NVIC 02-26: Cybersecurity implementation guidance for MTSA entities

NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26 Commandant 2703 Martin Luther King Jr. Ave. SE United States Coast Guard Washington DC 20593-7318 Staff Symbol: CG-5P NVIC 02-26 October 19, 2026 NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26 Subj: CYBERSECURITY REGULATIONS IMPLEMENTATION GUIDANCE FOR MARITIME TRANSPORTATION SECURITY ACT (MTSA) REGULATED ENTITIES Ref: (a) Title 33, Code of Federal Regulations (CFR), Part 101 Subpart F (b) 46 United States Code (USC) § 70103(c)(3)(A) (c) Title 33, Code of Federal Regulations, Part 6 (d) USCG Office of Maritime Cyber Policy (CG-MCP) Mission Management System (MMS) Work Instruction MCP-WI-002, Waiver and Equivalency Guidance for Requirements of 33 CFR Part 101, Subpart F - Cybersecurity (e) National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0, published February 26, 2024 (f) NIST Special Publication (SP) 800-53, Revision 5 (g) Navigation and Vessel Inspection Circular (NVIC) No. 02-24 (series) (h) Laid-up Inspected/Examined Vessels, CVC-WI-018(3) (i) CG-MCP MMS Work Instruction MCP-WI-003, DoD SAFE Instructions for Cybersecurity Plan, Cybersecurity Assessment, Waiver & Equivalency Request Submissions

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — PURPOSE. This NVIC provides information and guidance on the implementation of

cybersecurity regulations for MTSA-regulated entities. These regulations were published in the Federal Register on January 17, 2025 (90 FR 6298) and are available in Title 33, Code of Federal Regulations, Part 101 (33 CFR 101). This NVIC is also intended to clarify the regulatory text, aid the cyber risk management process for the maritime industry, and present the Coast Guard’s preferred means of complying with the subject regulations.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — DISCLAIMER.

a. This NVIC is intended only to provide clarity regarding existing requirements under the law. It does not change any legal requirements and does not impose new requirements on the public. Not all recommendations will apply to all entities, depending on individual operations, systems, equipment, or other factors. The Coast Guard recognizes that the entities comprising the Marine Transportation System (MTS) are varied in cybersecurity resources, programs, and overall/specific risks. Owners/operators may use a different approach that has greater or lesser complexity than this NVIC recommends, if that approach satisfies the applicable legal requirements. Entities are strongly encouraged to utilize best practices and industry standards, such as the NIST Cybersecurity Framework, and to mature their cybersecurity programs in a timely fashion to address evolving threats, vulnerabilities, and associated risks. NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26 b. Throughout this NVIC, “must”, “should”, and “may” are used purposefully. While the regulations set minimum requirements and are generally referenced by “must,” the guidance in “should” and “may” statements highlight recommended practices that are consistent with global cybersecurity standards.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — TIMELINE. On January 17, 2025, the Coast Guard updated its maritime security regulations

by establishing minimum cybersecurity requirements for U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities required to have a security plan under 33 CFR Parts 104, 105, and 106. The cybersecurity regulations came into effect on July 16, 2025, and are available in 33 CFR 101 Subpart F. MTSA regulated entities are required to operate in accordance with this regulation and their submitted Cybersecurity Plan (CSP) as of July 16, 2027.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — DIRECTIVES AFFECTED.

a. NVIC 01-20, Guidelines for Addressing Cyber Risks at MTSA Regulated Facilities, is cancelled, as it is superseded by this guidance reflecting updated cybersecurity requirements under 33 CFR Part 101, Subpart F. b. CG-5PC Policy Letter 01-25, Cybersecurity Training for Personnel with Access to Information Technology (IT) or Operational Technology (OT) Systems, dated October 9, 2025, remains in effect until July 16, 2027, at which point it will be cancelled as relevant contents are incorporated into Chapter 2.b of Enclosure (1) to this NVIC. c. CG-5PC Policy Letter 01-26, Cybersecurity Assessment Initial Scoping and Process, dated June 2, 2026, is cancelled as contents are incorporated into Enclosure (4) of this NVIC.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — DISCUSSION.

a. The Coast Guard’s oversight of cybersecurity within the MTS is rooted in performance- based evaluation, where inspectors confirm that entities have implemented security measures that reduce cyber risk and sustain operational resilience. The MTSA regulations remain focused on performance-based requirements, in which the expected standard of performance is set, and the exact method of compliance is left up to the owner/operator in consideration of varied business needs, operating environments, vulnerabilities, risk environment, and risk tolerance. For example, just as the original MTSA regulations do not specify that a facility must have a fence to achieve physical access control, the MTSA cybersecurity regulations do not require a specific method for conducting network credential management. Owner/operator intent alone is insufficient; performance can and should be validated through documentation and observable evidence of implementation, effectiveness, and risk management. This approach gives owners/operators the discretion to determine the internal details of how they will meet the regulatory standards in the most effective and efficient way for their organization. The Coast Guard will not specify any particular solutions or products to address the requirements. Restating the regulatory text in CSP sections can be helpful for organization and reference. However, because of the performance-based nature of many requirements, if this approach is used, owners/operators must ensure they are also documenting how they are specifically meeting each requirement in the CSP. NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26 b. In this NVIC, MTSA-regulated vessels, facilities, and OCS facilities will be referred to collectively as “entities” for brevity, and responsible parties will be collectively referred to as “owners/operators”; however, this does not change the specific responsibility designations in reference (a). If guidance is intended to apply to a particular subset of entities, it will be specifically identified. The Cybersecurity Plan developed under reference (a) will be referred to as “CSP.” The Cybersecurity Assessment will be referred to as “CSA.” Except where noted, this guidance will refer to the Vessel Security Plan

(VSP), Facility Security Plan (FSP), and Outer Continental Shelf Facility Security Plan

(OCS FSP) developed under 33 CFR 104, 105, or 106 collectively as “security plan.” c. The CSP serves as the foundational framework for an entity’s cybersecurity program. For entities newly embarking on formalizing their cybersecurity efforts, the CSP establishes baseline governance to structure and define their program. For entities with a mature cybersecurity governance program that exceeds the standards set by these regulations, the CSP may be a regulatory compliance document that cross-references existing cybersecurity practices to MTSA requirements. d. As the CSP is central to the compliance program and most security requirements in the regulations must be annotated within the CSP in some fashion, implementation guidance on various topics is organized according to the section of the CSP in which they would be included. This NVIC is a companion document to the regulations and is intended to augment rather than be used as a stand-alone compliance guide. Ultimately, owners/operators must ensure that all regulatory provisions are complied with in accordance with 33 CFR 101.620(a). Table 1 of Enclosure (1) provides a crosswalk of regulatory provisions to CSP sections to guide CSP development and ensure all regulatory provisions are covered in the CSP. e. For clarity, implementation guidance is developed as if the required provisions of reference

(a) are included in a CSP that is either a separate document or a standalone annex of the security plan. Owners/operators may include compliance information incorporated into the security plan as outlined in 33 CFR 101.630, and all provisions in this guidance still apply. While the CSP may be incorporated into an existing security plan, this does not mean that the CSP is expected to be less complex to develop or maintain than a separate document or an annex of the security plan. In general, the provisions outlined in these cybersecurity regulations are meant to reflect a similar depth and scope as the physical security provisions established by MTSA. f. MTSA-regulated owners/operators are encouraged to use the guidance provided in Enclosures 1-4 to develop and maintain a robust and resilient cybersecurity posture for their operations, as well as in preparation for cybersecurity-focused compliance inspections by Coast Guard personnel. Enclosures to this NVIC include Cybersecurity Plan Development and Maintenance Guidance, a Sample Cybersecurity Officer (CySO) Designation Letter, Penetration Testing Guidance, and Scoping and Assessment Guidance.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — ACTION. Captains of the Port (COTPs) and Officers in Charge, Marine Inspection (OCMIs)

are encouraged to bring this circular to the attention of maritime entities within their zones of responsibility. This NVIC will be distributed by electronic means only. It is located on the NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26 Coast Guard’s Navigation and Vessel Inspection Circular website and can also be accessed via the Coast Guard’s Maritime Industry Cybersecurity Resource Center.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — ENVIRONMENTAL ASPECT AND IMPACT CONSIDERATIONS. The Office of

Environmental Management, Commandant (CG-SHORE-V) reviewed this NVIC and the general policies contained within and determined that this policy falls under DHS categorical exclusion A3. This NVIC will not result in any substantial change to existing environmental conditions or violation of any applicable federal, state, or local laws relating to the protection of the environment. It is the responsibility of the action proponent to evaluate all future specific actions resulting from this policy for compliance with the National Environmental Policy Act (NEPA), other applicable environmental requirements, and the U.S. Coast Guard Environmental Planning Policy, COMDTINST 5090.1 (series).

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — RECORDS MANAGEMENT CONSIDERATIONS. Records created as a result of this

publication, regardless of format or media, must be managed in accordance with Records & Information Management Program Roles and Responsibilities, COMDTINST 5212.12 (series) and the records retention schedule location on the Records Resource Center Microsoft SharePoint site.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — FORMS/REPORTS. None. The U.S. Coast Guard handles all Sensitive Security Information

(SSI), in accordance with 49 CFR 1520, which includes requirements for proper information marking and storage. The information is therefore not subject to routine public disclosure. The U.S. Coast Guard will share the information with other agencies on a need-to-know basis and in accordance with applicable laws and policies.

Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities — QUESTIONS. Questions concerning this policy should be directed to the U.S. Coast Guard

Office of Maritime Cybersecurity Policy (CG-MCP) at MTSCyberRule@uscg.mil. Robert C. Compher Rear Admiral, U.S. Coast Guard Assistant Commandant for Prevention Policy Enclosure: (1) Cybersecurity Plan Development and Maintenance Guidance (2) Sample CySO Designation Letter (3) Penetration Testing Guidance (4) Scoping and Assessment Guidance NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26 Enclosures Enclosure (1) - Cybersecurity Plan Development and Maintenance Guidance .............................. 6 Enclosure (2) - Sample CySO Designation Letter ........................................................................ 48 Enclosure (3) - Penetration Testing Guidance .............................................................................. 52 Enclosure (4) - Scoping and Assessment Guidance ...................................................................... 55 Tables Table 1 - Regulatory provisions to CSP sections crosswalk ......................................................... 10 Table 2 - Example responsibility matrix for a landlord/tenant arrangement at a cruise terminal . 14 Table 3 - Personnel Training Requirements.................................................................................. 23 Table 4 - Cybersecurity Drill and Exercise Requirements............................................................ 25 Table 5 - Guidance for CSP Sections 7, 8, and 9 .......................................................................... 33 Table 6 - Compliance Purposes and Timelines ............................................................................. 38 Table 7 - Compliance Event Scenarios ......................................................................................... 38 Table 8 - CSA Process Guide....................................................................................................... 58 Figures Figure 1 - Compliance Flowchart .................................................................................................... 11 Figure 2 - Port with One FSP vs. Port with Individual FSPs ........................................................... 14 Figure 3 - Cyber Incident Response Lifecycle ................................................................................. 44 Figure 4 - Categorization of Network Assets and Systems.............................................................. 56 Figure 5 - CSA Risk Filtering Process ............................................................................................. 57