Subpart F, IMO, IACS, Sub M: sorting the cyber rules that actually apply to you
Maritime cybersecurity has an acronym problem. IMO resolutions, class-society unified requirements, NIST frameworks, Coast Guard circulars and now a federal rule all get said in the same breath, and vendors who serve international shipping tend to list all of them, leaving you to work out which one carries a penalty for your operation.
For a U.S.-flagged towing company or an MTSA-regulated terminal, the answer is short: 33 CFR Part 101 Subpart F is the binding one. Its applicability section names you directly — owners and operators of U.S.-flagged vessels holding a Vessel Security Plan under 33 CFR part 104, MTSA-regulated facilities under part 105, and Outer Continental Shelf facilities under part 106.
Everything else on the conference slide is either someone else's obligation, guidance rather than law, or already inside Subpart F. Sorting that out is the first ten minutes of every readiness call we hold, so here it is in writing.
The regimes, one by one
- 33 CFR Part 101 Subpart F — the one that binds you
- The Coast Guard's cybersecurity rule, effective July 16, 2025, with the Cybersecurity Plan due July 16, 2027. A named Cybersecurity Officer, an annual assessment, the fourteen-section plan, training, drills, technical measures, and records — enforced through the same inspections you already receive, at $43,527 per violation, per day.
- IMO MSC.428(98) — internationally trading ships
- The International Maritime Organization's resolution folds cyber risk into the safety management systems of SOLAS ships on international voyages. If your fleet is domestic brown-water tonnage, this is not your regime — and a vendor leading with IMO language is telling you who their usual client is.
- IACS UR E26 and E27 — newbuild class rules
- Classification-society unified requirements for the cyber resilience of new ships and their installed systems, applied through class during design and construction. They matter if you contract new tonnage to class; they do not reach your existing fleet, and they do not substitute for Subpart F.
- Subchapter M — your safety regime, not your cyber regime
- The towing-vessel inspection regime under 46 CFR lives in a different title of federal law and contains no cybersecurity requirements. Your TSMS and its audits do not cover the cyber rule, and the cyber rule does not touch your COI. Two clocks, two bodies of evidence.
- NVIC 01-20 and the guidance era
- Before the rule, the Coast Guard addressed facility cyber risk through guidance that asked facilities to fold computer-system vulnerabilities into their security assessments and plans. That era ended when the final rule published: guidance became regulation with its own sections, deadlines and penalties. Work done under the old guidance is a head start, not compliance.
- CIRCIA and the reporting overlap
- CISA's separate incident-reporting rule remains unfinished. The operative reality today: reportable cyber incidents go to the National Response Center without delay, and certain entities also notify CISA separately. One call does not always cover both.
The applicability test, honestly run
The gate is §101.605, and it works by reference: if a vessel carries a Vessel Security Plan under part 104, or a facility holds a security plan under part 105, the cyber rule attaches. Foreign-flagged vessels are outside Subpart F but must still report cyber incidents as hazardous conditions.
Two edges catch people. Holding a pre-existing MTSA waiver does not exempt you — the Coast Guard confirmed in July 2026 that waiver holders must still complete a Cybersecurity Assessment and, if warranted, request a Subpart F waiver by July 16, 2027. And requirements attach to critical IT and OT systems under a deliberately broad test: if a system's compromise could contribute to a transportation security incident, and the honest answer is yes or maybe, it is critical.
Straight answers
- We are audited under Subchapter M. Does that cover cyber?
- No. Sub M is a safety regime under 46 CFR with no cybersecurity content. The cyber rule is 33 CFR Part 101 Subpart F, with its own plan, its own auditor-independence requirement, and its own records. Your TSMS audit and your cyber audit are different events.
- Our new boat is being built to class with E26 compliance. Are we done?
- No. E26 governs how the vessel is designed and built; Subpart F governs how your company operates — the officer, the plan, the training, the drills, the records. A cyber-resilient newbuild still sails inside a company program the Coast Guard must approve.
- We are foreign-flagged. Does any of this reach us?
- Subpart F does not apply to foreign-flagged vessels, but cyber incidents must still be reported as hazardous conditions under the amended reporting rules. If you also operate a U.S. facility under part 105, the facility is covered in full.
- We already hold an MTSA waiver. Are we exempt?
- No. The Coast Guard confirmed that pre-existing waiver holders must complete the Cybersecurity Assessment and, if relief is warranted, request a Subpart F waiver by July 16, 2027. The assessment comes first in every path.