Does the rule apply to barges we own but do not operate?

Split ownership is ordinary in barging. A leasing company, a grain shipper or a family LLC holds title to a string of barges; a towing company crews the boats, moves the equipment, and runs it all day to day under charter or management contract. The two are often not the same company — sometimes the title-holder has never crewed anything and never will. So when the Coast Guard's cyber rule addresses its duties to the "owner or operator," a fair question lands on the desk of every barge-owning entity: is that us?

Here is the honest shape of the answer, and — stated up front — its limit: how the duty allocates in your specific charter is a question for your maritime counsel, and nothing in this piece is legal advice. What we can do is show you how the rule is built, what the practical division of labor looks like, and the one question that sorts most situations in a sentence.

How the rule reaches a vessel at all

Start with the gate. §101.605 applies the subpart to owners and operators of U.S.-flagged vessels that are required to carry a Vessel Security Plan under the existing maritime security regulations, along with regulated facilities. The cyber rule reaches equipment through the security plans it already carries — we walk that gate in detail in does the rule apply to my towboats. If none of the equipment in question is covered by an MTSA security plan on either the vessel or facility side, the cyber rule's program obligations are not in play and the ownership question is moot. Sort that first.

"Owner or operator" — what the rule's phrasing does

Assuming covered equipment, the rule places its duties on the owner or operator — the phrase is disjunctive, and the duties live in §101.620: designate the Cybersecurity Officer, ensure the assessment and the plan, ensure incidents get reported. The rule names both parties rather than picking one, and it leans on the same owner-or-operator structure the existing security regulations already use — which means your charter documents have almost certainly already answered a version of this question. Whoever holds the Vessel Security Plan obligations for a covered vessel today is, as a practical matter, the party the cyber rule's machinery attaches to alongside it.

And there is a reason the working obligations naturally follow the operator. The rule's program protects systems and people: wheelhouse computers, dispatch software, crews, the office that pays the fuel invoices. A pure title-holder — a lessor under bareboat charter with no crew, no dispatch desk and no operational systems touching the equipment — has almost nothing for a Cybersecurity Plan to protect. The operator has all of it. The definitions in §101.615 reinforce the point from the other side: coverage follows the systems, reaching even systems whose operation is delegated or outsourced, so the program lands where the systems actually live and are run.

The one question that sorts it

When a company that owns barges asks us whether the rule applies, we ask one question back before anything else:

Do you operate these barges yourselves, or does someone move them for you?

If you operate them — your boats, your crews, your dispatch — then for practical purposes you are the operator as well as the owner, the distinction collapses, and the compliance work is yours: CySO designated in writing, Cybersecurity Assessment complete, plan submitted by Jul 16, 2027 (§101.655). Being organized as an owning LLC and an operating LLC under one roof does not change the substance; counsel will tell you which entity signs.

If someone else moves them, the practical center of gravity shifts to your operator — and your own posture becomes a different, quieter kind of important, covered next.

If someone else moves your barges

Three things belong on the title-holding company's desk.

The allocation is contractual, and counsel confirms it. Exactly how the owner-or-operator duty splits in a bareboat charter, a management agreement or a split-ownership deal — who signs, who is the responsible party of record for a given hull — is a maritime-counsel question, the same one your charters already answer for the underlying security plans. Do not accept a vendor's flat assurance in either direction, ours included. Ask your attorney to confirm where this sits in your charter language, and whether it should say more than it does.

Your operator's compliance is now your exposure question. Whatever the formal allocation, the rule names owners in the same breath as operators, and an owner whose operator simply ignores a federal compliance regime has a problem worth managing. The practical instrument is the charter: a compliance covenant obligating the operator to meet the cyber rule for covered equipment, with evidence on request. What evidence? The same artifacts a Coast Guard inspector would ask the operator for — the written CySO designation, the plan's status, current training records (§101.650(d)), and the incident log with its records kept per §101.640.

Ask, this year, not in 2027. The compliance sequence — assessment, then plan — takes months, and the operator who has not started by early 2027 will not be finished by July. An owner's inquiry letter this fall, asking the operator to state its cyber-rule posture in writing, costs a page and may be the most useful compliance document your file holds. If the answer comes back thin, there is still calendar to act on it.

The pattern underneath

The rule keyed itself to the security-plan regime the industry already runs, and that regime long ago worked out how owners and operators divide responsibility — through charters, management contracts and plans of record. The cyber rule inherits those grooves rather than cutting new ones. So the answer to the title question is rarely "yes, the whole program is yours" and rarely "no, nothing to do with you." It is: the program follows the operation, the allocation follows the contract, the exposure follows the title — and each of the three deserves ten minutes with the right person, which for the middle one is your attorney. The obligations themselves are explained plainly at /the-rule.

If you own covered equipment and want help framing the questions for your operator or your counsel, book a readiness call at /book.