A glossary for the Coast Guard cyber rule: the rule's words, the cyber words, and the documents behind them

The rule defines thirty-seven terms in §101.615. The cyber trade uses a few hundred more, most of them unnecessary. This glossary covers the ones that actually appear in the obligation, in the documents the Coast Guard publishes about it, and in the conversation you will have with whoever helps you comply. Where the rule defines a word itself, the section is given; where it does not, the definition is ours, written for the river.

Part one — the rule's own words

Alternative Security Program (ASP). A Coast Guard-approved security program that an industry body or company runs in place of individual plans. The cyber rule lets a Cybersecurity Plan be "part of an approved Alternative Security Program" (§101.630(a)). Few inland operators use one.

Captain of the Port (COTP). The Coast Guard officer with authority over a port zone. For a facility, the COTP is who reviews and approves your Cybersecurity Plan (§101.630(d)), and who you notify in an emergency. Your sector — Ohio Valley, Lower Mississippi River, New Orleans, Houston-Galveston — is the COTP's zone.

Compliance dates. §101.655: all Cybersecurity Plans must be submitted by July 16, 2027. The other dates live elsewhere: incident reporting has applied since the rule took effect on July 16, 2025; training was due January 12, 2026 (§101.650(d)(4)).

Critical IT or OT systems. The rule's definition (§101.615): any IT or OT system "that, if compromised or exploited, could result in a transportation security incident (TSI), as determined by the Cybersecurity Officer in the Cybersecurity Plan." It expressly includes "business support services" and "systems whose ownership, operation, maintenance, or control is delegated wholly or in part to any other party" — the engine dealer's telematics and the MSP-run firewall count. The Coast Guard's own test for designating one: could substantial loss of the system's confidentiality, integrity or availability result in a TSI? Yes or maybe means critical.

Cyber incident. The rule's umbrella term for an event that actually or potentially jeopardizes a system or the information on it (§101.615). Not every incident is reportable — see below.

Cyber Incident Response Plan (IRP). Defined in §101.615 as "a set of predetermined and documented procedures to respond to a cyber incident" that "gives the owner or operator or a designated CySO instructions on how to respond" and "pre-identifies key roles, responsibilities, and decision-makers." It must be developed, maintained and exercised (§101.650(g)(2)).

Cybersecurity Assessment (CSA). Defined in §101.615 as "the appraisal of the risks facing an entity, asset, system, or network … and includes identification of relevant vulnerabilities and threats and determining the extent to which adverse circumstances or events could result in operational disruption and other harmful consequences." Required by §101.650(e)(1): first by July 16, 2027, then annually, and sooner on a change of ownership. It must analyze all networks, validate the plan, patch every known exploited vulnerability on critical systems, and feed amendments. Its report is SSI. It comes before the plan, and before any waiver.

Cybersecurity Officer (CySO). The person, named in writing, responsible for the program (§101.625). Must be reachable by the Coast Guard around the clock, may hold other duties, may cover several vessels or facilities, and may be an outside provider — the rule was written to allow it. No license or certificate is required; the qualification is knowledge gained "through training or equivalent job experience." The CySO "must develop, implement, and verify" the plan (§101.630(a)) and has fifteen listed duties (§101.625(d)), the first of which is making sure the assessment gets done.

Cybersecurity Plan (CSP). The fourteen-section document that "must describe in detail how the requirements of subpart F will be met" (§101.630). Approved by the Coast Guard, not certified; valid five years; SSI. Our full walkthrough is here.

Drill. A test of an individual element of the plan — a phishing test, an incident call-through. At least twice each calendar year (§101.635(b)), and they may ride along with the Sub M drills you already run.

Equivalency. Permission to meet a requirement with a different measure of equal effectiveness (§101.665). Requested from the Coast Guard after a completed assessment, with technical justification. Compare waiver.

Exercise. A full test of the program — tabletop, live, or port-wide — at least once a calendar year with no more than 18 months between (§101.635(c)), with the CySO's "substantial and active participation." Must test communication, notification, coordination, resources and response.

Facility Security Plan (FSP) / Vessel Security Plan (VSP). The MTSA security plans facilities and vessels already hold under 33 CFR 105 and 104. If you hold one, you are in the cyber rule's scope (§101.605). The Cybersecurity Plan can be folded into them, attached as an annex, or filed separately — and the preamble says a separate submission "is still considered a part of" them.

Information technology (IT). The office side: email, dispatch, accounting, files, the business network.

Key personnel. People with elevated cybersecurity responsibilities who receive additional training beyond the all-hands topics (§101.650(d)(2)). Your plan defines who they are.

Known Exploited Vulnerability (KEV). A software weakness on CISA's published list of vulnerabilities attackers are actively using. On critical systems these must be patched or covered by a documented compensating control "without delay" (§101.650(e)(1)(iv)).

Marine Safety Center (MSC). The Coast Guard unit that reviews and approves Cybersecurity Plans for vessels (§101.630(d)).

MTSA. The Maritime Transportation Security Act of 2002 — the statute, at 46 U.S.C. 70103, under which the cyber rule was written. The same law that created your VSP or FSP.

National Response Center (NRC). The federal 24-hour reporting line, 1-800-424-8802. Reportable cyber incidents go here "without delay" (§101.650(g)(1); the owner's duty is §101.620(b)(7)).

Officer in Charge, Marine Inspection (OCMI). The Coast Guard inspection authority at a sector; named alongside the COTP as a reviewer for facility plans (§101.630(d)).

Operational technology (OT). The computers that control physical things: engine monitoring and alarms, steering, chart systems, tank gauging, pumps and valves, gate controls. The rule treats OT with extra care — segmentation from IT, physical access limits, and no OT on the public internet without documented justification.

Owner or operator. The party with the rule's primary duties (§101.620): defining the organization in Section 1 of the plan, designating the CySO in writing, ensuring the assessment and plan exist, and ensuring reportable incidents reach the NRC.

Penetration test. An authorized attempt to break in, to find what an attacker would. Required only "in conjunction with Cybersecurity Plan renewal" at five years (§101.650(e)(2)) — not for the initial submission. Results must be available to the Coast Guard on request (§101.660).

Records. §101.640: kept "at a minimum" for training, drills, exercises, cybersecurity threats, reportable cyber incidents, and plan audits; retained under the existing MTSA records rules — two years, producible on request, electronic copies protected against deletion or amendment.

Reportable cyber incident. The subset of incidents that must go to the NRC (§101.615). The definition is broad: it reaches loss of control or availability of a covered system, operational disruption, data breach, and anything that could become a TSI — and an incident still under investigation counts. When in doubt, call.

Sensitive Security Information (SSI). A federal category under 49 CFR part 1520, not a label you choose. The Cybersecurity Plan is SSI by rule (§101.630(b)); the assessment report and your security plans are too. SSI is marked on every page, shared only with those who need it, and never emailed.

Transportation Security Incident (TSI). Defined at §101.105: a security incident resulting in significant loss of life, environmental damage, transportation system disruption, or economic disruption in a particular area. The whole rule is built to prevent cyber-caused TSIs, and the TSI test is how you decide which systems are critical.

Waiver. Relief from a specific requirement that is unnecessary given the nature of your operation (§101.665) — for example, no OT and no remotely accessible systems. Per-requirement, never blanket; cost and convenience are invalid grounds; and it cannot be requested until the assessment is complete. Filing a request does not suspend the obligation until relief is granted.

Part two — cyber words, in plain language

Air gap. A system with no network connection at all. Rarer than people think; the engine room computer with a cellular modem for the dealer is not air-gapped.

Backup / restore test. A copy of your data kept somewhere ransomware can't reach, and the proof that it can actually be restored. The rule requires backups of critical systems that are "sufficiently protected and tested frequently" (§101.650(g)(4)). A backup never restored is a hope.

Business email compromise (BEC). Fraud by email: someone impersonates a vendor or your owner and changes the bank details on an invoice. The most common and most expensive cyber loss for small companies in this industry — more than ransomware. The defense is a phone call to a known number before any bank change.

Compensating control. What you do when you can't patch: isolate the system, restrict who can reach it, monitor it. Acceptable under the rule if documented.

Default credentials. The factory password still on the router, the cameras, the gauging gateway. The Coast Guard's own assessments found them at most of the organizations it audited.

Endpoint. Any computer, laptop, tablet or phone. The nav PC in the wheelhouse is an endpoint.

Firewall. The device that decides what traffic enters and leaves a network. Most small operators have one ashore and none aboard.

Flat network. One network where everything can talk to everything — crew wifi, dispatch tablets, nav computers, engine telematics on the same subnet. The usual state of a towboat with Starlink, and the opposite of what §101.650(h) asks for.

Least privilege. Each person and account gets only the access their job needs. Required by §101.650(a).

Logging / monitoring. Keeping a record of what systems did and who touched them, and having someone actually look. Connections between IT and OT must be "logged and monitored" (§101.650(h)).

Managed service provider (MSP) / managed security service provider (MSSP). The outside IT company that runs your email, computers and firewall — and, often, has standing remote access to all of them. Under the rule their access must be documented and monitored (§101.650(f)), and a compromised MSP is a top way small companies get breached.

Multifactor authentication (MFA). A second proof beyond the password — a code on your phone, a key. Required on password-protected IT and on any remotely accessible OT (§101.650(a)). The single highest-value control on the list.

Patching. Installing the fixes vendors publish for known weaknesses. The rule's minimum is the KEV list on critical systems, without delay.

Phishing. An email or text that tricks someone into clicking or handing over a password. The Coast Guard's testing found 9 percent of maritime users clicked and three-quarters of those then gave up their credentials.

Ransomware. Malware that encrypts your systems and demands payment. For a towing company the realistic target is the shoreside dispatch and billing network, not the boat.

Remote access (VPN, RDP, TeamViewer). The ways people and vendors reach your systems from outside. Every one is a door; the rule wants each documented, authenticated with MFA, and monitored.

Segmentation. Dividing one network into separate zones — crew, business, navigation, engine — so a problem in one cannot reach the others. §101.650(h) requires IT segmented from OT.

Telematics. The engine manufacturer's remote monitoring link — a cellular or satellite modem on the engine network reporting to the dealer. Useful, and also a connection from the outside world directly to your OT. It belongs in the inventory.

Vulnerability scan. An automated check of systems for known weaknesses. Cheap, frequent, and required "as specified in the Cybersecurity Plan" (§101.650(e)(3)). Not the same as a penetration test.

Part three — the documents you will see cited

90 FR 6298. The Federal Register citation for the final rule, published January 17, 2025. Docket USCG-2022-0802. When someone cites "the preamble," this is the document.

33 CFR Part 101 Subpart F. The codified rule — sections §101.600 through §101.670. The current text is on eCFR and is the only authority that binds.

Policy Letter (CG-5PC PL 01-25, 01-26). Coast Guard guidance signed by the Office of Port and Facility Compliance: 01-25 on training, 01-26 on how to do the assessment. Guidance, not regulation — "not itself a rule" — but it is how the Coast Guard expects the rule to be met.

MCP-WI (work instruction). Issued by the Office of Maritime Cybersecurity Policy. MCP-WI-001 is the job aid inspectors use to verify training; 002 covers waivers and equivalencies; 003 explains how to transmit plans and assessments through DoD SAFE, the encrypted file-transfer system.

NVIC. Navigation and Vessel Inspection Circular — longstanding Coast Guard guidance. NVIC 01-20 addresses cyber risk in facility security plans; NVIC 02-24 Change 1 covers incident reporting, including the separate CISA notification for entities under 33 CFR part 6.

MSIB / Marine Safety Alert. Bulletins and alerts about specific incidents. Marine Safety Alert 06-19 described malware reaching a ship through a crew USB drive; MSIB 10-19 described ransomware shutting down a regulated facility for about thirty hours. Both are worth reading as what "cyber incident" has actually meant in this industry.

CTIME. Cyber Trends and Insights in the Marine Environment — Coast Guard Cyber Command's annual report on what it finds at the organizations it assesses. The best public evidence of what attacks on the MTS look like.

CG-835. The Coast Guard's vessel deficiency form. Expect to see one if an inspector cannot find your training records.

Small Entity Compliance Guides. Two six-page Coast Guard guides — one for vessels, one for facilities — written for small operators. Short on plan detail, useful on applicability and waivers.

---

If a term you met is not here, email it to us. This glossary grows with the questions operators actually ask.