The facility side of the rule: what terminals owe, and to whom
Most of the noise around the cyber rule is vessel noise. But Subpart F covers MTSA-regulated facilities with equal force: terminals handling dangerous cargoes, facilities serving foreign cargo vessels over 100 gross tons, facilities serving vessels carrying more than 150 passengers, and barge fleeting areas handling bulk dangerous cargo — the part 105 world, plus Outer Continental Shelf facilities under part 106.
For a facility, the rule arrives on familiar rails. You already hold a Facility Security Assessment and a Facility Security Plan; you already have a Facility Security Officer who answers to a Captain of the Port. The cyber rule adds a parallel structure — a Cybersecurity Assessment, a Cybersecurity Plan, a Cybersecurity Officer — that runs alongside what you have, not inside it.
One fact worth saying plainly: the delay conversation that hovered over vessels never included facilities. The facility deadline of July 16, 2027 has been firm since the day the rule published.
The facility particulars
- Submission goes to your COTP
- Facilities submit the Cybersecurity Plan to their cognizant Captain of the Port — the same office that holds your FSP — while vessels submit to the Marine Safety Center. Transmission is electronic via the DoD SAFE portal.
- The FSP stays; the CSP is its own document
- Your Facility Security Plan remains in force and unchanged in status. The Cybersecurity Plan is a separate fourteen-section document with its own approval, its own five-year cycle, and its own SSI handling. Cyber language added to an FSA under the old guidance era is a head start on the thinking, not a substitute for the submission.
- The OT sections do the heavy lifting
- Terminals are where the rule's operational-technology measures bite: network segmentation between IT and OT, physical security of OT with logged access to HMIs and hardware, unused ports blocked or disabled, and vendor remote connections monitored and documented. A facility's crane, gate, tank-gauging and access-control systems are exactly what those sections were written for.
- The FSO question
- The rule permits the Cybersecurity Officer to hold other duties, and at many facilities the FSO is the natural candidate on paper. The honest test is bandwidth: 24/7 federal reachability, an annual assessment and audit, two drills and an exercise, training records, and patch clocks — on top of the FSO's existing MARSEC duties. Outsourcing the role is explicitly permitted.
- Reporting runs on two tracks
- Reportable cyber incidents go to the National Response Center without delay, and certain entities must separately notify CISA — one call does not cover both. The reporting procedure belongs in writing, at the operations desk, before it is needed.
Why facilities are moving first
The Coast Guard's own regulatory analysis put the average small facility entity's compliance cost above ninety thousand dollars a year across the early years — more than one percent of revenue for over half of small facility owners. That math, plus a firm date and a familiar chain of command through the COTP, is why terminal operators have been the earliest serious movers on this rule.
There is also a quieter reason: facility inspections never stopped. The same inspectors who walk your facility for MTSA compliance now carry cybersecurity items in the same visit, and the training obligation for everyone with system access came due in January 2026. For a facility, the rule is not coming — it is already inside the fence.
Straight answers
- We addressed cyber in our FSA years ago under the Coast Guard's guidance. Are we covered?
- No. The guidance era asked facilities to consider computer-system vulnerabilities inside existing security plans; the final rule replaced that with a standalone Cybersecurity Plan, a named officer, and an annual assessment, each with its own requirements. The earlier work informs your assessment — it does not satisfy the rule.
- Does one plan cover multiple facilities?
- Facility owners average about three facilities each, and the rule's structure anticipates common ownership. How your plans are organized across sites is an early design decision worth making deliberately — with each facility's COTP relationship in mind.
- Can our FSO be the Cybersecurity Officer?
- The rule allows it — the CySO may hold other duties. Whether one person can carry both calendars is an operational question, not a legal one. A fractional CySO of record with the FSO running the ground game is the model the rule was written to permit.
- Was the facility deadline ever part of the delay discussion?
- No. The comment period on delay concerned vessel implementation only. Facilities have faced July 16, 2027 without qualification since the rule published in January 2025.