What counts as a reportable cyber incident, and who do we call?

Of everything in the Coast Guard's cyber rule, this is the part that can be needed tonight. It is also the part that has applied to you the longest: since the rule took effect on July 16, 2025, owners and operators of covered vessels and facilities have been required to report reportable cyber incidents to the National Response Center without delay. No plan has to exist first. No Cybersecurity Officer has to be named. The duty is already yours.

Here is how it works, written for the person who will actually be on the phone.

The number

National Response Center: 1-800-424-8802. Staffed around the clock, every day. It is the same line that takes spill and hazardous-condition reports, so your office and your wheelhouses probably know it already.

The measure is §101.650(g)(1): reportable cyber incidents go to the NRC "without delay." The owner or operator's corresponding duty to make sure that happens is §101.620(b)(7).

What "reportable" means

The rule defines a reportable cyber incident in §101.615, and the definition is wide on purpose. It reaches the loss of confidentiality, integrity or availability of a covered system; actual or threatened operational disruption; a data breach; and anything that could contribute to a Transportation Security Incident. An incident that is still under investigation, whose cause you do not yet know, is inside the definition.

In practice the definition reduces to four questions. Answer them about the event in front of you:

One yes means report. One "we're not sure" also means report; the rule's posture, and ours, is that uncertainty goes to the NRC rather than to a meeting. Nothing in the rule penalizes a good-faith report that turns out to be benign. The exposure runs the other way: an incident you sat on while deciding whether it was serious.

Two examples that come up. Ransomware on the shoreside network while the boats are fine is almost certainly reportable — operational disruption and data breach are both in the definition, and the systems that dispatch, crew and bill for the boats are covered IT. A compromised company email account that an attacker has been reading or sending from is a breach of credentials and very likely of customer or crew data, and belongs on the call too.

"Without delay"

The rule does not grant a business-hours grace period, and it does not ask you to finish investigating first. The standard is that you call as soon as you know enough to report — which in most cases is within the first hour of realizing something is wrong, not the next morning. That is why the procedure has to be written down: the person who discovers the problem at two in the morning is rarely the person who wrote the plan.

What the NRC will ask

The NRC takes the report as a conversation, not a form you fill out. Have these ready before you dial:

• Who you are. The vessel or facility name, the owner or operator, your name, and a callback number.
• What happened, in plain language. Which systems are affected, when it started, and how it was found.
• The operational impact so far, and whether it is contained.
• What has been done. Isolation steps taken, where you are in your incident response plan, and who else already knows.

You will be given a report number. Write it down. It is the single most important artifact of the night.

One call, two agencies — and a third

A report to the NRC also satisfies notification to the FBI. It does not satisfy CISA. Facilities and vessels that fall under 33 CFR Part 6 must separately notify CISA, at 844-729-2472 or SayCISA@cisa.dhs.gov, per NVIC 02-24 Change 1. If you are not sure whether Part 6 reaches you, that is a question to settle now, in daylight, and write into the procedure.

The record you keep

§101.640 requires records of cybersecurity threats and reportable cyber incidents, alongside training, drills, exercises and audits. Your incident log should carry, for each event: the date and time it was discovered, what happened, the four-question determination, the time of the NRC call and the report number, the CISA notification if one was made, who was notified internally, and the follow-up. Records are kept at least two years and must be producible to the Coast Guard on request; the incident log with its NRC report numbers is on the list of things an inspector asks for.

Events you decide are not reportable need a record too. Write down what happened, what you checked, and why it fell outside the definition. A decision not to report has to be defensible if someone second-guesses it later — and if the facts change, the determination gets made again.

The plan behind the call

§101.650(g) asks for more than the phone call: a Cyber Incident Response Plan that is developed, maintained and exercised, periodic validation of it, and backups of critical systems that are protected and tested. The reporting script is one page of that plan, but it is the page that matters most, because it is the one used under pressure.

A good script fits on a laminated card in the wheelhouse and by the dispatch desk: the four questions, the number, what to have ready, who gets called next, and where the report number goes. We have made one; it is in the downloads, and the rest of the obligation is explained at /the-rule/incident-reporting.

Who makes the call

Whoever your procedure names. That is the whole point of having one. In a fractional-CySO arrangement the on-call Cybersecurity Officer makes or supervises the call and handles the CISA notice where it applies, which takes the decision off a dispatcher at two in the morning. Whatever the arrangement, the name and the number have to be written somewhere the night person will find them.

If you would like the script written for your operation, and someone on call behind it, book a readiness call at /book.