Incident reporting: the obligation that has been live since July 2025
Reportable cyber incidents have had to go to the National Response Center — 1-800-424-8802 — without delay since July 16, 2025. This is not a 2027 obligation. It is in force now, and most small operators have no written procedure for it.
The definition of a reportable cyber incident is broad: it reaches operational disruption, data breaches, and anything that could become a Transportation Security Incident. Uncertain-but-under-investigation counts. The rule expects the call, not a wait-and-see.
One NRC call also satisfies FBI notification. It does not satisfy CISA — entities covered under Part 6 must separately notify CISA at 844-729-2472 or SayCISA@cisa.dhs.gov.
What the rule requires
- Report without delay
- To the NRC, by phone, as soon as you know enough to report. The rule does not grant a business-hours grace period — 2 a.m. is when this procedure gets used.
- Know what is reportable
- Loss of confidentiality, integrity or availability on covered systems; operational disruption; data breach; anything that could become a TSI. When genuinely unsure, the safe posture is to report.
- The parallel CISA notice
- Part 6 entities notify CISA separately. One call does not cover both.
- Keep the incident log
- Incidents and their report numbers are logged and retained. The log is part of the records the Coast Guard can demand at inspection.
- An exercised response plan
- The Cyber Incident Response Plan must exist, be maintained, and be exercised — a binder nobody has opened does not satisfy the rule.
Write the script before you need it
The difference between a clean report and a bad night is a one-page script: the NRC number, the elements the operator will ask for, who calls, who is notified internally, and where the report number gets logged.
Reporting readiness is also the cheapest thing to fix today, and — with training — it is the compliance obligation an inspector can already check.
Straight answers
- What if we report something that turns out to be nothing?
- Nothing in the rule penalizes a good-faith report that resolves benignly. The exposure runs the other way — an incident you sat on while deciding whether it was serious.
- Does ransomware on the office network count, if the boats are fine?
- Almost certainly yes. Operational disruption and data breach are within the definition, and shoreside systems that dispatch, crew, or bill for vessels are covered IT.
- Who actually makes the call at 2 a.m.?
- Whoever your procedure names — which is the point of having one. In a fractional-CySO model, the on-call CySO makes or supervises the call and handles the CISA parallel notice where it applies.