Review - HR 7625 Introduced – CG as SRMA

 Back in February, Rep McDowell (R,NC) introduced HR 7625, the Marine Transportation System Cybersecurity Budget and Evaluation Report (MTS CYBER) Act of 2026. The bill would require the GAO to assess the budget and capabilities of the Coast Guard as a Sector Risk Management Agency (SRMA) to ensure it can fulfill responsibilities for protecting the MTS against cyber threats. No new funding is authorized. 

Moving Forward  

Both McDowell, and his sole cosponsor {Rep Begich (R,AK)}, are members of the House Transportation and Infrastructure Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see the bill considered in Committee. Since this is a study-report bill, I see nothing in the bill that would engender any organized opposition. I would expect the bill to receive a certain measure of bipartisan support. Whether that support would be sufficient to see the bill move to the floor of the House under the suspension of the rules process remains to be seen. This bill is not politically important enough to move to the floor under a rule. 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-7625-introduced-cg-as-srma - subscription required. 

Review – OMB Approves New CG Cybersecurity ICR

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a new information collection request from the DHS’ Coast Guard on “Cybersecurity Plans”. This ICR supports the requirements of the final rule on “Cybersecurity in the Marine Transportation System” that was published on January 17^th, 2025. The table below shows the approved burden estimate for that ICR.

The final rule had an effective date of July 16^th, 2025. With the approval of this ICR, the administrative requirements allowing for the collection of the security plan information have been met.

 

For more details about the ICR, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/omb-approves-new-cg-cybersecurity - subscription required.

CG Homeport Issues

I do not get around to the Coast Guard’s Homeport website very often, it is old and not very internet friendly. But imagine my surprise when I saw the following notice at https://www.uscg.mil/Homeport/ today:

The Coast Guard Homeport Internet Portal platform will be decommissioned on 12 April 2025. You will need to use alternate approaches for tasks typically performed through the Homeport platform.

We recognize that Homeport has long been a trusted tool for mariners and the broader maritime community. The Coast Guard is establishing temporary workarounds to ensure essential services remain accessible until we can identify the best permanent approach for each function.

The following pages will provide you with guidance on how to conduct activities previously done through Homeport.

The Coast Guard is responsible for maintaining both the physical and cyber security of our country’s maritime commerce system. The Homeport system is facing increasing costs and system obsolescence. As a result, it is no longer a viable tool for managing the many functions required to ensure the smooth and safe flow of vessel traffic.

The page goes on to provide email links for many of the basic services that were provided by Homeport. I suspect that this is part and parcel of the Trump Administration’s limiting of information sharing by the federal government, but there is still some truth in that notice. I hope that something good comes out of this as the Coast Guard stands up a more user-friendly version of their portal.

Review - CG Published Maritime Cybersecurity Final Rule

Last week, the Coast Guard published a final rule in the Federal Register (90 FR 6298-6453) on Cybersecurity in the Marine Transportation System. The notice of proposed rulemaking was published on February 22^nd, 2024 (see additional NPRM posts here and here – both removed from paywall). This rule updates the maritime security regulations by establishing minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities, and facilities subject to the Maritime Transportation Security Act of 2002 regulations.

In addition to the obligatory cybersecurity point-of-contact requirement, the final rule requires covered ships, platforms and facilities to have a cybersecurity plan that includes:

• Account security measures,

• Device security measures, and

• Data security measures,

Additionally, the final rule addresses,

• Cybersecurity training,

• Risk management,

• Supply chain issues,

• Resilience,

• Network segmentation, and

• Physical security.

Effective Date

The effective date for this final rule is July 16^th, 2025.

CG Sends Maritime Cybersecurity Final Rule to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the Coast Guard on “Cybersecurity in the Marine Transportation System”. The notice of proposed rulemaking (NPRM) was published [removed from paywall] on February 22^nd, 2024.

According to the 2024 Spring Unified Agenda entry for this rulemaking:

“The Coast Guard has published a proposed rule to update its maritime security regulations by adding regulations specifically focused on establishing minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities, and U.S. facilities subject to the Maritime Transportation Security Act of 2002 regulations.  This proposed rulemaking is part of an ongoing effort to address emerging cybersecurity risks and threats to maritime security by including additional security requirements to safeguard the marine transportation system.”

Coast Guard Publishes Notice of Availability of Chinese Crane MARSEC Directive – 11-19-24

Today the Coast Guard published a notice in the Federal Register (89 FR 91413-91414) announcing the availability of Maritime Security (MARSEC) Directive 105-5. That document, marked as Sensitive Security Information (SSI) under requirements of 33 CFR §101.405(a)(1), is not publicly available. This notice directs owners and operators of STS cranes manufactured by PRC companies to contact their local COTP or cognizant District Commander to acquire a copy of the Directive.

Today’s notice justifies the Directive by reporting that:

“STS cranes manufactured by PRC companies make up the largest share of the global ship-to-shore crane market and account for nearly 80% of the STS cranes at U.S. ports. By design, these cranes may be controlled, serviced, and programmed from remote locations, and those features potentially leave STS cranes manufactured by PRC companies vulnerable to exploitation, threatening the maritime elements of the national transportation system.”

As such the Coast Guard has issued MARSEC Directive 105-5 to extend and expand the requirements of MARSEC Directive 105-4 that was also announced by a similar Federal Register notice published on February 23^rd, 2024.

CG Publishes TWIC Reader Delay Final Rule – 10-31-24

Today, the Coast Guard published a final rule in the Federal Register (89 FR 86723-86739) on “TWIC--Reader Requirements; Second Delay of Effective Date”. This rulemaking extends the enforcement date for the TWIC Reader requirements for the three categories of facilities related to Certain Dangerous Cargo listed in 33 CFR §105.253(a) until May 8^th, 2029. The notice of proposed rulemaking was published on December 6^th, 2022. The effective date of this rule is December 2^nd, 2024.

The TWIC Reader rule was controversial from its first proposal. The preamble for this rule provides a lengthy review of the regulatory convolutions that the Coast Guard has gone through on the TWIC Reader requirements. One of the developments that has had the most impact on the two ‘delay rules’ is the Congressional mandate for the Coast Guard to commission an independent study reviewing the security value of the TWIC program. The Homeland Security Operational Analysis Center (HSOAC) delivered that analysis in July, 2022; a copy of that report will be posted in the docket for this rule. The CG continues to review that report.

OMB Approves CG Final Rule on 2nd Delay of TWIC Reader Implementation

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the Coast Guard’s final rule on “TWIC--Reader Requirements; Second Delay of Effective Date”. The rule was sent to OIRA on July 10^th, 2024. The notice of proposed rulemaking for this action was published on December 6^th, 2022. 

According to the Spring 2024 Unified Agenda entry for thisrulemaking:

“On August 23, 2016, the Coast Guard issued a final rule, requiring owners and operators of certain vessels and facilities regulated by the Coast Guard to conduct electronic inspections of Transportation Worker Identification Credentials (TWICs) as an access control measure (81 FR 57652).  On August 2, 2018, the TWIC Credential Accountability Act of 2018 was enacted.  It prohibited implementation of the 2016 rule until after the Coast Guard submitted a report reviewing the security value of the TWIC program.  On March 9, 2020, the Coast Guard published its first TWIC delay rule (85 FR 13493).  On December 6, 2022, the Coast Guard proposed to further delay portions of the 2016 final rule for three categories of facilities until May 8, 2026, or later depending on the outcome of the Homeland Security Operational Analysis Center (HSOAC) study and consideration of public comments.  On December 23, 2022, Congress enacted the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, which directs the Secretary not to implement the 2016 final rule for covered facilities before May 8, 2026.  On April 17, 2023, the Coast Guard published a conforming amendment rule that removed from the CFR earlier implementation dates for facilities covered by this legislation (88 FR 23349).  The Coast Guard plans to issue a final rule to respond to comments from the NPRM and address whether the implementation date should be set beyond May 8, 2026.”

CG Sends 2nd TWIC Reader Delay Final Rule to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs announced that it had received a final rule from the Coast Guard on TWIC--Reader Requirements; Second Delay of Effective Date. The notice of proposed rulemaking for this action was published on December 6^th, 2022.

According to the abstract for this rulemaking in the Spring 2024 Unified Agenda:

“On August 23, 2016, the Coast Guard issued a final rule, requiring owners and operators of certain vessels and facilities regulated by the Coast Guard to conduct electronic inspections of Transportation Worker Identification Credentials (TWICs) as an access control measure (81 FR 57652).  On August 2, 2018, the TWIC Credential Accountability Act of 2018 was enacted.  It prohibited implementation of the 2016 rule until after the Coast Guard submitted a report reviewing the security value of the TWIC program.  On March 9, 2020, the Coast Guard published its first TWIC delay rule (85 FR 13493).  On December 6, 2022, the Coast Guard proposed to further delay portions of the 2016 final rule for three categories of facilities until May 8, 2026, or later depending on the outcome of the Homeland Security Operational Analysis Center (HSOAC) study and consideration of public comments.  On December 23, 2022, Congress enacted the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, which directs the Secretary not to implement the 2016 final rule for covered facilities before May 8, 2026.  On April 17, 2023, the Coast Guard published a conforming amendment rule that removed from the CFR earlier implementation dates for facilities covered by this legislation (88 FR 23349).  The Coast Guard plans to issue a final rule to respond to comments from the NPRM and address whether the implementation date should be set beyond May 8, 2026.”

CG Publishes NMSAC Meeting Notice – 8-13-24

Yesterday, the Coast Guard published a meeting notice in the Federal Register (89 FR 56397-56398) for a two day meeting of the National Maritime Security Advisory Committee (NMSAC) on August 13^th, and 14^th, 2024. The meeting will be held in conjunction with the 11th Annual Maritime Security West Conference in San Diego, CA.

The agenda includes public discussion about the following open CG taskings for the Committee:

• Discussion of Task T-2023-01: Update of NVIC 03-03, “Implementation Guidance for the Regulations Mandated by the Maritime Transportation Security Act of 2002 for Facilities”,

• Discussion of Task T-2023-02: Active Shooter/Active Threat in the Maritime Environment,

• Discussion of Task T-2023-03: Unmanned Systems in the Maritime Environment, and

• Discussion of Committee Topic Out-Brief: Task T-2024-01: NPRM for Cybersecurity in the Marine Transportation System.

The virtual meeting will be open to the public, but pre-registration is required. To register contact Mr. Ryan Owens, Alternate Designated Federal Officer of the National Maritime Security Advisory Committee, telephone 202-302-6565 or via email at ryan.f.owens@uscg.mil. Written comments for consideration by the Committee may be submitted to Owens by August 9^th, 2024.

CG Report for 2023 Cyber Trends in Maritime Environment

I ran into an interesting article over on IndustrialCyber.co looking at the recently released report from the Coast Guard Cyber Command. That report, “2023 Cyber Trends and Insights in the Marine Environment Report”, takes a look at last years trends in maritime cybersecurity. It is a 60-page report with lots of detail, so it is well worth reading. And Anna Ribeiro’s article provides a good overview.

The report includes a fairly detailed discussion (pgs 16-20) about the techniques that Cyber Protection Team (CPT) members used to gain entry to systems during their cybersecurity assessments. Nothing really fancy, certainly no 0-day exploits; just solid application of cybersecurity knowledge.

The discussion about strengthening OT networks (pgs 24-28), while short is illuminative. The Cyber Command authors identify the “three common vulnerabilities present in almost every OT network” the CPT assessors looked at:

• Improperly segmented networks,

• End-of-life software, and

• Use of legacy protocols.

The OT hardening discussion then focuses on how to fix those issues first. Not a bad idea for any OT system.

The final thing I want to point out in the report is Appendix C, “Known Exploitable Vulnerabilities Detected on Cpt Missions”. This appendix lists the vulnerabilities found during CPT missions that are listed in CISA’s Known Exploited Vulnerability (KEV) Catalog. The number of KEV’s found is remarkably small, but that is more than made up for how old some of them are. The oldest KEV reported by the CPT’s in the wild is an “Apache HTTP Server-Side Request Forgery (SSRF)” - CVE-2012-1823. Even being over a decade old, the CG cyber personnel found two incidences of this vulnerability available for attack.

This is a unique look at cybersecurity in the wild, well worth the read even if you have nothing to do with the maritime domain. 

Review - CG Marine Cybersecurity NPRM – Cybersecurity Plan

Last week, the CG published a notice of proposed rulemaking for “Cybersecurity in the Marine Transportation System”. The proposed regulations would update the maritime security regulations by adding regulations specifically focused on establishing minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities, and U.S. facilities subject to the Maritime Transportation Security Act of 2002 regulations. This is part of a continuing series of posts on that rulemaking. The earlier posts included:

NPRM Introduction (short version),

Cybersecurity Officer (short version)

This post looks at the requirements for each vessel/facility to have a Cybersecurity Plan

Before the Cybersecurity Plan is started, each covered vessel or facility is required to conduct a Cybersecurity Assessment. The Cybersecurity Plan is then required to incorporate the results of that Cybersecurity Assessment as well as the cybersecurity measures outlined in the new Subpart F. The Cybersecurity Plan would be marked (and protected) as Sensitive Security Information. The proposed rule would require each Cybersecurity Plan to include 14 specific sections. Once the plan is completed it would be required to be submitted to the Coast Guard official responsible for approving the facility or vessel security plan under the Maritime Transportation Security Act. That official would then approve the plan, request additional information, or disapprove the plan.

Commentary

I am more than a little disappointed in the lack of detail about the requirements for the Cybersecurity Assessment. I understand that the Coast Guard was trying to write it general enough that it would apply to everyone, but would not unnecessarily burden anyone with unnecessary requirements. Unfortunately, there are some requirements that should have been included.

First and foremost is the absence of any requirement to define the cybersecurity systems that are to covered by the Cybersecurity Plan. Before any assessment can be made the system must be defined by listing all of the electronic components and defining how they are connected to each other and external communications systems, including the internet, perhaps to include a software bill of materials (SBOM) where available. Additionally, there needs to be a definition of how external communications to and from the system will be controlled or restricted, especially personally owned devices. To be sure, the controls of those communications would probably be included in the Cybersecurity Pan, but the communications nodes would have to be identified in the assessment.

For more details about the proposed regulatory requirements for Cybersecurity Plans, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cg-marine-cybersecurity-nprm-9c8 - subscription required.

Review - CG Marine Cybersecurity NPRM – Cybersecurity Officer

Yesterday, the CG published a notice of proposed rulemaking for “Cybersecurity in the Marine Transportation System”. The proposed regulations would update the maritime security regulations by adding regulations specifically focused on establishing minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities, and U.S. facilities subject to the Maritime Transportation Security Act of 2002 regulations. This is the second in a series of posts about the provisions of that rule.

Owner Responsibilities

Section 106.620 provides that the owner-operator of any covered vessel or facility has primary responsibility for the implementation of the requirements of this new Subpart F. One of the enumerated responsibilities §106.620(b) is the requirement to designate in writing the Cybersecurity Officer for each covered vessel of facility. Subparagraph (b)(3) requires that the CySO be “accessible to the Coast Guard 24 hours a day, 7 days a week”. It also requires that the appointment document specify how the CG can contact the CySO.

Cybersecurity Officer

Section 106.625 spells out the requirements and responsibilities of the Cybersecurity Officer. In the preamble to the rule, the CG notes that there is broad latitude on who may be appointed to this role. Paragraph (d) specifies the specific responsibilities of the CySO for ‘each vessel, facility, or OCS facility for which they are designated’. Paragraph (e) outlines the qualifications for Cybersecurity Officers.

 

For more details about the requirements for the Cybersecurity Office, see my article CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cg-marine-cybersecurity-nprm - subscription required.

Review - CG Publishes Marine Cybersecurity NPRM

Today, the Coast Guard published a notice of proposed rulemaking in the Federal Register (89 FR 13404-13514) on “Cybersecurity in the Marine Transportation System”. The proposed regulations would update the maritime security regulations by adding regulations specifically focused on establishing minimum cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf facilities, and U.S. facilities subject to the Maritime Transportation Security Act of 2002 regulations. The proposed changes would add a new Subpart F, Cybersecurity, to 33 CFR 101, Maritime Security.

Public Comments

The Coast Guard is soliciting public comments on the NPRM. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # USCG-2022-0802). Comments should be submitted by April 22^nd, 2024.

 

For more details about the provisions of the proposed rule, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/cg-publishes-marine-cybersecurity - subscription required.

OMB Approves CG Marine Cybersecurity NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) from the Coast Guard on “Cybersecurity in the Marine Transportation System”. The NPRM was submitted to the OIRA on November 13^th, 2023.

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“The Coast Guard proposes to update its maritime security regulations by adding cybersecurity requirements to existing Maritime Security regulations in 33 CFR part 101 et seq.  This proposed rulemaking is part of an ongoing effort to address emerging cybersecurity risks and threats to maritime security by including additional security requirements to safeguard the marine transportation system.”

We will probably see this rule published in the Federal Register next week.

Coast Guard Sends Cybersecurity NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) from the Coast Guard on “Cybersecurity in the Marine Transportation System”. According to the Spring 2023 Unified Agenda entry for this rulemaking:

“The Coast Guard proposes to update its maritime security regulations by adding cybersecurity requirements to existing Maritime Security regulations in 33 CFR part 101 et seq.  This proposed rulemaking is part of an ongoing effort to address emerging cybersecurity risks and threats to maritime security by including additional security requirements to safeguard the marine transportation system.”

It will be interesting to see how closely the requirements of this proposed rule track with the “Maritime Cybersecurity Assessment and Annex Guide (MCAAG)” guidance issued by the Coast Guard in January.

CG Announces NMSAC Meeting – August 2023

Today, the Coast Guard published a meeting notice in the Federal Register (88 FR 45435-45436) for a two-day meeting of the National Maritime Security Advisory Committee (NMSAC) on August 22^nd and 23^rd in Arlington, VA. The public is invited to attend either the actual meeting or the virtual version.

NOTE: The ‘HomePort’ NMSAC link (https://homeport.uscg.mil/NMSAC) in the notice is worthless. There is an imperceptible space between the ‘/’ and ‘NMSAC’ which generates extra characters and external links generally do not work on the CG’s ‘HomePort’ network. A search on the HomePort web page shows no entry for ‘NMSAC’ or ‘National Maritime Security Advisory Committee’.

Cybersecurity Update

During the first day of the meeting, the Committee will provide an update on Task T–2022–5: Working Group on Cybersecurity Information Sharing.

New NMSAC Tasks

Also on the first day, there will be a discussion of three new tasks that the Committee has been requested to consider:

• Task T–2023–1: Update of NVIC 03–03, “Implementation Guidance for the Regulations Mandated by the Maritime Transportation Security Act of 2002 for Facilities.” The MTSA regulations for facilities provide the basis for chemical facilities covered under that program being exempted from the CFATS regulation reporting requirements.

• Task T–2023–2: Active Shooter/Active Threat in the Maritime Environment

• Task T–2023–3: Unmanned Systems in the Maritime Environment

Public Comments

Personnel wishing to participate in the limited personal or virtual meeting need to register. You can register by contacting Ryan Owens at ryan.f.owens@uscg.mil by August 15^th, 2023. Personnel wishing to submit written comments on the above topics may do so by posting to the Federal eRulemaking Portal (www.regulations.gov; docket # USCG-2023-0396).

2-Day NMSAC Meeting – January 24th-25th

The Coast Guard published a meeting notice in today’s Federal Register (88 FR 1080-1081) for a two-day meeting of the National Maritime Security Advisory Committee (NMSAC) in Baton Rouge, LA on January 24^th and 25^th, 2023. The public may attend in either personal or virtual modes.

The agenda for the meeting includes:

• Discussion of Task T-2021-2: Provide input to support further development of the Maritime Cyber Risk Assessment Model,

• Discussion of Task T-2022-4: Transportation Worker Identification Credential (TWIC) Reader Program,

• Discussion of Task T-2022-5: Working Group on Cybersecurity Information Sharing, and

• Update on TSA programs to secure vessels and facilities from mass shooter events.

Registration is required. To register for either live or virtual attendance, contact Ryan Owens (Ryan.f.owens@uscg.mil) before January 22^nd. Personnel wishing to provide written comments on the agenda topics may do so via the Federal eRulemaking Portal (www.Regulations.gov, docket # USCG-2022-1001).

CG Publishes 2nd TWIC Reader Delay NPRM

Today the Coast Guard published a notice of proposed rulemaking (NPRM) in the Federal Register (87 FR 74563-74573) for “Transportation Worker Identification Credential (TWIC)--Reader  Requirements; Second Delay of Effective Date”. This rulemaking would extend the enforcement date for the TWIC Reader requirements for facilities the three categories of facilities related to Certain Dangerous Cargo listed in 33 CFR §105.253(a) until 2026 and Coast Guard is considering a further extension until 2029.

The Coast Guard is soliciting comments on the rulemaking. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov; Docket # USCG-2022-0052). Comments should be submitted by January 5^th, 2023.

Commentary

There will almost certainly be requests for extending this date because of the holidays. But the current TWIC Reader enforcement extension expires on May 23^rd and the Coast Guard will need time to review the comments and ‘formulate’ the final rule, so they will be reluctant to extend the comment date. Having said that, the OMB did approve the publication of this rulemaking (consistent with change) back on October 26^th. It took the Coasties an exceptionally long time to move from that approval to publication of the rule today. Much of that time could have been used to allow for more complete industry commentary.

OMB Approves 2nd TWIC Reader Delay NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a Coast Guard notice of proposed rulemaking (NPRM) on “TWIC--Reader Requirements; Second Delay of Effective Date”. This rule would extend the implementation delay of the TWIC reader requirements for facilities handling or receiving vessels carrying Certain Dangerous Cargo that was set in place in the 2020 TWIC reader rulemaking.

There are three categories of facilities related to CDC issues for the purposes of the TWIC reader requirements outlined in 33 CFR 105.253(a). These facilities are currently slated to be required to implement the TWIC reader requirements on May 8^th, 2023. The Coast Guard is still waiting for the congressionally mandated review of those requirements. That study by the Homeland Security Operational Analysis Center (HSOAC), once published, will have to be subject to public review and comments before the TWIC reader requirement can be implemented at these facilities. This new rulemaking would extend the current exemption through 2026 to allow that process to continue.

The Coast Guard will probably publish this rulemaking later this week.