Access control

Also governed by§101.650(a)§101.650(h)

Multifactor authentication

On password-protected IT systems and on remotely accessible operational technology. Where it is not technically possible, the plan documents why and what compensates.

Default passwords changed

Before a system is placed in service. Default credentials remain one of the most commonly observed exposures in assessed maritime organizations.

Password strength and automatic lockout

Stated as a standard, applied as a configuration.

Least privilege

People get the access their job needs. The plan should say how that is decided and how often it is reviewed.

Separate credentials for critical systems

The account that reads business email is not the account that reaches critical systems. This single control breaks the most common attack chain.

Revocation on departure

Access ends when employment or the engagement ends. The plan names who triggers it and how fast.

IT and OT segmentation

Operational technology segmented from information technology, with every connection between them logged and monitored.

• MFA stated per system, with the exceptions listed and justified rather than a blanket claim
• An account inventory: who has what, on which system, with what privilege level
• A quarterly access review with evidence it happened
• A departure checklist that includes the shared accounts everyone forgets — the dispatch login, the fuel card portal, the vendor site
• Named administrative accounts rather than a shared "admin" everyone uses
• The segmentation described in a way the network map in Section 6 corroborates

Multifactor authentication is enforced on the Microsoft 365 tenancy,
the accounting system, the dispatch platform, and all remote access
to vessel networks.

Exception: the [system] operator console does not support MFA in
the installed version. Compensating controls: the console is on the
segmented OT network with no routable path from the business
network; physical access is limited and logged under Section 8;
the account is unique to the console and is not used elsewhere.
The vendor's roadmap is reviewed annually; risk accepted by
[owner/officer] on [date] and recorded in Section 12.

• MFA configuration evidence per system
• Account lifecycle records: provisioning, review, revocation with dates
• Access review records
• Segmentation configuration and the logs of IT-to-OT connections
• Compensating-control documentation where MFA is not possible

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Claiming MFA everywhere

Almost nobody has it everywhere, and a reviewer who finds one system without it now doubts the whole section. List the exceptions and justify them — that reads as competence, not weakness.

Shared accounts

A shared login makes both least privilege and revocation impossible, and it defeats every record that depends on knowing who did something.

Departure handled informally

Where nobody owns revocation, it happens eventually or never. Departed-employee access is a documented failure mode across industries.

Segmentation asserted, not shown

If Section 7 claims segmentation and the Section 6 network map shows one flat network, the plan contradicts itself.

Do we really need MFA on the boat?

The rule requires it on remotely accessible operational technology. A vessel system reachable from shore is remotely accessible. Where the equipment cannot support it, document the compensating controls and accept the risk in writing.

What about the shared dispatch login everyone uses?

That is the most common finding in small operations, and it breaks three requirements at once — least privilege, revocation, and attribution in your records. Individual accounts are the fix, and they are usually free.

How is this different from Section 8?

Section 7 is logical access — accounts, credentials, network paths. Section 8 is physical access to the same systems. The rule points both at the same measures, which is why they are usually written together.