What moved on the rule, and where it moved
The rule is written, but it is not finished moving. This page pulls the Federal Register, the docket, the Coast Guard's own guidance, the safety bulletins for the sectors you run in, and the vulnerability catalog the rule requires you to act on — dated, linked to the source, and refreshed every hour.
The three facts worth checking before anything else
Designate the Cybersecurity Officer, complete the assessment, and submit the plan. Unchanged since the final rule.
Check it at the sourceThe Coast Guard asked for comment on a two-to-five-year vessel delay when the final rule published on Jan 17, 2025. Comments closed Mar 18, 2025 and no delay has been published since. The docket below is where one would appear first.
Check it at the sourcePosture as of the Jun 4, 2026 guidance release. Plans submitted are retained while the Coast Guard finishes its review and approval procedures. Waiver requests are a separate track and are open.
Check it at the sourceuntil Jul 16, 2027 — CySO designated, assessment complete, plan submitted for approval. §101.655
The rule, and where it moves
33 CFR Part 101 Subpart F (eCFR)
ecfr.govThe regulation itself, current and in force, with the date it was last amended. If a vendor quotes a requirement at you, check it here first.
Most recent amendment recorded for §101.670.
Federal Register: documents amending 33 CFR Part 101
federalregister.govEvery Federal Register document that amends 33 CFR Part 101 — the part this rule lives in. A delay, a correction or a new proposal appears here as a dated document.
Rule
Proposed Rule
Proposed Rule
Rule
Rule
Rule
Rule
Rule
Proposed Rule
Proposed Rule
Proposed Rule
Rule
Docket USCG-2022-0802
regulations.govThe rulemaking file: the final rule, both proposed rules, and the studies behind them. If the vessel deadline ever moves, it posts here first.
Supporting & Related Material
Supporting & Related Material
Rule
Proposed Rule
Supporting & Related Material
Supporting & Related Material
Supporting & Related Material
Proposed Rule
The Coast Guard
Maritime Commons
news.uscg.milThe Coast Guard’s own blog, and where policy moves before it moves anywhere else. It publishes no working feed and refuses automated requests, so these are read and entered by hand rather than pulled.
Announced by ALCOAST 266/26. CG-MCP is the office that writes the guidance and will run plan review, so reviewer expectations now have an address. The name was already on the June guidance; the ALCOAST formalizes the office.
Read this before filing anything on the waiver track. An existing waiver under the older parts does not carry across to the cyber requirements on its own.
The best public incident data for this sector, and usable evidence in an assessment. Reported maritime cyber incidents rose 17 percent year over year, phishing remained the primary entry point, and operational technology featured in 62 percent of Coast Guard cyber missions.
The release that set the current submission posture. If one Coast Guard post shapes what a covered operator should do this year, it is this one.
What an inspector actually checks on your training records. The record fields in our training template come from this document.
Federal cyber sources the rule points at
Vulnerabilities that are being exploited right now, each with the date the catalog sets for fixing it. This is not reading — it is the list your program is required to act on.
Remediate by 2026-10-19. Fortinet Multiple Products Path Traversal Vulnerability
Remediate by 2026-10-19. BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
Remediate by 2026-10-18. Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Remediate by 2026-10-17. Palo Alto Networks PAN-OS Code Injection Vulnerability
Remediate by 2026-10-17. Ahsay AhsayCBS Improper Authentication Vulnerability
Remediate by 2026-10-17. Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Remediate by 2026-10-17. Ahsay AhsayCBS Command Injection Vulnerability
Remediate by 2026-10-16. Microsoft Windows Command Injection Vulnerability
Remediate by 2026-10-16. Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Remediate by 2026-10-11. ProFTPD Improper Access Control Vulnerability
CISA cybersecurity advisories
cisa.govAdvisories filtered to control systems, operational technology and marine equipment: the vessel and terminal gear that rarely reaches a fleet's inbox.
CISA is aware of critical authentication bypass vulnerability CVE-2026-102764 , affecting BeyondTrust Remote Support (formerly Bomgar) versions 26.2.3 and earlier. Patches are available for supported versions (24.3.1 and later); organizatio
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability CVE-2026-102764 BeyondTrust Remot
Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud are affected: EseeCloud App <=4.9.6 (CVE-2026-107617, CVE-2
Successful exploitation of these vulnerabilities could allow an attacker to delete protected data, recover user credentials and impersonate legitimate users, or cause the server to stop responding to all clients. The following versions of E
The following versions of Grid Protection Alliance openPDC and openHistorian are affected: openPDC <2.9.477, <2.9.482 (CVE-2026-104629, CVE-2026-100730, CVE-2026-105281, CVE-2026-85479, CVE-2026-101022) openPDC (Docker image) <2.9.477, <2.9
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code.
Hitachi Energy is aware of unauthenticated servlet access vulnerabilities that affect Asset Suite product versions listed in this document. These vulnerabilities can be exploited to potentially cause confidentiality, integrity and availabil
Hitachi Energy is aware of RCE (Remote Code Execution) vulnerability in Apache ActiveMQ component of SOI product versions listed in this document. These vulnerabilities can be exploited to carry out various attacks affecting confidentiality
Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. The following versions of Savannah lwIP SMTP client are affected: lwIP SMTP client 2.2.1 (CVE-
Hitachi Energy is publishing this cybersecurity advisory in response to the security findings reported by Dragos affecting end-of-life RTU500 CMU firmware version 9.x. The reported findings are associated with legacy RTU500 firmware version
How to read this page
Every item links to the source, and nothing here replaces reading it. Government material is public domain and quoted freely; where a date or figure matters, we cite the document rather than paraphrase it. The catalog under §101.650(d)(15) is not reading — it is an obligation your program has to consume, and the due dates in it are set by the catalog itself.
Our reading of the rule, section by section, is at the rule explained. The sources themselves, with what each costs to follow, are at where this industry lives. Nothing on this page is legal advice.