The technical measures: what §101.650 actually asks your systems to do
Beneath the plan and the paperwork, the rule requires concrete technical controls. They are grouped under §101.650 and they are less exotic than the word cybersecurity suggests — most of them are the basics, made mandatory and made documentable.
The theme across all of them: the Coast Guard can ask for the artifact. An inventory that exists in someone's head, MFA that is enabled but undocumented, backups that have never been restore-tested — each is a finding waiting to be written.
The measures, by subsection
- Account security — §101.650(a)
- Auto-lockout on failed logins, default passwords changed, minimum password strength, MFA on password-protected IT and remotely accessible OT, least privilege, separate credentials for critical systems versus business email, and revocation when people leave.
- Device security — §101.650(b)
- An approved hardware and software list, executable code disabled by default on critical systems, and a full asset inventory with critical IT/OT flagged — plus a network map and OT configuration documentation, producible on request.
- Data security — §101.650(c)
- Secure log capture and storage with restricted access, encryption of sensitive data and IT-to-OT traffic where technically feasible, and records kept at least two years.
- Network segmentation — §101.650(h)
- IT segmented from OT, and every connection between them logged and monitored. On a workboat this is the line between the business network and engine monitoring; at a terminal, between the office and SCADA.
- Physical security — §101.650(i)
- OT access limited to authorized personnel, HMI and hardware access logged, unused ports blocked, disabled or removed, and no unauthorized media or hardware connections.
- Supply chain — §101.650(f)
- Cybersecurity as a procurement criterion, vendors obligated to notify you of incidents without delay, and third-party remote connections monitored and documented — the vendor VPN into your dispatch system is exactly what this subsection is about.
- Resilience — §101.650(g)
- A Cyber Incident Response Plan that is maintained and exercised, NRC reporting procedures, and backups of critical IT and OT that are protected and frequently tested.
Where small fleets actually stand
In practice, most 5–50 boat operators are missing the same five things: MFA on the dispatch and email systems, a written asset inventory, any IT/OT separation on newer boats, restore-tested backups, and vendor remote-access records. None of these is exotic. All of them are findable in an afternoon assessment, and most are fixable without new hardware.
The gap between where operators are and what the rule requires is real — but it is weeks of disciplined work, not a datacenter project. The expensive version of this rule is the one bought in a panic in June 2027.
Straight answers
- Does MFA have to go on everything?
- The rule requires it on password-protected IT systems and remotely accessible OT. The practical read for a small fleet: email, the TMS or dispatch system, remote-access tools, and anything a vendor reaches from ashore.
- Our engine monitoring came with the boat. Is it OT in scope?
- If its compromise could contribute to a Transportation Security Incident — and on the criticality test, maybe means yes — then it is a critical system: inventoried, segmented from business IT where feasible, physically protected, and its access logged.
- What does 'no OT on the internet without documented justification' mean for us?
- Exactly what it says: if a piece of operational technology is reachable from the internet, the rule expects a documented reason it must be — and monitoring around it. The default posture is that it is not.