As cited
Copy frozen at (site build).
ot ics
US Coast Guard releases NVIC 02-26 to guide maritime operators on cybersecurity plans, IT and OT risk assessments
The U.S. Coast Guard issued Navigation and Vessel Inspection Circular (NVIC) 02-26 to establish cybersecurity compliance procedures for maritime operators, including requirements to designate a qualified Cybersecurity Officer, conduct risk assessments covering information technology (IT) and operational technology (OT) systems, and submit cybersecurity plans by July 16, 2027. The guidance applies to U.S.-flagged vessels, port facilities, and Outer Continental Shelf facilities under the Maritime Transportation Security Act (MTSA) and includes four enclosures with templates, penetration testing expectations, and an optional risk-filtering methodology based on the National Institute of Standards and Technology Cybersecurity Framework. The Coast Guard emphasizes a performance-based approach, allowing operators flexibility in how they meet requirements based on their operational environments and risk profiles rather than mandating specific products or solutions.
Why it matters: Maritime operators and facility owners regulated under the MTSA must now formalize cybersecurity governance and submit compliance documentation to the Coast Guard by July 16, 2027, or face regulatory enforcement; practitioners should begin planning cybersecurity assessments, officer designations, and plan development immediately to meet the deadline.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ot ics
US Coast Guard releases NVIC 02-26 to guide maritime operators on cybersecurity plans, IT and OT risk assessments
The U.S. Coast Guard released NVIC 02-26, guidance for maritime operators to comply with federal cybersecurity rules under the Maritime Transportation Security Act. The circular requires U.S.-flagged vessels, ports, and offshore facilities to designate a Cybersecurity Officer, conduct risk assessments, and submit cybersecurity plans by July 16, 2027, using a performance-based approach that allows operators flexibility in how they meet standards. The guidance includes templates, penetration testing expectations, and an optional risk-filtering methodology based on the National Institute of Standards and Technology Cybersecurity Framework to identify critical information technology and operational technology systems.
Why it matters: Maritime operators subject to MTSA regulations must establish governance and documentation to meet the July 16, 2027 deadline, or face Coast Guard compliance inspections; vendors supporting these entities should understand the assessment and planning requirements their clients will undertake.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ot ics
US Coast Guard releases NVIC 02-26 to guide maritime operators on cybersecurity plans, IT and OT risk assessments
The U.S. Coast Guard released NVIC 02-26, regulatory guidance requiring maritime operators of U.S.-flagged vessels and port facilities to designate a cybersecurity officer, conduct risk assessments for information technology (IT) and operational technology (OT) systems, and submit formal cybersecurity plans by July 16, 2027. The circular provides four supporting enclosures with templates, methodology for scoping critical systems, and expectations for penetration testing during five-year renewal cycles. The Coast Guard emphasized a performance-based compliance model where operators choose implementation methods suited to their environments rather than prescribing specific technologies or products.
Why it matters: Maritime facility operators and vessel owners subject to Maritime Transportation Security Act regulations must begin formalizing cybersecurity governance now to meet the July 16, 2027 submission deadline; practitioners should review the risk-filtering methodology and assess IT-OT interdependencies to scope compliance effort.
- Source published
- First seen by Cybersecurity Tracker