The Coast Guard Maritime Cybersecurity Rule Explained: What 33 CFR Part 101, Subpart F Requires of Ports

The short version

Ports have handled physical security under the Maritime Transportation Security Act (MTSA) for two decades. Subpart F adds a cyber layer to the same plans, the same Captains of the Port and the same regulated population (Federal Register, Jan. 17, 2025; 33 CFR Part 101, Subpart F). It matters for islands because the harbor that brings in food and fuel now runs on terminal operating systems, gate systems, cranes and remote vendor connections, and an outage in any of them can close a lifeline as surely as a blocked channel; ISPI’s Key Bridge and Port of Baltimore closure case shows how much one closure costs.

This explainer covers what the rule requires, the dates that apply, what has changed since publication and what it means for Hawaiʻi, the U.S. Pacific territories and neighboring island governments. Each requirement is paraphrased from the regulatory text in the electronic Code of Federal Regulations, and each date was checked against the Federal Register and Coast Guard sources on Nov. 9, 2026. For related research, see the ports and maritime security research hub and the supply chain and infrastructure hub.

What the rule is and who it covers

The Coast Guard published the final rule, Cybersecurity in the Marine Transportation System, on Jan. 17, 2025 at 90 FR 6298 (docket USCG-2022-0802, RIN 1625-AC77), after a February 22, 2024 proposed rule; it became effective on July 16, 2025 (Federal Register, Jan. 17, 2025). The preamble ties the rule to the 2018 amendment of MTSA, which requires vessel, facility and Outer Continental Shelf security plans to include provisions for detecting, responding to and recovering from cybersecurity risks that may cause a transportation security incident (Federal Register, Jan. 17, 2025).

Applicability follows the existing MTSA plans. Subpart F applies to owners and operators of U.S.-flagged vessels, facilities and Outer Continental Shelf facilities required to have a security plan under 33 CFR parts 104, 105 and 106; it does not apply to foreign-flagged vessels (33 CFR Part 101, Subpart F). The Coast Guard estimated the affected population at about 11,222 vessels and 3,718 facilities, including 33 Outer Continental Shelf facilities, and put industry and government costs at about $1.2 billion in total, or $138.7 million a year annualized at a 2 per cent discount rate in 2022 dollars (Federal Register, Jan. 17, 2025).

Three design choices shape how the rule works in practice. First, it is a baseline: the Coast Guard used CISA’s Cybersecurity Performance Goals as the benchmark for the technical requirements, and CISA has since issued version 2.0 of those goals aligned to the NIST Cybersecurity Framework 2.0 (Federal Register, Jan. 17, 2025; CISA CPGs). Second, it is performance-based: owners choose how to meet each requirement but must document how they do it in the plan (Federal Register, Jan. 17, 2025). Third, the rule replaces guidance with law; the preamble states that the final rule supersedes NVIC 01-20, the 2020 Coast Guard guidance on addressing cyber risk at MTSA facilities (Federal Register, Jan. 17, 2025).

For facilities, § 101.610 gives the subpart preemptive effect over a state or local law that conflicts with it or frustrates an overriding federal need for uniformity (33 CFR Part 101, Subpart F). That matters for state and territorial port authorities that write their own cyber policies: they can add to the federal floor but cannot contradict it.

The timeline, and whether any date has moved

The rule phases in over two years. The Coast Guard summarized the schedule on the effective date: incident reporting to the National Response Center immediately on July 16, 2025; training by Jan. 12, 2026 and annually after that; and Cybersecurity Officer designation, the Cybersecurity Assessment and plan submission by July 16, 2027 (USCG, July 16, 2025). The regulatory text carries the same dates (33 CFR Part 101, Subpart F).

Delay check. The final rule asked for comment, by March 18, 2025, on a possible 2-to-5-year delay of the implementation periods for U.S.-flagged vessels only; it said the Coast Guard may issue a future rule after reviewing comments and asked whether a vessel-only delay could have unintended effects on facilities (Federal Register, Jan. 17, 2025). Incident reporting was outside that question because U.S.-flagged vessels have reported under 33 CFR 6.16-1 since Executive Order 14116 of Feb. 21, 2024 (Federal Register, Jan. 17, 2025). On Nov. 9, 2026 the Federal Register docket USCG-2022-0802 listed only three documents: the two 2024 proposed-rule notices and the January 2025 final rule (Federal Register docket USCG-2022-0802). The eCFR version history for Part 101 shows no change to Subpart F after July 16, 2025, and the current § 101.650(d)(4) and § 101.655 still read Jan. 12, 2026 and July 16, 2027 (33 CFR Part 101, Subpart F). Later Coast Guard guidance repeats the Jan. 12, 2026 training deadline (USCG, Nov. 26, 2025). ISPI therefore found no published delay or extension for training, assessment or plan deadlines, for vessels or facilities. Anyone relying on a different date should ask the Coast Guard at the rule mailbox listed in the final rule and check the Federal Register for any later notice.

The Cybersecurity Officer

Each owner or operator must designate a Cybersecurity Officer (CySO) in writing, by name and title, who can be reached by the Coast Guard 24 hours a day, seven days a week; the plan must say how (33 CFR Part 101, Subpart F). An alternate may be named to cover leave or absence, the CySO may hold other jobs if the duties are still met, and one person may serve several vessels or facilities as long as every plan lists them (33 CFR Part 101, Subpart F). The CySO may delegate tasks but keeps ultimate responsibility (33 CFR Part 101, Subpart F).

The regulation lists 15 responsibilities. In short, the CySO ensures the Cybersecurity Assessment is done; the plan’s measures are built and working; an annual audit happens and the plan is updated; the Cyber Incident Response Plan is executed and exercised; inspections are arranged; problems found by drills, audits or inspections are fixed promptly; staff are trained and aware; reportable cyber incidents are recorded and reported to the owner or operator; records and reports are kept; amendments go to the Coast Guard before they take effect; managers are briefed on changing cyber conditions; and known exploited vulnerabilities in critical systems are identified and mitigated without delay (33 CFR Part 101, Subpart F).

The officer needs general knowledge, through training, education or equivalent experience, of the vessel or facility’s operations, cybersecurity practice, its incident response and cybersecurity plans, security equipment, audit and monitoring methods, relevant law, training techniques, handling of Sensitive Security Information, current threat patterns and known exploited vulnerabilities, behavioral signs of people likely to threaten security, and running drills and exercises (33 CFR Part 101, Subpart F). That last pairing of cyber and behavioral knowledge links the rule to insider risk, the subject of ISPI’s PB-07 brief on supply chain insider risk at island ports.

The Cybersecurity Plan

The plan can sit inside the existing vessel or facility security plan, be an annex to it, be a separate submission or be handled through an approved Alternative Security Program; it is Sensitive Security Information protected under 49 CFR part 1520 (33 CFR Part 101, Subpart F). It must have 14 sections (or an index to them): cybersecurity organization and CySO identity; personnel training; drills and exercises; records; communications; systems and equipment with maintenance; access-control measures; physical security for IT and OT; monitoring; audits and amendments; audit and inspection reports with resolution of vulnerabilities; a record of unresolved vulnerabilities, including those accepted as risk; incident reporting procedures; and the Cybersecurity Assessment (33 CFR Part 101, Subpart F).

Facility and Outer Continental Shelf plans go to the cognizant Captain of the Port or Officer in Charge, Marine Inspection; vessel plans go to the Marine Safety Center (33 CFR Part 101, Subpart F). The Coast Guard may approve (with or without conditions), ask for more information or revisions, or disapprove with reasons; if it needs more time, it can acknowledge receipt and let the operator keep running under the submitted plan (33 CFR Part 101, Subpart F). An approved plan is valid for five years (33 CFR Part 101, Subpart F).

Plans have to stay current. Proposed amendments go to the Coast Guard at least 30 days before they take effect; a change of owner or operator, or of CySO, must be reflected and reported within 96 hours; and an annual audit must begin no later than one year after approval, run by people independent of the measures they audit, with any resulting amendments submitted within 30 days (33 CFR Part 101, Subpart F). Operators may still put extra measures in place at once in an exigent situation, so long as they tell the Coast Guard by the fastest practicable means (33 CFR Part 101, Subpart F).

Waivers come after analysis, not before. Under § 101.665 an owner or operator may seek a waiver or an equivalence determination only after completing the required Cybersecurity Assessment, and must notify the Coast Guard of any temporary deviation (33 CFR Part 101, Subpart F). In July 2026 the Coast Guard also posted a clarification for vessels and facilities that already hold MTSA physical-security waivers because of a low risk of a transportation security incident, explaining how Subpart F applies to them (USCG Maritime Commons).

The technical baseline

Section 101.650 sets the measures every plan must document. They follow familiar cyber hygiene, adapted to ports and ships where operational technology, such as cranes, gates, pumps, ballast and navigation systems, sits next to business IT (33 CFR Part 101, Subpart F).

Two definitions decide how far the measures reach. A critical IT or OT system is any system that, if compromised, could result in a transportation security incident, as the CySO determines in the plan, including business support services and systems run wholly or partly by another party (33 CFR Part 101, Subpart F). That last clause can bring managed service providers, hosted terminal systems and vendor-maintained equipment into scope. Penetration testing is tied to plan renewal, not to the first submission (33 CFR Part 101, Subpart F).

Training: what was due on Jan. 12, 2026

All personnel with access to IT or OT systems, including contractors whether part-time, full-time, temporary or permanent, must be trained on recognizing and detecting cyber threats and incidents, techniques used to get around security measures, how to report a cyber incident to the CySO, and OT-specific topics for anyone whose duties involve OT; key personnel must also be trained on their roles in incident response and on keeping current with threats and countermeasures (33 CFR Part 101, Subpart F). Those topics were due by Jan. 12, 2026 and annually after that (33 CFR Part 101, Subpart F).

New hires must be trained within five days of gaining system access and no later than 30 days after hiring; staff on a new IT or OT system within five days of access; and anyone not yet trained must be escorted or monitored by someone who has been (33 CFR Part 101, Subpart F). Training on the relevant provisions of the plan itself follows within 60 days of plan approval, and all training must be documented in the security records (33 CFR Part 101, Subpart F).

The Coast Guard issued CG-5PC Policy Letter 01-25 on Oct. 10, 2025 to explain the training requirement, and announced it on Nov. 26, 2025 together with Change 1 to NVIC 02-24 on incident reporting (USCG, Nov. 26, 2025). Both are listed on the Coast Guard’s Maritime Cyber Resource Center with a training verification job aid (USCG Maritime Cyber Resource Center).

Incident reporting: the NRC, the FBI and CISA

The rule defines a reportable cyber incident by its consequences. It is one that leads, or if still under investigation could reasonably lead, to a substantial loss of confidentiality, integrity or availability of a covered system; a disruption or significant adverse effect on the ability to operate or deliver goods and services, including effects on public health or safety; disclosure of nonpublic personal information of a significant number of people; other potential operational disruption to critical infrastructure; or a possible transportation security incident (33 CFR Part 101, Subpart F).

Entities that have not already reported under 33 CFR 6.16-1, or are not subject to it, must report reportable cyber incidents to the National Response Center without delay (33 CFR Part 101, Subpart F). Separately, § 6.16-1 requires immediate reporting of evidence of an actual or threatened cyber incident involving or endangering any vessel, harbor, port or waterfront facility to the FBI, CISA and the Captain of the Port (33 CFR 6.16-1). To reduce duplicate reporting, NVIC 02-24 Change 1 aligned the cyber and reportable-cyber-incident criteria and notes that the FBI now accepts National Response Center reports as meeting federal notification requirements (USCG, Nov. 26, 2025). The Coast Guard lists the National Response Center number as 1-800-424-8802 (USCG Maritime Cyber Resource Center).

What the Coast Guard has issued since

Guidance has filled in the rule during 2026. The Coast Guard’s Maritime Commons records a fifth annual Cyber Trends and Insights in the Marine Environment report on June 16, 2026; the July 2026 waiver clarification; Marine Safety Information Bulletin 04-26 on Aug. 27, 2026, confirming that the cyber requirements still apply to inactive vessels that keep a valid certificate; an Aug. 31, 2026 announcement that an Office of Maritime Cybersecurity Policy has been established under the Assistant Commandant for Prevention Policy; and, on Oct. 20, 2026, NVIC 02-26, Cybersecurity Regulations Implementation Guidance for MTSA Regulated Entities (USCG Maritime Commons). NVIC 02-26 appears on the Coast Guard’s NVIC index and its resource center, alongside a policy letter on Cybersecurity Assessment scoping, waiver and equivalency guidance, submission instructions and small-entity guides for facilities and vessels (USCG NVIC index; USCG Maritime Cyber Resource Center).

Foreign-flagged ships are outside Subpart F but not outside scrutiny. On the effective date the Coast Guard said it would intensify Port State Control attention to signs of poor cybersecurity practice affecting International Safety Management Code compliance on foreign-flagged vessels, which may lead to deficiencies, detention, denial of entry or Captain of the Port action (USCG, July 16, 2025). The International Maritime Organization’s guidance for ships is MSC-FAL.1/Circ.3/Rev.4, Guidelines on maritime cyber risk management, and resolution MSC.428(98) asks administrations to make sure cyber risks are addressed in ship safety management systems no later than the first annual Document of Compliance verification after Jan. 1, 2021 (IMO).

Port equipment supply chains remain a parallel concern. MARAD’s U.S. Maritime Advisory 2026-014, effective Oct. 21, 2026 through April 19, 2027, warns of vulnerabilities in foreign-made port equipment and systems, reminds owners of Chinese-manufactured ship-to-shore cranes to comply with Coast Guard Maritime Security Directives 105-4 and 105-5, and recommends segmentation, multifactor remote access, monitoring, offline backups and on-site vendor updates (MARAD Advisory 2026-014). Those recommendations overlap heavily with the supply-chain, segmentation and resilience measures in § 101.650 (33 CFR Part 101, Subpart F).

What it means for Hawaiʻi and the U.S. Pacific territories

In the Pacific, the Coast Guard’s Oceania District in Honolulu directs operations across Hawaiʻi, Guam, the Commonwealth of the Northern Mariana Islands and American Samoa, with 24-hour command centers at Sector Honolulu and Sector Guam (USCG Oceania District). Any MTSA-regulated facility in those jurisdictions, whether run by a state or territorial port authority, a terminal operator, a fuel company or a tenant, falls under Subpart F if it must keep a part 105 facility security plan (33 CFR Part 101, Subpart F).

Hawaiʻi shows why the cyber layer matters. The State’s Honolulu Harbor 2050 Master Plan says about 85 per cent of the goods used in Hawaiʻi are imported and 91 per cent of those imports come through the State’s commercial harbors, with Honolulu Harbor as the statewide distribution hub (Honolulu Harbor 2050 Master Plan). The same plan describes the harbor’s maritime sector as heavily reliant on IT, OT and connected devices within a just-in-time supply chain, warns that cyber attacks can interrupt operations and corrupt data, and says the master plan is not the vehicle for cybersecurity planning, which should be coordinated with federal and state agencies (Honolulu Harbor 2050 Master Plan). Subpart F is now the federal vehicle for regulated facilities; ISPI’s Honolulu Harbor single-port explainer sets out the physical single points of failure the cyber plan sits beside.

Three features of the rule bite harder on islands. Landlord ports and tenants must sort out who is the owner or operator for each regulated facility; the Coast Guard said it cannot make a blanket call and that responsibility depends on the specific agreements (Federal Register, Jan. 17, 2025). Port-wide programs do not substitute for facility plans; the Coast Guard expects them to work alongside each facility’s own plan, coordinated through Area Maritime Security Committees (Federal Register, Jan. 17, 2025). And small staffs carry the same duties as large ones: a 24-hour CySO, two drills and one exercise a year, an independent annual audit and documented vendor monitoring (33 CFR Part 101, Subpart F). One CySO may cover several facilities, which helps small operators share scarce cyber staff (33 CFR Part 101, Subpart F).

Funding is limited but exists. FEMA’s Port Security Grant Program funds state, local, territorial and private-sector maritime partners; FY 2026 funding was $95 million, with awards announced on Sept. 25, 2026 (FEMA PSGP). The final rule notes that FEMA listed cybersecurity as a key priority for FY 2024 and that the Coast Guard would work with FEMA to highlight cybersecurity in the program, while making no promise about future prioritization (Federal Register, Jan. 17, 2025).

The territories also depend on links the rule does not regulate. Undersea cables, satellite links and island power grids are not regulated by Subpart F as such, yet they carry or power the systems its measures protect; ISPI’s Pacific undersea cables explainer describes what happened when Tonga lost its cable. Resilience planning for regulated facilities should assume those outside links can fail at the same time as an on-site incident.

What it means for neighboring Pacific island governments

For the Freely Associated States and independent Pacific island countries, Subpart F does not apply: it covers U.S.-flagged vessels and U.S. MTSA facilities only (33 CFR Part 101, Subpart F). Their ports and flagged ships work under the IMO framework, where the cyber guidance takes the form of high-level recommendations for safeguarding shipping and resolution MSC.428(98) ties cyber risk to ship safety management systems (IMO). But their trade runs through the same carriers and hubs. Ships calling at U.S. ports face Port State Control scrutiny of cyber practice (USCG, July 16, 2025), and U.S.-flagged carriers serving the region must meet Subpart F on board (33 CFR Part 101, Subpart F).

That makes the rule a practical template. Its 14-section plan, its list of minimum measures and its consequence-based incident definition can be adapted by a small port authority without adopting U.S. law, and the CISA performance goals behind it are publicly available (CISA CPGs). ISPI’s free Cyber Continuity Checklist with a maritime annex, built on IMO guidance and Subpart F, is one way to run a first readiness check; it does not replace the rule for regulated facilities.

What this means for island and coastal governments

A cyber incident at a single-port island is a supply incident. Hawaiʻi’s own harbor plan recognizes cyber risk and hands the planning to federal and state agencies (Honolulu Harbor 2050 Master Plan); Subpart F now sets the federal floor for regulated facilities (33 CFR Part 101, Subpart F). Six practical steps follow:

• Map who owns which cyber duty at each regulated facility. Landlord-tenant responsibility depends on the specific agreements (Federal Register, Jan. 17, 2025). Port authorities should confirm in writing which entity designates each CySO before July 16, 2027.
• Check the training records now. The Jan. 12, 2026 deadline has passed and annual refreshers follow (33 CFR Part 101, Subpart F). Include contractors and part-time and temporary staff, as the rule requires.
• Treat the Cybersecurity Assessment as the start, not the paperwork. Waivers and equivalence requests can only follow a completed assessment (33 CFR Part 101, Subpart F), and the assessment is what identifies critical systems, including vendor-run ones.
• Write vendor clauses that match the rule. Vendors must report vulnerabilities and reportable incidents without delay, and remote connections must be monitored (33 CFR Part 101, Subpart F); MARAD’s crane advisory adds on-site updates and segmentation (MARAD Advisory 2026-014).
• Exercise the port and the government together. Facility exercises may be part of comprehensive port exercises (33 CFR Part 101, Subpart F). Island emergency managers should join them, using a continuity of operations guide for island local governments so that agencies keep working if the port’s systems go down.
• Plan for insiders as well as hackers. The CySO must understand behavioral signs of people likely to threaten security (33 CFR Part 101, Subpart F), and port staff with credentials sit inside every control; see the reporting on the inside threat at Fiji’s ports and ISPI’s Insider Threat Program Template.

The rule sets minimums; the Coast Guard quantifies its costs but describes its benefits qualitatively, not as a measured drop in incidents (Federal Register, Jan. 17, 2025). For island governments, Subpart F is best read as a minimum to build on, alongside the physical and route risks set out in ISPI’s guide to the maritime chokepoints island economies depend on and its analysis of single-port reliance in landlocked states.

Frequently asked questions

What is 33 CFR Part 101, Subpart F?

It is the U.S. Coast Guard regulation titled Cybersecurity, added by the final rule Cybersecurity in the Marine Transportation System (90 FR 6298, Jan. 17, 2025). It sets minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities and port facilities that must have a Maritime Transportation Security Act security plan. It took effect on July 16, 2025.

When must a Cybersecurity Plan be submitted?

No later than July 16, 2027. By the same date owners and operators must designate a Cybersecurity Officer and complete the first Cybersecurity Assessment. Approved plans are valid for five years.

Has the Coast Guard delayed the training or plan deadlines?

As of Nov. 9, 2026, ISPI found no Federal Register rule delaying them. The final rule asked for comment on a possible 2-to-5-year delay for U.S.-flagged vessels only, but the docket lists no later rule and the current regulatory text still shows Jan. 12, 2026 for training and July 16, 2027 for plan submission.

Where are maritime cyber incidents reported?

Reportable cyber incidents go to the National Response Center (1-800-424-8802) without delay. Under 33 CFR 6.16-1, evidence of an actual or threatened cyber incident involving a vessel, harbor, port or waterfront facility must also be reported to the FBI, CISA and the Captain of the Port; Coast Guard guidance says the FBI accepts National Response Center reports as meeting its notification requirement.

Does the rule apply to Pacific island countries or foreign ships?

No. It covers U.S.-flagged vessels and U.S. MTSA-regulated facilities, including those in Hawaiʻi, Guam, the Northern Mariana Islands and American Samoa. Foreign-flagged vessels are excluded, though the Coast Guard has said it will increase Port State Control scrutiny of their cyber practices. Other Pacific island governments can use the rule and IMO guidance as a model.

ISPI publishes its research free under CC BY 4.0. If your port authority, terminal operator or island government needs a Subpart F readiness review, a port cyber-and-continuity tabletop or an insider-risk assessment for credentialed port staff, you can commission research from ISPI. ISPI is a nonprofit organization with its 501(c)(3) application pending.

For related coverage, see Duty of Care for Island Resort Operators, What Is the Island Security Premium? Understanding ESG Risk in Pacific and Caribbean Island Operations and CM-15, ESG and Indigenous Community Relations in Hawaii.

Sources

1. U.S. Coast Guard, Cybersecurity in the Marine Transportation System, final rule, 90 FR 6298 (Federal Register, Jan. 17, 2025; docket USCG-2022-0802)
2. Federal Register API, documents in docket USCG-2022-0802 (checked Nov. 9, 2026)
3. eCFR, 33 CFR Part 101, Subpart F, Cybersecurity (current text; last amended July 16, 2025)
4. eCFR, 33 CFR 6.16-1, Reporting of sabotage, subversive activity, or an actual or threatened cyber incident
5. U.S. Coast Guard Maritime Commons, Final Rule implementation timeline (July 16, 2025)
6. U.S. Coast Guard Maritime Commons, Policy Letter 01-25 and NVIC 02-24 CH-1 (Nov. 26, 2025)
7. U.S. Coast Guard Maritime Commons, Cyber Awareness and Risk Management posts (June 16 to Oct. 20, 2026)
8. U.S. Coast Guard, Maritime Industry Cybersecurity Resource Center
9. U.S. Coast Guard, Navigation and Vessel Inspection Circulars index (lists NVIC 02-26)
10. U.S. Coast Guard Oceania District (Honolulu)
11. MARAD, U.S. Maritime Advisory 2026-014, Foreign Adversarial Technological, Physical, and Cyber Influence (effective Oct. 21, 2026)
12. CISA, Cross-Sector Cybersecurity Performance Goals 2.0
13. International Maritime Organization, Maritime cyber risk (MSC-FAL.1/Circ.3/Rev.4; MSC.428(98))
14. Hawaiʻi Department of Transportation, Harbors Division, Honolulu Harbor 2050 Master Plan, Volume I (final, November 2022) (PDF)
15. FEMA, Port Security Grant Program
← All CommentaryISPI Research Library →Commission Research →