From NVIC 01-20 to the final rule: what changed when guidance became law

For five years, the phrase "Coast Guard cyber" meant a guidance document. NVIC 01-20 — Navigation and Vessel Inspection Circular 01-20 — was published in 2020 and told MTSA-regulated facilities to address computer system and network vulnerabilities inside the security assessments and plans they already maintained under 33 CFR parts 105 and 106. It was sensible, it was framework-flavored, and it was voluntary. A facility that mapped its posture to the NIST Cybersecurity Framework and wrote a few cyber paragraphs into its Facility Security Assessment had done what the circular asked.

That era is over, and a surprising number of operators — and more than a few vendors — have not updated their mental model. If your cyber posture was built to NVIC 01-20, here is precisely what changed in January 2025 when the final rule published, and what it means for the work you have already done.

Guidance asked. The rule requires.

The structural difference is the whole difference. A NVIC is guidance: it recommends, it suggests alignment, and its enforcement lives in the gray space of a Captain of the Port's expectations. The final rule — 33 CFR Part 101 Subpart F, effective July 16, 2025 — is regulation. It carries defined applicability under §101.605, enumerated requirements, fixed dates, and civil penalties that run to $43,527 per violation, per day, with each day counting separately.

Three specific upgrades matter most to anyone who did the 2020-era work:

The plan is now its own document. NVIC 01-20's model was integration — fold cyber into the FSA and FSP you already have. Subpart F's model is a standalone Cybersecurity Plan under §101.630: fourteen required sections, submitted for Coast Guard approval, marked as Sensitive Security Information, valid five years. Cyber paragraphs inside an FSP, however thoughtful, are not a submission.

The people requirements got names. The guidance era had no required role. The rule requires a Cybersecurity Officer designated in writing under §101.625 — reachable by the Coast Guard around the clock, responsible for the assessment, the plan, audits, training, drills and incident reporting. It also requires training for everyone with system access under §101.650(d), a deadline that passed on January 12, 2026. New hires get five days.

The technical measures stopped being a framework. Where the circular pointed at NIST categories, the rule enumerates: multifactor authentication, account lifecycle controls, an approved hardware and software list, segmentation between IT and OT, logged and monitored vendor connections, tested backups, and an annual Cybersecurity Assessment under §101.650(e). The assessment is not optional for anyone — the Coast Guard confirmed in July 2026 that even facilities holding pre-existing MTSA waivers must complete it, with any relief requested afterward through §101.665.

What your NVIC-era work is still worth

Honestly: a head start, and a real one. A facility that took the circular seriously already has an asset-aware FSA, a security officer who thinks in assessments and plans, drill discipline, and a working relationship with its COTP — the same office that will receive its Cybersecurity Plan. The thinking transfers. The documents do not.

The practical translation exercise looks like this: your FSA's cyber content seeds the Cybersecurity Assessment but must be rebuilt to the rule's method — asset inventory, criticality designations against the transportation-security-incident test, and analysis per the Coast Guard's published assessment guidance. Your FSP stays in force, unchanged; beside it goes the fourteen-section plan. Your FSO may or may not become your CySO — the rule allows the dual hat, and the honest question is bandwidth, not eligibility.

The date that ends the ambiguity

Whatever posture the guidance era left you in, the rule sets one date: July 16, 2027 under §101.655 — the Cybersecurity Plan submitted, the CySO designated, the assessment complete. Facilities were never part of any delay discussion. Two obligations are already in force: incident reporting to the National Response Center without delay, and the all-hands training whose deadline passed in January.

If your last serious look at Coast Guard cyber was through NVIC 01-20, the single most useful thing you can do this month is re-run the gap analysis against the rule instead of the circular. It is a different exercise, with a different finish line — and the finish line now has a penalty attached.