Physical security
Physical security controls for IT and OT systems
Who can physically touch the equipment — including the USB port in the wheelhouse.
Section 8 covers the attack that walks aboard. Physical access to operational technology and the information technology that supports it must be limited to authorized personnel, human-machine interfaces and hardware must be secured and monitored, access must be logged, and unused ports must be blocked, disabled, or removed.
For a working boat this is a more interesting section than it first appears, because the equipment lives in spaces that crew, surveyors, vendors and contractors move through all day.
What §101.630(c)(8) hard-wires into this section
- Access limited to authorized personnel
- Named authorization, not "crew." The plan says who, and how someone becomes authorized.
- HMIs and hardware secured and monitored
- The screens and boxes that operate things. Secured is physical; monitored means someone would know.
- Access logged
- A record of who reached the equipment and when. On a vessel this is often a logbook rather than a badge system, which is acceptable if it is real.
- Unused ports blocked, disabled, or removed
- The USB port on the chart computer is the canonical example. Blocked physically, disabled in configuration, or removed — any of the three, stated and verifiable.
- By-exception access procedures
- How a vendor gets temporary physical access, who approves it, and what is recorded.
What a reviewer expects to see
- A per-location table: where the equipment is, who may reach it, how access is recorded
- The USB decision made explicitly for each critical machine, with the method stated
- A vendor escort rule that matches how surveyors and technicians actually board
- A cargo-file transfer procedure that replaces the thumb drive habit rather than banning it without an alternative
- Logging that a crew can actually maintain — a bound logbook beats an unused badge reader
Replacing a habit rather than banning it
Not a template to copy. This is the shape and specificity a section reads with when it has been written from a real operation — bracketed where your facts go.
USB ports on the chart and gauging computers are disabled in firmware, verified quarterly by the port captain and recorded in the vessel log. Cargo documents are transferred through the [named] shared folder, which is reachable from the wheelhouse tablet on the crew network and is not connected to the OT segment. Where a document arrives on removable media, it is transferred ashore on the office scanning workstation and forwarded electronically; the media is not connected to any vessel system. This procedure was briefed [date] and is covered in the OT training module under Section 2.
What has to be producible
- Physical access logs for spaces containing critical systems
- Port-blocking records: which machines, which method, verified when
- Vendor access records with escort and approval
- Photographs or configuration evidence of applied controls
Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.
How this section gets a plan returned
- Writing a policy the crew cannot follow
- A rule that stops cargo files moving stops work, and gets ignored by the second week. Give the practice a replacement, not a prohibition.
- Ignoring the vendor path
- Technicians with laptops attach to operational equipment routinely. If the plan has no by-exception procedure, that access is unrecorded by design.
- Treating this as shoreside only
- The wheelhouse is the highest-consequence physical access point in the entire operation, and it is the one most plans skip.
What operators ask about this section
- Do we have to ban USB drives?
- No. The requirement is that unused ports are blocked, disabled or removed, and that access is controlled. Ports in use for a documented purpose, with a documented procedure, are a different thing from an open port nobody thought about.
- What counts as a log on a boat?
- A bound logbook maintained by the crew is a legitimate access record. The standard is that it is real and current — an electronic system nobody uses is worse.