The associations, credentials and committees that matter for the Coast Guard cyber rule — and the ones that don't

The Coast Guard's cyber rule dropped a new obligation into an industry that already runs on associations, third-party auditors and advisory committees. Most operators know the Sub M landscape cold. Fewer know which of those bodies has anything to do with the cyber rule, which ones have nothing to do with it, and what to make of the letters after a vendor's name. This is the map.

One fact frames everything that follows: the rule creates no certification. There is no certified Cybersecurity Officer, no certified plan, no certified vendor. The CySO needs no license — the qualification standard in §101.625 is knowledge gained "through training or equivalent job experience." Plans are approved by the Coast Guard, never certified. Anyone who tells you otherwise is selling the word, not the thing.

The Coast Guard itself

Start at the source. The Maritime Industry Cybersecurity Resource Center at uscg.mil/maritimecyber is where every rule-support document lives: the assessment method (Policy Letter 01-26), the training policy (01-25), the waiver and equivalency guidance (MCP-WI-002), the submission instructions (MCP-WI-003), the small-business assessment guide, and the two Small Entity Compliance Guides. Maritime Commons, the Coast Guard's blog, is where posture changes are announced — it is where the June 2026 "hold your plan submissions" notice appeared. Read it monthly.

Two programs worth knowing. Coast Guard Cyber Command's Cyber Protection Teams conduct assessment and threat-hunt missions with Marine Transportation System partners on request, and their annual Cyber Trends and Insights in the Marine Environment report is the best public data on what attacks on this industry actually look like. And CISA's no-cost services — including a free vulnerability-scanning subscription — are listed by name in the Coast Guard's own small-business assessment guide as acceptable tools for the assessment.

The trade associations

American Waterways Operators (AWO)

The tugboat, towboat and barge industry's national association. If you operate boats you are probably already a carrier member, and your Responsible Carrier Program — the Coast Guard-accepted safety management system, audited by third parties — is the machinery your cyber program will ride on.

What AWO has done on cyber: a Cyber Risk Management: Best Practices for the Towing Industry document produced with the Coast Guard through their Safety Partnership, and a January 2026 Cybersecurity Training Outline to help members meet §101.650(d) themselves or choose a third-party course. AWO's member letters tracked the training-verification job aid inspectors now use. It does not endorse vendors. What it does is put every serious safety VP and port captain in the same room twice a year at the Safety Committee meetings — and carry the industry's voice to the Coast Guard when the rule needs clarifying.

Use it for: the best-practices document, the training outline, and the committee rooms.

Inland Rivers, Ports & Terminals (IRPT)

The association of river ports, terminal operators, carriers and shippers — several hundred members across the inland system. IRPT has been forwarding Coast Guard and CISA cyber advisories to members and has said it will keep doing so. Its annual conference is in September. Corporate membership is published at $825 a year.

Use it for: staying current if you run a terminal, and meeting the other terminal operators who are three months further into this than you are.

International Liquid Terminals Association (ILTA)

If your dock handles liquid bulk, this is your association, and your facility is almost certainly an MTSA-regulated one — which puts you in the cyber rule's scope on the facility side regardless of what your boats do. The annual operating conference is in Houston each summer.

Gulf Intracoastal Canal Association (GICA)

The GIWW's association, 150-plus members, with an annual seminar in New Orleans each August. Run by a retired Coast Guard captain who was the Eighth District's Chief of Prevention and later a towing company's compliance VP — exactly the person who can tell you how the Coast Guard will read this rule on the Gulf.

The Propeller Clubs

Local chapters in every port city. Not a compliance body — a social one. Mentioned here because it is where the conversation about who is doing what on cyber actually happens, over lunch.

The third-party organizations (TPOs)

If you are on the Subchapter M TSMS option, a Coast Guard-approved Third-Party Organization under 46 CFR part 139 already audits your safety management system. The largest inland TPO is the Towing Vessel Inspection Bureau (TVIB), a nonprofit that also certifies the auditors and surveyors themselves; Sabine Surveyors and Rushing Marine Service are among the others with deep inland benches.

Why this matters for cyber: §101.630(f) requires an annual audit of your Cybersecurity Plan by someone independent of the measures being audited — someone with no regular cybersecurity duties for your boats. The Sub M world has run on exactly that structure for a decade. Expect your TPO relationship to be where the cyber audit eventually lives, and expect your TPO auditor to be the first person who asks to see your training records, because the Coast Guard's inspectors now do.

Use it for: the auditor-independence requirement, and the inspection-readiness habit you already have.

The committees — where the rule gets interpreted

Area Maritime Security Committees (AMSC)

Every Coast Guard sector has one — Sector Ohio Valley, Sector Lower Mississippi River, Sector New Orleans, Sector Houston-Galveston. They are statutory bodies (46 U.S.C. 70112, 33 CFR 103.305), chaired by the Captain of the Port, and their members serve unpaid five-year terms after a background check. Over thirty of them now run cybersecurity subcommittees.

This is the single most valuable room in the system, and it is free. The sector's prevention staff, the port's terminal security officers, and the operators who take this seriously are all at the table. Membership is by application to the sector and is slow; the open portions of meetings are attendable now.

Marine Compliance Alliance

A Paducah-born professional association of roughly 150 inland compliance managers — the people inside towing companies who will actually own the Cybersecurity Plan. If you are one of them, this is your peer group.

National Towing Safety Advisory Committee (NTSAC)

The federal advisory committee that advises the Coast Guard on towing-vessel matters, eighteen seats across the industry. Worth knowing it exists because its public meetings are where the industry's formal comments on rules get shaped. As of this writing the committee is awaiting new appointments and has not met since 2024.

The cyber-specific bodies

MTS-ISAC

The Maritime Transportation System Information Sharing and Analysis Center — the maritime sector's threat-sharing body, a member of the National Council of ISACs since 2020. It serves vessel operators, ports, terminals and the vendors that support them. For a small operator the practical value is the advisories; for anyone evaluating a vendor, membership is a reasonable signal that they take the sector's threat picture seriously.

IMCSO

The International Maritime Cyber Security Organisation, launched in 2024, maintains an authorised-supplier registry and practitioner certifications for maritime cyber specialists. Its bar is high — supplier listing requires ISO 27001 and ISO 9001 — and its center of gravity is international shipping. It is a meaningful credential if a vendor holds it; its absence means nothing for a firm built for brown water.

Credentials: what to look for when you hire help

Since the rule certifies nothing, the credentials that matter are the ones that predate it.

For the firm:

• SOC 2 Type 2 or ISO 27001 — evidence the firm runs its own security the way it will ask you to run yours, and that it can handle Sensitive Security Information properly. Your plan and assessment are SSI under 49 CFR 1520; ask how they will store them.
• A 24/7 incident-response bench. The CySO must be reachable by the Coast Guard around the clock. Ask who answers at two in the morning.
• Maritime experience, specifically. Ask what a towboat's wheelhouse network looks like. If the answer does not include Rose Point, Starlink and the engine dealer's telematics, they have not been aboard one.

For the people:

• CISSP or CISM — the standard security-leadership credentials; reasonable to expect on the CySO or the person backing them.
• GICSP — the industrial-control-systems credential; relevant if your terminal runs SCADA or automated transfer systems, less so for a towboat.
• Sub M auditor credentials (TVIB-certified auditor or surveyor) — the signal that someone understands how the Coast Guard inspects, which is worth more here than most cyber certificates.

Frameworks, not credentials: the Coast Guard's assessment method is grounded in NIST Cybersecurity Framework and NIST SP 800-30, with SP 800-82 for operational technology and IEC 62443 for industrial systems. A vendor who cites these is speaking the rule's language. A vendor who cites CMMC is speaking the defense industry's language, which is a different rule for different buyers.

Class-society cyber notations (ABS CyberSafety, DNV Cyber Secure) exist for ocean-going ships under IMO guidelines. They are not required under Subpart F and are largely irrelevant to an inland fleet. The same is true of IMO MSC.428(98) and the IACS UR E26/E27 requirements — blue-water instruments that do not reach the river.

The rooms worth your time this year

• International WorkBoat Show, New Orleans, December — the industry's largest gathering, with a compliance track. If you attend one event, attend this one.
• Inland Marine Expo, produced by The Waterways Journal, late spring — the inland show, where the Coast Guard's cyber policy staff have answered the "what does this cost me" question on stage.
• Marine Log's Tugs, Towboats & Barges, Mobile, spring — the 5-to-50-boat room.
• Your sector's AMSC — ongoing, free, and closer to the Coast Guard than any of the above.

What to actually do with this

Three moves, in order. Read AWO's best-practices document and training outline — they are written for you. Apply to your sector's AMSC, or at least attend the next open meeting. And when you evaluate anyone offering to write your plan, ask for the firm's SOC 2 or ISO 27001, the name of the person who answers the phone at night, and a description of a towboat's network. The associations tell you who belongs to the industry. Those three questions tell you who belongs on your boats.