The rule, in full33 CFR Part 101 Subpart F

The Coast Guard's cyber rule, explained in plain English

Final rule “Cybersecurity in the Marine Transportation System,” 90 FR 6298, published January 17, 2025 under the Maritime Transportation Security Act. Effective July 16, 2025. This page is the map; each requirement links to a deeper guide.

Who must comply

If you carry a security plan today, you are in scope

U.S.-flagged vessels: Every vessel that must carry a Vessel Security Plan under 33 CFR 104 — including towing vessels and unmanned barges. During rulemaking the Coast Guard rejected requests to exclude inland towing vessels.
MTSA-regulated facilities: Terminals handling dangerous cargoes, facilities serving SOLAS vessels or vessels with 150+ passengers, barge fleeting areas handling bulk dangerous cargo, and similar operations under 33 CFR 105.
Outer Continental Shelf facilities: Facilities regulated under 33 CFR 106.
Existing MTSA waiver holders: Not exempt. The Coast Guard confirmed in July 2026 that they must still complete a Cybersecurity Assessment and, if warranted, request a Subpart F waiver by July 16, 2027.

Requirements attach to critical IT and OT systems— systems whose compromise could lead to a Transportation Security Incident. The Coast Guard’s assessment guidance is blunt: if the answer to “could it cause a TSI?” is yes or maybe, designate it critical.

The compliance clock

Two obligations are already live

Jul 16, 2025: Reportable cyber incidents must go to the National Response Center (1-800-424-8802) without delay. Also the anchor date for the drill and exercise cadence. §101.650(g)(1)
Jan 12, 2026: All personnel with IT or OT access — including contractors — must have completed cybersecurity training. Annually thereafter; new hires within 5 days of system access. §101.650(d)
Jun 4, 2026: The Coast Guard holds full Cybersecurity Plan submissions until further notice while review procedures are finalized. Waiver and equivalency requests are open now. §101.665
Jul 16, 2027: Designate a CySO, complete the Cybersecurity Assessment, and submit the Cybersecurity Plan for approval. Waiver requests due the same date. §101.655

A delay for vessels was floated during rulemaking and never enacted — no delaying rule has ever been published, and every 2026 Coast Guard communication still cites July 16, 2027. Penalties under 46 U.S.C. 70119 run to $43,527 per violation, and each day of a continuing violation is a separate violation.

The requirements

Eleven program areas, each with its own guide

The Cybersecurity PlanWhat 33 CFR 101.630 requires in a Cybersecurity Plan, how submission and approval work, the five-year validity cycle, and the amendment clocks that run afterward.§101.630 The Cybersecurity OfficerWhat 33 CFR 101.625 requires of the Cybersecurity Officer, who can hold the role, the 24/7 reachability duty, and why the rule explicitly permits a third-party CySO.§101.625 The annual assessmentWhat the annual Cybersecurity Assessment under 33 CFR 101.650(e) involves, the Coast Guard's three-stage method, criticality designation, and why the report is SSI.§101.650(e)TrainingThe cybersecurity training 33 CFR 101.650(d) requires §101.650(d)Drills and exercisesWhat 33 CFR 101.635 requires §101.635 Incident reportingWhat counts as a reportable cyber incident under 33 CFR 101.615, the NRC without-delay requirement, the separate CISA notification for Part 6 entities, and the incident log.§101.650(g)(1)WaiversHow waivers and equivalency requests work under 33 CFR 101.665 §101.665 Technical measuresAccount security, device security, data security, network segmentation and physical security under 33 CFR 101.650 §101.650(a)Records and auditsThe two-year records requirement, what inspectors actually check, and the annual independent audit under 33 CFR 101.630(f) §101.650(c)Which rules applyA working operator hears five different cyber regimes named in one conference session. For a U.S. brown-water fleet or terminal, exactly one of them is binding §101.605 Sub M and the cyber ruleWhat carries over from a towing company's Sub M discipline to 33 CFR Part 101 Subpart F, what does not, and why your TSMS auditor will not be checking any of it.§101.630(f)Terminals and facilitiesHow 33 CFR Part 101 Subpart F lands on MTSA-regulated terminals and facilities: who is covered, where the plan goes, what changes for the FSO, and why the facility deadline was never in question.§101.605

What an inspector can ask for

The artifact list is the real test

Cyber compliance is checked at your regular vessel and facility inspections, by your regular inspectors, carrying a verification job aid. What they check is evidence: the approved plan current within its five-year cycle, each annual assessment report, the written CySO designation with a 24/7 contact, audit reports with independence evidence, training records with dates and attendees, drill and exercise records with corrective actions, the incident log with NRC report numbers, the asset inventory and network map, backup test records, and vendor remote-access logs.

Records are kept at least two years and produced on demand. The honest test of any compliance program is a records request answered in minutes — that standard, more than any technology, is what the rule actually demands of an operator.

14plan sections

2 + 1drills + exercise, yearly

5 daysnew-hire training clock

2 yrsrecords retention

If you carry a security plan today, you are in scope

Two obligations are already live

Eleven program areas, each with its own guide

The artifact list is the real test

Find out where your fleet actually stands.