United StatesCoast Guard Cybersecurity in the Marine Transportation System: cybersecurity plan and measures
Coast Guard Cybersecurity in the Marine Transportation System, 33 CFR 101.600 to 101.650
In force since .
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it owns or operates a U.S.-flagged vessel, a facility or an Outer Continental Shelf facility that is required to have a security plan under 33 CFR parts 104, 105 or 106; it does not apply to foreign-flagged vessels subject to 33 CFR part 104. Declare operates_essential_service where that holds, since the Coast Guard sets these requirements to safeguard the security and resilience of the Marine Transportation System.
- Ensure a Cybersecurity Plan is developed, approved, and maintained, and submit it for review and approval to the cognizant Captain of the Port, Officer in Charge, Marine Inspections or Marine Safety Center; the plan is sensitive security information.
- Designate in writing, by name and by title, a Cybersecurity Officer who is accessible to the Coast Guard 24 hours a day, 7 days a week.
- Ensure the development, approval, and execution of a Cyber Incident Response Plan, and have the Cybersecurity Officer ensure an audit of the Cybersecurity Plan and its implementation is performed annually, beginning no later than 1 year from the initial date of approval.
- Ensure that multifactor authentication is implemented on password-protected IT systems and remotely accessible OT systems, and when it is not feasible, that appropriate compensating security controls are implemented and documented.
- Ensure all personnel with access to the IT or OT systems, including contractors, have cybersecurity training, and ensure cybersecurity drills are conducted at least twice each calendar year.
These lines are LexLint's reading of the law's text, as of .
What this law does
This subpart applies to the owners and operators of U.S.-flagged vessels, facilities, and OCS facilities required to have a security plan under 33 CFR parts 104, 105, and 106. For each U.S.-flagged vessel, facility, or OCS facility, the owner or operator must ensure a Cybersecurity Plan is developed, approved, and maintained. The owner or operator must designate, in writing, by name and by title, a Cybersecurity Officer who is accessible to the Coast Guard 24 hours a day, 7 days a week.
The owner or operator must ensure the development, approval, and execution of the Cyber Incident Response Plan. Each owner or operator must submit one copy of their Cybersecurity Plan for review and approval to the cognizant Captain of the Port or Officer in Charge, Marine Inspections for a facility or OCS facility, or to the Marine Safety Center for a U.S.-flagged vessel.
The Cybersecurity Officer must ensure that an audit of the Cybersecurity Plan and its implementation is performed annually, beginning no later than 1 year from the initial date of approval. Multifactor authentication must be implemented on password-protected IT and remotely accessible OT systems, and when it is not feasible, appropriate compensating security controls must be implemented and documented.
All personnel with access to the IT or OT systems, including contractors, whether part-time, full-time, temporary, or permanent, must have cybersecurity training. The Cybersecurity Officer must ensure that cybersecurity drills are conducted at least twice each calendar year. The Coast Guard's final rule on cybersecurity in the Marine Transportation System is effective .
When LexLint raises it
When your app profile says your app runs an essential service.