NVIC 09-02: Area Maritime Security Committees and Plans guidance

NVIC 09-02 CH 6 Commandant US Coast Guard Stop 7618 United States Coast Guard 2703 Martin Luther King Jr Ave SE Washington, DC 20593-7618 Staff Symbol: CG-FAC Phone: (202) 372-1080 COMDTPUB P16700.4 JULY 20, 2023 NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 09-02, Change 6 Subj: GUIDELINES FOR THE AREA MARITIME SECURITY COMMITTEES AND AREA MARITIME SECURITY PLANS REQUIRED FOR U.S. PORTS Ref: (a) Maritime Transportation Security Act (MTSA) of 2002, Public Law (Pub. L.) 107-

(b) Security and Accountability for Every Port Act (SAFE Port Act) of 2006, Pub. L. 109- 347, as amended

(c) Coast Guard Authorization Act of 2010, Pub. L. 111-281

(d) Magnuson Act of 1950, 46 United States Code (U.S.C.) §§ 70051-70054

(e) Regulations Relating to the Safeguarding of Vessels, Harbors, Ports, and Waterfront Facilities of the United States, Executive Order 10173, as amended

(f) Ports and Waterways Safety Act (PWSA) of 1972, 46 U.S.C. §§ 70001-70036, Pub. L. 92-340

(g) Federal Aviation Administration (FAA) Reauthorization Act of 2018, Pub. L. 115-

(h) Navigation and Navigable Waters, Maritime Security: 33 Code of Federal Regulation (CFR) Parts 101-106

(i) Risk Management (RM), COMDTINST 3500.3 (series)

(j) Sensitive Security Information (SSI), DHS Management Directive 11056.1 (series)

(k) Sensitive Security Information (SSI) Handling Procedures, Navigation and Vessel Inspection Circular No. 10-04, COMDTPUB P16700.4 (series)

(l) Classified Information Management Program, COMDTINST M5510.23 (series)

(m) Physical Security and Force Protection Program, COMDTINST M5530.1 (series)

(n) Area Maritime Security Plan (AMSP) and Area Maritime Security (AMS) Assessment Development and Maintenance Process, COMDTINST 16601.28 (series) NVIC 09-02 CH 6

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — PURPOSE. The purpose of this Circular is to: (a) provide guidance to field

commanders, the maritime community, and Area Maritime Security Committee (AMSC) members on the development and maintenance of Area Maritime Security (AMS) Assessments and Area Maritime Security Plans (AMSPs); (b) provide guidance on the responsibilities of the Captain of the Port (COTP) acting as the Federal Maritime Security Coordinator (FMSC); (c) provide a common template for AMSPs; (d) address port security issues that are the shared responsibility of the port stakeholders and AMSCs; and (e) promote unity of effort among all stakeholders with maritime security interests at the port level.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — ACTION. COTPs will give the guidance in this Circular the widest dissemination to

the maritime community and AMSC members. COTPs, with the assistance of the AMSCs, should follow the guidance provided in Enclosures (1) through (7) regarding the development of AMS Assessments, and the development, review, exercising, and updating of AMSPs.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — AUTHORIZED RELEASE. This circular will be distributed by electronic means

only.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — DIRECTIVES AFFECTED. NVIC 9-02, Change 5 is cancelled and replaced by NVIC

09-02, Change 6.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — BACKGROUND. The MTSA required the Coast Guard to coordinate joint planning

for anti-terrorism efforts in the port environment to enhance deterrence and response to Transportation Security Incidents (TSIs) and maritime terrorism threats. The MTSA also required designation of both the geographic areas for which AMSPs were required to be prepared, and a Coast Guard official to serve as the FMSC for each area. AMSPs are required to be integrated with facility and vessel security plans (when required by MTSA), and adequate to deter a TSI when implemented in conjunction with the Department of Homeland Security (DHS) Transportation Systems Sector-Specific Plan. The SAFE Port Act expanded mandatory content of AMSPs to include a Salvage Response Plan (SRP) to ensure that waterways are cleared, and that commerce through the Nation’s ports is reestablished as efficiently and quickly as possible after a maritime TSI. The Coast Guard Authorization Act of 2010 further expanded mandatory content to include area response and recovery protocols to prepare for, respond to, and recover from a TSI. Reference (g) required incorporation of cyber risks into the AMSP. AMSP content requirements established by 33 CFR parts 101-103 include the requirements of References (a) through (g), for which maritime community engagement is essential.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — DISCUSSION.

a. The COTPs/FMSCs are responsible for establishing and maintaining AMSCs to provide advice regarding the development and maintenance of an AMSP for each COTP Zone and the Gulf of Mexico (GOM). MTSA-implementing regulations require that each AMSC use a risk-based approach to develop and NVIC 09-02 CH 6 maintain their AMS Assessment. AMSCs also develop methods to identify port infrastructure and operations, identify risks to the port, communicate threats involving terrorism to affected stakeholders, coordinate resources, and mitigate threats and consequences. Enclosure (1) provides guidelines for the AMSCs. b. The AMSPs and AMSCs are essential elements of the layered security of our Nation’s ports. Collaborative planning, coordination, open lines of communication, strong working relationships, and unity of effort are essential to provide an effective systems approach to preventing, detecting, responding to, and recovering from terrorist threats to the Marine Transportation System (MTS). c. Guidance for the development and maintenance of AMSPs is contained in Enclosure

(2) to this document. A standard template for AMSPs is included to assist COTPs/AMSCs in the development of AMSPs and is designed to meet the regulatory requirements contained in Reference (h).

(1) AMSPs developed by COTPs/AMSCs shall include protocols and procedures for the essential components of the plan, which include awareness, preparedness, prevention, security response, communications, and recovery coordination and procedures.

(2) The AMSP should also provide for facilitating the recovery of the MTS after a TSI and must include or incorporate by reference, a Salvage Response Plan (SRP) annex per Reference (b). AMSPs should provide linkages to recovery plans and be compatible across all forms of transportation disruptions, as defined by References (a) and (b), with special attention to MTS recovery and salvage response procedures.

(3) The COTP/FMSC and AMSCs contribute to the Maritime Common Operating Picture by providing decision makers with the situational awareness access to vital information needed to make informed decisions when planning and executing response and recovery operations. d. AMS Preparedness Stages.

(1) The first stage of the AMSP process begins with an Area Maritime Security (AMS) Assessment of the ports within the COTP Zone. Enclosure (3) describes the process, requirements, and skills needed by personnel to conduct the assessment, and it also discusses the role of the Maritime Security Risk Analysis Model (MSRAM) in supporting the assessment. Additional information regarding risk-based decision making is available in Reference (i). NVIC 09-02 CH 6

(2) The second stage of the preparedness process includes the planning and coordination needed among stakeholders to implement risk reduction strategies identified through the AMS Assessment.

(3) Subsequent stages in the preparedness cycle include exercise, evaluation, After Action Reports, identification of lessons learned, and AMSP adjustments. Enclosure (4) provides guidance on the AMS Training and Exercise Program. Recommendations on port security training are also included in Enclosure (4). However, training should be conducted throughout the stages of the preparedness process. e. AMSPs may contain Sensitive Security Information (SSI). Persons requiring access to a plan that contains SSI must submit a DHS Non- Disclosure Agreement (Tab A to Enclosure 2). Each plan containing SSI is required to be designated and marked as SSI in accordance with Reference (j). Paragraphs will be clearly marked to identify the security designation of information contained in each paragraph (SSI, For Official Use Only [FOUO], or Unclassified [U]). SSI information may be redacted from the AMSP in accordance with Reference (k). However, a redacted plan must also be marked as such in accordance with Reference (k). The redacted AMSP may be shared with the port community consistent with access regulations applicable to its remaining content. Therefore, if a redacted AMSP contains information designated as FOUO then applicable access requirements apply. Additional guidance is provided in References (l) and

(m). f. Protected Critical Infrastructure Information (PCII). PCII, as defined in the Homeland Security Act (6 U.S.C. § 671(3) and § 212(3)), may be important or essential to planning the recovery of maritime Critical Infrastructure/Key Resources. Access to PCII will be limited to the purpose for which it was obtained and voluntarily provided by owners of such material. Access to, use of, and safeguarding PCII will be done in strict accordance with the requirements of 6 CFR part 29. PCII will not be included in the AMSP and will be maintained and safeguarded separately. g. AMSP content is derived from specific statutory and regulatory requirements and discretionary authority available to the Coast Guard. AMSPs should not be expanded to include emerging issues without the concurrence of the AMSP program manager in the Office of Port and Facility Compliance (CG- FAC) at Coast Guard Headquarters, in coordination with Coast Guard District and Area Commands. However, emerging initiatives often involve a level of detail or location-specific issues that are more appropriately addressed by COTPs/AMSCs through the development of job aids (e.g., quick response cards and templates for tactical operations), best practices/lessons learned (learned through exercises and training), etc. Such materials may be incorporated by reference in AMSPs where appropriate to NVIC 09-02 CH 6 AMS content requirements described in Enclosure (2).

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — DISCLAIMER. This guidance is not a substitute for applicable legal

requirements, nor is itself a rule. It is not intended to, nor does it impose legally binding requirements on any party. It represents the Coast Guard's current thinking on this topic and may assist industry, mariners, the general public, and the Coast Guard, as well as other federal and state regulators, in applying statutory and regulatory requirements. You can use an alternative approach for complying with these requirements if the approach satisfies the requirements of the applicable statutes and regulations. If you want to discuss an alternative approach (you are not required to do so), you may contact CG-FAC, which is responsible for implementing this guidance.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — MAJOR CHANGES. Change 6 provides updated guidance to comply with References

(a) through (c) and (g). As a result, Enclosures (1) through (7) were revised accordingly. Enclosures (1), (3), (4), (5) and (7) include minor verbiage, grammatical, or formatting updates. Enclosure (2) had substantial updates, especially in sections 4000, 5000, and 6000. Enclosure (6), the Salvage Response Plan (SRP) Template was completely updated to meet the needs of both the AMSP and the Area Contingency Plan. Additionally, Enclosure (5) is now a required annex to include in the AMSP.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — SCOPE AND AUTHORITIES. It is recommended the reader become familiar with

the directives and publications noted throughout this preface and are listed in the references section.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — ENVIRONMENTAL ASPECT AND IMPACT CONSIDERATIONS. The

development of this NVIC and the general policies contained within it have been thoroughly reviewed by the originating office in conjunction with the Office of Environmental Management, Commandant (CG-47). This NVIC will not result in any substantial change to existing environmental conditions or violation of any applicable federal, state, or local laws relating to the protection of the environment. It is the responsibility of the action proponent to evaluate all future specific actions resulting from this policy for compliance with the National Environmental Policy Act (NEPA), other applicable environmental requirements, and the U.S. Coast Guard Environmental Planning Policy, COMDTINST 5090.1 (series).

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — DISTRIBUTION. No paper distribution will be made of this NVIC. An

electronic version will be located on the following Commandant web site: http://www.dco.uscg.mil/Our-Organization/NVIC/Year/2000/#2002

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — RECORDS MANAGEMENT CONSIDERATIONS. This non-directive

guidance does not have any significant or substantial change to existing records management requirements as per guidance located in the Records Resource Center https://uscg.sharepoint-mil.us/sites/cg61/SitePages/CG-611-Records- Retention.aspx?Mode=Edit. NVIC 09-02 CH 6

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — IMPLEMENTATION.

a. Coast Guard Area and District Commanders will work with COTPs/FMSCs to establish scalable port security measures based upon input received from the AMSCs. These measures may include Regulated Navigation Areas with a port security component, security zones, or other combinations of regulations issued under 33 CFR part 165. When implemented, these enhanced port security measures could address security threats within a port area used to deter a TSI. They could also compliment an increased posture needed when Maritime Security (MARSEC) Levels are raised. However, at no time will these security measures prevent a COTP/FMSC from taking more extensive measures, pursuant to existing authority, within their port in times of national emergency or imminent attack. b. COTP/FMSC Responsibility.

(1) Each COTP/FMSC will use the enclosed guidelines to develop and maintain an AMSP and an associated AMS Assessment and exercise program that conforms to the requirements contained in 33 CFR part 103 and Reference (a). These plans may include State and local Urban Areas Security Initiative Emergency Operations Plans, and other geographic sub-plans as annexes as long as the entire COTP Zone is covered. Where a region wide AMSP has been established and major sub-areas are addressed using AMSC regional subcommittees, ensure these geographically defined areas are included as annexes to the Plan.

(2) Separate AMSPs may be prepared for individual ports when there are compelling reasons, subject to the concurrence of the AMSP Approving Authority.

(3) COTPs/FMSCs will use MSRAM as part of the assessment tool to support the development of AMS Assessments as described in Enclosure (3).

(4) Ensure PCII is not contained within the AMSP and is safeguarded separately.

(5) AMSPs will be submitted by the COTP/FMSC in an electronic format to their District Commander for review in accordance with the Plan Review Authority’s direction and Reference (n).

(6) COTP/FMSC will upload approved AMSPs in the appropriate HOMEPORT “Sensitive but Unclassified” community as per Reference (n). NVIC 09-02 CH 6 c. District Commander Responsibility.

(1) District Commanders, working with the COTPs/FMSCs, will ensure timelines are met and provide any technical or drafting assistance needed.

(2) District Commanders will review all AMSPs* within their District based on the criteria found in Reference (n) and this Circular and forward the plans to the respective Area Commander for final approval. *The one exception to the district review is the GOM AMSP, which will be reviewed by LANTAREA. d. Area Commander Responsibility. Area Commanders will review and approve all AMSPs in accordance with the criteria found in Reference (n) and this Circular and inform Commandant (CG-FAC) when approved AMSPs are posted in HOMEPORT. e. Headquarters Responsibility.

(1) Commandant (CG-5P), the Office of Port and Facility Compliance

(CG-FAC), is responsible for policy and guidance governing AMS Assessments and AMSPs and will coordinate with Commandant (CG- 5R), the Office of Emergency Management and Disaster Response

(CG-OEM), to establish and review exercise policy and guidance. CG- FAC is also responsible for policy and guidance governing the oversight of AMSCs and MTS stabilization and recovery policy.

(2) The Office of International and Domestic Port Security (CG-PSA) is responsible for policy and guidance governing the use of the MSRAM, and the Port Security and Resiliency Assessment (PSRA) program.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — FORMS/REPORTS. None.

FORMS/REPORTS. None.

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — SECTION 508. This publication was created to adhere to Accessibility guidelines and

standards as promulgated by the U.S. Access Board. If changes are needed, please communicate with the Coast Guard Section 508 Program Management Office at Section.508@uscg.mil. NVIC 09-02 CH 6

Guidelines for the Area Maritime Security Committees and Area Maritime Security Plans Required for U.S. Ports — REQUEST FOR CHANGES. Requests for recommended changes to this NVIC

should be directed to CG-FAC at HQS-SMB-CG-FAC-1-AMSC@uscg.mil. W. R. Arguin Rear Admiral, U.S. Coast Guard Assistant Commandant for Prevention Policy Encl: (1) Guidance for Development and Maintenance of Area Maritime Security Committees (AMSC) (2) Guidance for Development and Maintenance of Area Maritime Security Plans (AMSP) (3) Area Maritime Security (AMS) Assessment (4) Area Maritime Security Exercise Program Guidance (5) Cybersecurity Risk Plan Template (6) Salvage Response Plan Template (7) Glossary of Terms and Definitions