Does the Coast Guard cyber rule apply to my towboats?
The rule reaches you through the security plans you already hold, not through how many computers you own. Here is the applicability gate in §101.605, the tank-barge line that decides most towing companies, and the three questions to answer honestly before you spend a dollar.
It is the first question on every readiness call, and it deserves a straight answer before anyone talks about assessments, plans or prices. The Coast Guard's cyber rule, 33 CFR Part 101 Subpart F, does not decide who it covers by counting computers. It decides by pointing at the maritime security plans you already hold under MTSA. If you hold one, you are in. If you hold none, you are not.
That sounds simple. For a towing company it is simple most of the time — and the exceptions are exactly where people get it wrong.
The gate is the security plan you already hold
§101.605 applies the subpart to owners and operators of three kinds of things:
- U.S.-flagged vessels that must carry a Vessel Security Plan under 33 CFR Part 104
- MTSA-regulated facilities under 33 CFR Part 105 — terminals handling dangerous cargoes, facilities serving foreign cargo vessels over 100 gross tons or vessels carrying 150 or more passengers, and barge fleeting areas handling bulk dangerous cargo
- Outer Continental Shelf facilities under 33 CFR Part 106
Foreign-flagged vessels are outside Subpart F. They still have to report cyber incidents as hazardous conditions under the amended 33 CFR 160.202, but that is a different obligation and not the subject here.
Everything in the rule — the Cybersecurity Officer, the assessment, the fourteen-section plan, the training, the drills — hangs on that gate. So the real question is not "does the cyber rule apply to us" but "which of our boats and docks already carry an MTSA security plan."
The tank-barge line
On the vessel side, the line for towing is the one you already know from your Vessel Security Plan. A towing vessel over 8 meters that tows Subchapter D or Subchapter O tank barges carries a VSP under Part 104 — and so it is inside the cyber rule. The Coast Guard's own analysis of the rule counted roughly 4,822 towing vessels in scope, belonging to about 1,686 owners.
If every barge you push is dry cargo — grain, coal, aggregate, steel — your boats may well be outside the vessel side of the rule. That is a legitimate answer, and we will give it to you when it is true.
But it is only half the test.
The dock that pulls you back in
The second half is the facility side. A fleeting area that handles bulk dangerous cargo is an MTSA facility under Part 105. So is a dock or terminal that handles dangerous cargoes, and so are the liquid terminals most tank-barge tows are going to and from. If your company operates one — and many dry-cargo towing companies also run a fleet or a dock that does — the facility is in scope on its own, regardless of what the boats push.
The quickest tell is the gate. If your yard has a TWIC reader at it, you already hold a Facility Security Plan, and §101.605 already reaches you there.
A surprising number of eight-boat companies are in scope both ways: the boats through Part 104, the fleet through Part 105. The two sides carry the same obligations, but they are submitted to different people — vessel plans to the Marine Safety Center, facility plans to the cognizant Captain of the Port — so it matters to know which you are.
The three questions
Here is the honest test. Answer each one from your own records, not from memory.
| Question | Where the answer lives | If yes |
|---|---|---|
| 1. Does any boat we operate carry a Vessel Security Plan under Part 104? | Your VSP; for towing, whether the boat tows tank barges | The vessel side applies |
| 2. Does any dock, fleeting area or terminal we operate carry a Facility Security Plan under Part 105? | Your FSP; the TWIC reader at the gate | The facility side applies |
| 3. If either is yes: which of our systems could cause a Transportation Security Incident if compromised? | Your Cybersecurity Assessment — nobody else can answer it | Those are your critical systems, and the measures attach to them |
Question three is the one that decides how much the rule asks of you. The technical measures in §101.650 attach to "critical IT/OT systems" — systems whose compromise could lead to a Transportation Security Incident. The Coast Guard's assessment guidance, Policy Letter 01-26, puts the test plainly: if the answer to "could it cause a TSI" is yes or maybe, designate it critical. The definition in §101.615 also reaches business support services and systems whose operation is delegated to someone else, which is why the engine dealer's telematics link and the MSP-run firewall cannot be waved off because another company holds the keys.
Two no answers mean Subpart F does not reach you. One yes means it does, and the scoping work begins.
Two things that do not get you out
An existing MTSA waiver. The Coast Guard confirmed on July 22, 2026 that operators holding a pre-existing MTSA waiver are not exempt from Subpart F. They must still complete a Cybersecurity Assessment and, if the facts warrant, request a separate Subpart F waiver by July 16, 2027.
"We don't really have computers." The rule does not take your word for it. Even an operator with little or no IT or OT must complete the assessment first; relief, where it is justified, comes afterward through the waiver process in §101.665. A waiver request without a completed assessment attached is returned. On most boats the claim is also not true: the wheelhouse has two Windows PCs running the chart system, a Starlink router carrying crew wifi and dispatch traffic on one subnet, and an engine gateway the dealer can reach from another state. Saying so honestly is what the assessment is for.
What applies once you are in
If one of the first two questions is yes, the obligations are these, and we have written each of them up at /the-rule:
- A Cybersecurity Officer designated in writing, reachable by the Coast Guard around the clock (§101.625)
- A Cybersecurity Assessment, first by July 16, 2027 and then annually (§101.650(e))
- A fourteen-section Cybersecurity Plan submitted by the same date (§101.630, §101.655)
- Two obligations that are already in force: reporting reportable cyber incidents to the National Response Center without delay, live since July 16, 2025 (§101.650(g)(1)), and annual cybersecurity training for everyone with system access, which was due January 12, 2026 (§101.650(d))
The last two are the ones an inspector can already ask about at your next regular inspection. If you are in scope and have not started, those are where to start, and our deadline playbook lays the order out.
What we tell people on the call
We will not tell you the rule applies when it does not. A dry-cargo operator with no regulated facility hears that in the first ten minutes, and hears what the foreign-flag reporting rule and ordinary good practice still ask of them. An operator who pushes tank barges, or runs a fleet that handles them, hears that they are in, on which side, and what is already overdue.
If you would like the three questions answered against your own boats and docks, book a readiness call at /book — thirty minutes, and you leave knowing where you stand.
The NRC call-script card, the training-records template and the CySO chooser
Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.
Get them —