already apply.
- Counting only people: shared HMI logins and vendor service accounts left out of the account security review.
- Undocumented compensating controls: where OT cannot support MFA or patches, the rule accepts compensating controls only when documented.
- Remote access sprawl: vendor connections added after the inventory and never recorded in the plan.
- Drills without reporting: exercises that never test the NRC and 6.16-1 calls.
Practitioner checklist
- Designate the CySO and alternate in writing with 24/7 contact details.
- Publish and drill the NRC and 33 CFR 6.16-1 reporting procedure.
- Confirm annual training records and the 5-day rule for new system users.
- Inventory network-connected systems, IT and OT network maps and third-party connections with their credentials.
- Remove default and shared credentials on critical systems or document compensating controls.
- Enforce MFA on IT systems and remotely accessible OT, and segment IT from OT with monitored conduits.
- Track KEVs against critical systems and record mitigation decisions.
- Complete the Cybersecurity Assessment and submit the plan by 16 July 2027.
- Schedule two drills, one exercise and the annual audit each year.
Standards and references
- eCFR: 33 CFR Part 101 Subpart F, Cybersecurity
- Federal Register: Cybersecurity in the Marine Transportation System, final rule
- US Coast Guard Maritime Commons: Final rule implementation timeline
- eCFR: 33 CFR 6.16-1, Reporting of sabotage, subversive activity or cyber incidents
- eCFR: 33 CFR 101.415, Penalties
- eCFR: 33 CFR 27.3, Penalty adjustment table
- GAO: Major rule report B-337400
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · Maritime Cybersecurity Guide · OT Security Guide · TSA Pipeline and Rail Cybersecurity Directives Guide. This guide summarises 33 CFR Part 101 Subpart F and related US rules as of 27 October 2026 and is not legal advice.