NVIC 01-20: Cyber risk guidance for MTSA regulated facilities

Commandant 2703 Martin Luther King Jr. Ave U.S. Coast Guard Washington, DC 20593-7618 Staff Symbol: CG-FAC Phone: (202) 372-1107 COMDTPUB P16700.4 NVIC 01-20 February 26, 2020 NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 01-20 Subj: GUIDELINES FOR ADDRESSING CYBER RISKS AT MARITIME TRANSPORTATION SECURITY ACT (MTSA) REGULATED FACILITIES Ref: (a) Title 33 of the Code of Federal Regulations (CFR) Subchapter H, Maritime Security

Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA) Regulated Facilities — PURPOSE. This Navigation and Vessel Inspection Circular (NVIC) provides guidance to

facility owners and operators in complying with the requirements to assess, document, and address computer system or network vulnerabilities. In accordance with 33 CFR parts 105 and 106, which implement the Maritime Transportation Security Act (MTSA) of 2002 as codified in 46 U.S.C. Chapter 701, regulated facilities (including Outer Continental Shelf facilities) are required to assess and document vulnerabilities associated with their computer systems and networks in a Facility Security Assessment (FSA). If vulnerabilities are identified, the applicable sections of the Facility Security Plan (FSP) must address the vulnerabilities in accordance with 33 CFR 105.400 and 106.400.

Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA) Regulated Facilities — DISCLAIMER. This NVIC is intended only to provide clarity regarding existing

requirements under the law. It does not change any legal requirements, and does not impose new requirements on the public. Not all recommendations will apply to all facilities, depending on individual facility operations. Facility owners and operators may use a different approach that has greater or lesser complexity than this NVIC recommends, if that approach satisfies the applicable legal requirements (i.e., this NVIC does not represent a minimum requirement for compliance).

Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA) Regulated Facilities — ACTION.

a. Enclosure (1) provides a list of existing MTSA regulatory requirements that may apply once a facility owner or operator identifies computer system and/or network vulnerabilities in DISTRIBUTION - SDL No. 170 a b c d e f g h i j k l m n o p q r s t u v w x y z A B X X X X X X C X X D X X E X X X F G H X X NON-STANDARD DISTRIBUTION NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 01-20 the FSA. Enclosure (1) also explains how these requirements relate to cyber security measures, and which measures should be included in an FSP. This list is not exhaustive, but is intended to be an informative guide to updating FSAs and FSPs, taking into account computer system and network vulnerabilities, or cyber security vulnerabilities, as referred to in this NVIC. b. The Coast Guard also encourages facility owners and operators to apply the standards of National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (version 1.1, dated April 16, 2018) and NIST Special Publication 800-82 to improve a facility’s cyber posture. c. The focus of this NVIC is MTSA-regulated facilities only. This NVIC does not address cyber security vulnerabilities of vessels, ports in general, transportation sector facilities, or seaport systems.

Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA) Regulated Facilities — DIRECTIVES AFFECTED. None.

DIRECTIVES AFFECTED. None.

Guidelines for Addressing Cyber Risks at Maritime Transportation Security Act (MTSA) Regulated Facilities — BACKGROUND.

a. MTSA regulations in 33 CFR parts 105 and 106 provide general requirements for facility cyber security while allowing facility owners and operators the discretion to determine the details of how they will comply. These regulations also give the Coast Guard the authority to review for compliance and approve FSAs and FSPs. The result is that the owners and operators are responsible for assessing cyber security vulnerabilities and ensuring cyber security of their facilities with Coast Guard’s oversight and guidance. b. Although the MTSA regulations are mandatory for facility owners and operators, this NVIC does not contain any mandatory provisions. It constitutes voluntary guidance meant to assist the owners and operators of MTSA-regulated facilities in understanding and complying with the mandatory regulations. The NVIC reminds facility owners and operators that they must comply with the existing MTSA regulations related to computer systems and networks, but they have the discretion to determine how best to identify, assess, and address the vulnerabilities of their facility’s computer systems and networks. c. The maritime industry continues to increase its use of cyber technology. Facility operators use computers and cyber-dependent technologies for communications, engineering, cargo control, environmental control, access control, passenger and cargo screening, and many other purposes. Facility safety and security systems such as security monitoring, fire detection, and general alarm installations increasingly rely on computers and networks. d. Collectively, these technologies enable the Marine Transportation System to operate with an impressive record of efficiency and reliability. While these computer and network systems create benefits, they introduce new vulnerabilities that increase risk. Exploitation, misuse, disruption, or simple failure of cyber systems can cause injury or death, harm the marine environment, disrupt vital trade activity, and degrade the ability to respond to other emergencies.