United StatesCoast Guard Cybersecurity in the Marine Transportation System: reportable cyber incidents
Coast Guard reportable cyber incident reporting, 33 CFR 101.620(b)(7) and 101.615
In force since .
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it owns or operates a U.S.-flagged vessel, a facility or an Outer Continental Shelf facility that is required to have a security plan under 33 CFR parts 104, 105 or 106; it does not apply to foreign-flagged vessels subject to 33 CFR part 104. Declare operates_essential_service where that holds, since the Coast Guard sets these requirements to safeguard the security and resilience of the Marine Transportation System.
- If your organization has not reported to the Coast Guard pursuant to, and is not subject to, 33 CFR 6.16-1, ensure all reportable cyber incidents are reported to the National Response Center.
- Treat as a reportable cyber incident an incident that leads to or, if still under investigation, could reasonably lead to a substantial loss of confidentiality, integrity, or availability of a covered information system, network, or OT system, a disruption or significant adverse impact on your ability to engage in business operations or deliver goods or services, disclosure or unauthorized access to nonpublic personal information of a significant number of individuals, other potential operational disruption to critical infrastructure systems or assets, or an incident that otherwise may lead to a transportation security incident.
- Have the Cybersecurity Officer ensure all reportable cyber incidents are recorded and reported to the owner or operator, and include cyber incident reporting procedures in the Cybersecurity Plan.
- Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
These lines are LexLint's reading of the law's text, as of .
What this law does
For entities that have not reported to the Coast Guard pursuant to, or are not subject to, 33 CFR 6.16-1, the owner or operator must ensure all reportable cyber incidents are reported to the National Response Center.
A reportable cyber incident is an incident that leads to or, if still under investigation, could reasonably lead to a substantial loss of confidentiality, integrity, or availability of a covered information system, network, or OT system, a disruption or significant adverse impact on the reporting entity's ability to engage in business operations or deliver goods or services, disclosure or unauthorized access to nonpublic personal information of a significant number of individuals, other potential operational disruption to critical infrastructure systems or assets, or incidents that otherwise may lead to a transportation security incident.
The Cybersecurity Officer must ensure all reportable cyber incidents are recorded and reported to the owner or operator. The Cybersecurity Plan must contain cyber incident reporting procedures in accordance with part 101.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility shall be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives. The Coast Guard's final rule on cybersecurity in the Marine Transportation System is effective .
When LexLint raises it
When your app profile says your app runs an essential service.