What does "OT" mean on a towboat, and what does the rule want us to do about it?

The Coast Guard's cyber rule draws a line between two kinds of computer. IT is the office side: email, dispatch, accounting, files. OT — operational technology — is the computers that control or monitor physical things. The rule is more protective of OT, for a plain reason: a compromised email account loses money, but a compromised steering or gauging system can put a tow in a bridge pier or product in the river. That is the Transportation Security Incident the whole rule exists to prevent.

Most towboat operators, asked whether they have OT, say no. Most of them do. Here is what counts, and what the rule wants done about it.

What OT is, on a towboat

Walk the boat from the wheelhouse down.

The wheelhouse. The electronic chart system — on most inland boats, two Windows PCs running Rose Point or a similar ECS; an ECDIS on boats that carry one — plus the radar, the AIS transponder, the GPS and heading sensors, the autopilot driving the hydraulic steering, the depth sounder, and the watch alarm. The chart PCs are ordinary computers with a browser on them, fed chart updates over the internet, and often carrying a remote-support tool the electronics shop installed years ago.

The engine room. Electronic engines with their control modules, the monitoring panels, and — the piece people forget — the dealer's telematics gateway, a cellular or satellite modem on the engine network that reports to the manufacturer's monitoring center. That is a connection from the outside world directly to your OT, and someone in another state can use it.

The network that ties it together. Starlink and a router, installed in the last few years, carrying crew wifi, the dispatch and fleet-management sync, electronic logs, telematics backhaul and streaming — typically on one flat network. The router is often managed by the installer or the ISP, not by you.

At the fleet or dock. Tank gauging with wireless gateways, overfill alarms, transfer-monitoring software, PLC-driven pump and valve control, custody-transfer meters, gate access and the TWIC readers. At a dry-bulk dock, the conveyor PLCs.

And the system that is technically IT but behaves like OT. The dispatch or fleet-management platform — the thing that knows where every barge is and which boat is going where. The rule's definition of critical IT and OT in §101.615 expressly includes business support services and systems whose operation is delegated to another party. If losing dispatch would stop barges moving, it is critical regardless of what it is called.

The test for any of it is the same: could substantial loss of this system's confidentiality, integrity or availability lead to a TSI? The Coast Guard's guidance says yes or maybe means critical. Falsified tank readings that delay noticing an unsafe condition, a gate computer that lets the wrong person in, a billing system whose loss halts cargo — those are the Coast Guard's own examples of "maybe."

What the rule wants you to do about it

The measures are in §101.650. Here is each, against the boat.

Two of these carry most of the weight and most of the cost.

Segmentation: the one real project

§101.650(h) asks for IT segmented from OT, with the connections between them logged and monitored. On a boat with a single flat network that means configuring the router into separate networks — crew, business, navigation, engine — and deciding which may talk to which. On most vessel routers this is a configuration job, not new hardware, but it has to be designed by someone who understands both the boat and the router, and it has to be done when the boat is not underway. It is the finding we write on almost every assessment, and the Coast Guard's own reporting says more than half of the OT networks it has assessed were mis-segmented while their owners believed them isolated.

Ashore, the same principle separates the office from the cameras and the gauging.

Access control: MFA and the dealer

§101.650(a) requires multifactor authentication on password-protected IT and on remotely accessible OT. For a towboat, "remotely accessible OT" means the telematics gateway the dealer reaches, the chart-update portal with shore-side monitoring, and any remote-support tool on the nav PCs. The practical steps are to find every one of those paths in the assessment, require MFA on the ones that can support it, remove the ones nobody remembers installing, and document the rest with compensating controls.

The account hygiene underneath is ordinary: no shared "wheelhouse" login, default passwords gone from the router, cameras and gauging gateways, separate credentials for critical systems, and logins removed the day someone leaves.

Physical controls: the USB port

§101.650(i) is the one a deckhand can violate by charging a phone. The Coast Guard's Marine Safety Alert 06-19 described exactly that: malware reaching a vessel through a crew USB drive on a computer without protection. The rule's answer is blunt — unused physical ports blocked, disabled or removed; access to HMIs and hardware limited and logged; an exception procedure for the technician who genuinely needs the port. On a towboat that is a few port blockers, a setting on the chart PCs, a lock on the engine-room panel, and a line in the training.

What it does not want

It does not want you to take the chart PCs offline, replace the engine electronics, or buy a security operations center. It does not want vulnerability scans run against OT or navigation systems underway; those are inventoried by configuration review and vendor documentation. And it does not require a penetration test until the five-year plan renewal.

What it wants is that you know what you have, keep the crew's wifi away from the steering, control who can reach in from outside, and can show an inspector the documents that prove it. The rest of the technical measures are explained at /the-rule/technical-measures.

If you would like to know what the OT on your own boats looks like to the rule, book a readiness call at /book.