NVIC 02-24: Reporting security breaches and cyber incidents

Commandant 2703 Martin Luther King Jr. Ave. SE United States Coast Guard Washington DC 20593-7318 Staff Symbol: CG-FAC NVIC 02-24 February 21, 2024 NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-24 Subj: REPORTING BREACHES OF SECURITY, SUSPICIOUS ACTIVITY, TRANSPORTATION SECURITY INCIDENTS, AND CYBER INCIDENTS Ref: (a) Title 33, Code of Federal Regulations, Subchapter H (Maritime Security) (b) 46 United States Code (USC) § 70103(c)(3)(A) (c) Title 33, Code of Federal Regulations, Part 6 (Protection and Security of Vessels, Harbors, Ports, and Waterfront Facilities (d) National Information Sharing Environment (ISE) for Suspicious Activity Reporting, Version 1.5 (ISE-FS-200) (e) Executive Order on Amending Regulations Relating to the Safeguarding of Vessels, Harbors, Ports, and Waterfront Facilities of the United States

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — PURPOSE. This Navigation and Vessel Inspection Circular (NVIC) provides guidance for

complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. The cyber incident guidance in this NVIC supports the reporting requirements in Part 6 of Title 33 of the Code of Federal Regulations (33 CFR Part 6) that applies to any vessel, harbor, port, or waterfront facility (hereafter referred to as MTS stakeholders). The BOS, SA, and TSI guidance in this NVIC supports the reporting requirements applicable to Maritime Transportation Security Act (MTSA)-regulated entities subject to 33 CFR Part 101.305.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — DISCLAIMER. This NVIC is intended only to provide clarity regarding existing

requirements under the law and regulation. It does not change any legal requirement and does not impose new requirements on the public. MTS stakeholders may use a different approach, if that approach satisfies applicable legal requirements (i.e., this NVIC does not represent a minimum requirement for compliance).

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — BACKGROUND.

a. Under MTSA and MTSA-implementing regulations, MTSA-regulated entities are required to report BOS, SA, and TSI to the Coast Guard. CG-5P Policy Letter 08-16 provided guidance as well as specific examples of BOS and SA, including those involving computer systems and networks, to help industry meet MTSA reporting requirements. b. On February 21, 2024, the Executive Order on Amending Regulations Relating to the Safeguarding of Vessels, Harbors, Ports, and Waterfront Facilities of the United States amended 33 CFR Part 6. Among other provisions, it added a definition for “cyber incident” and created a requirement to report evidence of an actual or threatened cyber NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-24 incident involving or endangering any vessel, harbor, port, or waterfront facility to the Coast Guard, the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA). The broad applicability of 33 CFR Part 6 and the new definition of a cyber incident created an overlap with existing MTSA reporting requirements. This NVIC provides clarification on the reporting requirements identified in 33 CFR Part 101 and 33 CFR Part 6.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — DIRECTIVES AFFECTED: CG-5P Policy Letter 08-16 is hereby cancelled.

DIRECTIVES AFFECTED: CG-5P Policy Letter 08-16 is hereby cancelled.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — ACTION. U.S. Coast Guard Captains of the Port (COTP), Area Maritime Security

Committees (AMSC), MTS stakeholders, and MTSA-regulated entities may use this guidance when considering BOS, SA, TSI, and cyber incident reporting.

This NVIC will be distributed by electronic means only.

It is available by accessing the Coast Guard Maritime Industry Cybersecurity Resource Center website. a.

An owner or operator of a vessel, facility, or Outer Continental Shelf (OCS) facility that is required to maintain an approved security plan in accordance with MTSA (i.e., MTSA-regulated entities) and its implementing regulations in 33 CFR Parts 104, 105, or 106 of Reference (a) shall, without delay, report activities that may result in a TSI to the National Response Center (NRC), including BOS or SA as required by 33 CFR Part 101.305.

The purpose of this requirement is to provide the Coast Guard opportunity to understand and respond to potential or actual threats to the port area upon receipt of an NRC report, and to assess the adequacy of security plans to prevent a TSI.

Additionally, IAW Reference (b), the security plan shall "be consistent with the requirements of the National Transportation Security Plan and Area Maritime Transportation Security Plans." The COTP will affirm consistency to help ensure alignment of BOS and SA communication procedures within FSPs throughout their area of responsibility. b.

Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility, including any data, information, network, program, system, or other digital infrastructure thereon or therein, shall be reported immediately to the FBI, CISA, and to the COTP, or to their respective representatives, in accordance with section 6.16-1 of Reference (c).

The purpose of this requirement is to provide the FBI, CISA, and Coast Guard the opportunity to understand and respond to potential or actual threats to the MTS upon receipt of a report, and determine appropriate actions. c.

The maritime industry continues to expand its use of networked technology, which creates efficiencies but also increases threats and vulnerabilities to MTS stakeholders and MTSA-regulated entities through telecommunications equipment, computers, and networks.

Due to the increasing reliance on telecommunications equipment, computers, and networked systems for controlling physical operations, a growing portion of all security risks has a network or computer nexus.

Maintaining the security of these systems, including reporting cyber incidents, is vital to maintaining the security of the MTS. d.

Plausible terrorist attack scenarios include combined cyber and physical incidents.

MTS stakeholders, including those that are MTSA-regulated, should consider this possibility when evaluating a security incident, including the possibility that a cyber incident is a NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-24 precursor to a physical attack, or that cyber related BOS and SA may be an attempt by actors to identify weaknesses or to plan for later attacks. e.

The target and intent of malicious cyber activity can be difficult to discern.

The fact that business and administrative systems may be connected to operational, industrial control and security systems further complicates this matter.

The Coast Guard strongly encourages MTS stakeholders to minimize, monitor, mitigate, and wherever possible, eliminate any such connections. f.

The U.S.

Coast Guard handles all reports of security incidents as Sensitive Security Information (SSI), in accordance with 49 CFR part 1520, which includes requirements for proper information marking and storage.

The information is therefore not subject to routine public disclosure.

The U.S.

Coast Guard will share the information with other agencies on a need to know basis and in accordance with applicable laws and policies.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — ENVIRONMENTAL ASPECT AND IMPACT CONSIDERATIONS.

a. The Office of Environmental Management, Commandant (CG-47) reviewed this NVIC and the general policies contained within, and determined that this policy falls under the Department of Homeland Security (DHS) categorical exclusion A3. This NVIC will not result in any substantial change to existing environmental conditions or violation of any applicable federal, state, or local laws relating to the protection of the environment. It is the responsibility of the action proponent to evaluate all future specific actions resulting from this policy for compliance with the National Environmental Policy Act (NEPA), other applicable environmental requirements, and the U.S. Coast Guard Environmental Planning Policy, COMDTINST 5090.1 (series). b. This NVIC will not have any of the following: significant cumulative impacts on the human environment; substantial controversy or substantial change to existing environmental conditions; or inconsistencies with any Federal, State, or local laws or administrative determinations relating to the environment. All future specific actions resulting from the general policy in this NVIC must be individually evaluated for compliance with the National Environmental Policy Act (NEPA), Department of Homeland Security (DHS) and Coast Guard NEPA policy, and compliance with all other applicable environmental mandates.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — RECORDS MANAGEMENT CONSIDERATIONS. This NVIC has been thoroughly

reviewed during the directives clearance process, and it has been determined there are no further records scheduling requirements, in accordance with Federal Records Act, 44 U.S.C. 3101 et seq., NARA requirements, and Information and Life Cycle Management Manual, COMDTINST M5212.12 (series). This policy does not create significant or substantial change to existing records management requirements.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — FORMS/REPORTS. None.

FORMS/REPORTS. None.

Guidance for complying with reporting requirements for Breaches of Security (BOS), Suspicious Activity (SA), Transportation Security Incidents (TSI), and Cyber Incidents. — DISCLAIMER. This policy is not a substitute for applicable legal requirements, nor is itself

a rule. It provides operational guidance for U.S. Coast Guard personnel and the maritime