The U.S. Coast Guard released Navigation and Vessel Inspection Circular (NVIC) 02-26 to help maritime organizations comply with federal cybersecurity regulations covering U.S.-flagged vessels, port facilities, and Outer Continental Shelf facilities regulated under the Maritime Transportation Security Act (MTSA). The guidance supports cybersecurity requirements under 33 CFR Part 101, Subpart F, established to help maritime operators identify cyber risks, mitigate threats and vulnerabilities, and respond to and recover from cybersecurity incidents affecting the Marine Transportation System.
The document outlines procedures for designating a qualified Cybersecurity Officer, conducting cybersecurity assessments and developing and submitting cybersecurity plans to the Coast Guard by July 16, 2027. Its four enclosures cover cybersecurity plan development and maintenance, a sample officer designation letter, penetration testing expectations for five-year renewal cycles, and an optional risk-filtering methodology based on the National Institute of Standards and Technology Cybersecurity Framework to identify critical IT and OT (operational technology) systems and assess their interdependencies.
The Coast Guard said regulated organizations are not required to hire third-party providers to conduct assessments or develop plans, and the performance-based approach lets owners and operators determine how to meet the requirements based on their operational environments and cybersecurity risks.
This NVIC provides practical resources for documenting Cybersecurity Officer (CySO) designations, conducting Cybersecurity Assessments (CSA), and developing Cybersecurity Plans (CSP), all to be completed and submitted to the Coast Guard no later than July 16, 2027. It serves as a key roadmap to help entities compile, format, and submit their completed CSPs for Coast Guard approval. The NVIC aims to support regulatory compliance while recognizing different operational environments and cybersecurity risks across the maritime industry. This NVIC follows previous guidance published by CG-MCP, which can be found along with other cybersecurity resources.
The Coast Guard will continue to identify, develop, and update guidance as needed to support stakeholders in compliance through their own efforts or in coordination with third-party providers. In alignment with existing maritime security standards, the Coast Guard’s cybersecurity requirements reflect a performance-based approach, in which the expected standard of performance is set, and the exact method of compliance is left up to the owner/operator in consideration of varied business needs, operating environments, vulnerabilities, risk environment, and risk tolerance.
NVIC 02-26 includes four enclosures to help owners and operators meet regulatory requirements. Enclosure (1), on Cybersecurity Plan Development and Maintenance, outlines the structure, content, and submission recommendations for CSPs, including section-by-section guidance aligned with the regulatory requirements. Enclosure (2) is a sample Cybersecurity Officer designation letter, which provides a template and guidance for documenting the designation of a qualified Cybersecurity Officer (CySO).
Enclosure (3) offers penetration testing guidance, detailing expectations for periodic testing conducted during five-year renewal cycles, including safety considerations for OT. Penetration testing is not required as part of the initial CSP submission due July 16, 2027. Enclosure (4), on scoping and assessment, presents an optional, structured ‘risk-filtering’ methodology based on the NIST Cybersecurity Framework, helping owners and operators scope their environment, identify critical IT and OT systems, and evaluate interdependencies.
The Coast Guard’s cybersecurity oversight within the Marine Transportation System (MTS) is based on performance-based evaluation, in which inspectors confirm that entities have put in place security measures that reduce cyber risk and sustain operational resilience. The MTSA regulations set the expected standard of performance but leave the exact method of compliance to the owner/operator, who can weigh business needs, operating environments, vulnerabilities, risk environment, and risk tolerance. Just as the original MTSA rules do not require a fence for physical access control, the cybersecurity rules do not mandate a specific method for network credential management.
The Coast Guard will not specify particular solutions or products. Owner/operator intent alone is insufficient: performance should be validated through documentation and observable evidence of implementation, effectiveness, and risk management. Restating regulatory text in CSP sections can help with organization and reference, but owners/operators who do so must also document how they are specifically meeting each requirement.
The CSP is the foundational framework for an entity’s cybersecurity program. For entities just beginning to formalize their efforts, it establishes baseline governance to structure and define the program. For entities with mature governance that exceeds the regulatory standards, it may serve as a compliance document that cross-references existing practices to MTSA requirements. Because the CSP is central to compliance, and most security requirements must be annotated within it in some form, implementation guidance is organized by the CSP section where it would appear.
The NVIC is a companion to the regulations, meant to augment rather than replace them as a stand-alone compliance guide, and owners/operators remain responsible for complying with all regulatory provisions. The guidance assumes the CSP is either a separate document or a standalone annex of the security plan, though owners/operators may incorporate compliance information into the security plan, and all provisions still apply. Incorporating the CSP into an existing security plan does not make it less complex to develop or maintain, since the cybersecurity provisions are meant to match the depth and scope of MTSA’s physical security provisions.
Owners/operators are encouraged to use Enclosures 1-4, which cover CSP development and maintenance, a sample Cybersecurity Officer (CySO) designation letter, penetration testing, and scoping and assessment, to build a robust and resilient cybersecurity posture and prepare for Coast Guard cybersecurity compliance inspections.
The document identified that Captains of the Port (COTPs) and Officers in Charge, Marine Inspection (OCMIs) must flag the circular to maritime entities within their zones of responsibility. The NVIC will be distributed by electronic means only. It is available on the Coast Guard’s Navigation and Vessel Inspection Circular website and can also be accessed through the Coast Guard’s Maritime Industry Cybersecurity Resource Center.
On environmental considerations, the Office of Environmental Management, Commandant (CG-SHORE-V), reviewed the NVIC and its general policies and determined that the policy falls under DHS categorical exclusion A3. The NVIC will not substantially change existing environmental conditions or violate any applicable federal, state, or local environmental protection laws. The action proponent is responsible for evaluating all future specific actions resulting from the policy for compliance with the National Environmental Policy Act (NEPA), other applicable environmental requirements, and the U.S. Coast Guard Environmental Planning Policy.
On records management, records created as a result of the publication, regardless of format or media, must be managed in accordance with the Records & Information Management Program Roles and Responsibilities and the records retention schedule on the Records Resource Center Microsoft SharePoint site.
Last month, the USCG announced that it established the Office of Maritime Cybersecurity Policy to serve as its central authority for cybersecurity policy across the Marine Transportation System (MTS), citing growing use of IT and OT systems in the maritime industry and the associated risks to critical infrastructure. Created under the Director of Inspections and Compliance, the office will develop and implement policies for cyber safety and security of ports, vessels and facilities, while directing a coordinated cybersecurity compliance and enforcement strategy and serving as the Coast Guard’s primary liaison with industry and government partners.
