New Maritime Cybersecurity Requirements Are Here — Is Your Organization Ready?
On January 17, 2025, the U.S. Coast Guard published a final rule establishing mandatory cybersecurity requirements for U.S.-flagged vessels, Outer Continental Shelf (OCS) facilities, and facilities subject to the Maritime Transportation Security Act of 2002 (MTSA). The rule became effective July 16, 2025.
If your organization falls under MTSA, compliance isn't optional — and the deadlines are already in motion.
| Deadline | Requirement |
|---|---|
| July 16, 2025 | Reportable cyber incidents must be reported to the National Response Center (NRC) without delay |
| January 12, 2026 | All personnel must complete required cybersecurity training |
| July 16, 2027 | Designate Cybersecurity Officer (CySO), complete Cybersecurity Assessment, and submit Cybersecurity Plan for USCG approval |
You must designate a Cybersecurity Officer responsible for implementing the Cybersecurity Plan and Cyber Incident Response Plan. The CySO ensures the plan stays current, arranges inspections, oversees training, records and reports incidents, and takes steps to mitigate them. This can be a full-time, collateral, or contracted position.
An assessment identifying vulnerabilities in your critical IT and OT systems, evaluating risks, and determining the potential for operational disruption or other harmful consequences. Required within 24 months of the effective date and annually thereafter.
A comprehensive plan submitted to the Coast Guard for approval. Must include:
Instructions on how to respond to a cyber incident, including identification of key roles, responsibilities, and decision-makers among personnel.
Required when renewing your Cybersecurity Plan. Results must be available to the Coast Guard upon request.
At least two cybersecurity drills per calendar year. At least one cybersecurity exercise per calendar year (no more than 18 months between exercises).
We built our services around the requirements maritime organizations face. Here's how we support USCG-2022-0802 compliance:
Our Blue Team works inside your network to evaluate your security posture, review policies and procedures, and help develop your Cybersecurity Plan. We assess the same areas the regulation requires: account security, device security, data security, and incident response readiness.
Penetration testing is required when renewing your Cybersecurity Plan. Our penetration testers, backed by Sterling7, deliver the documentation you need — including a notarized letter of attestation after issues are corrected.
A point-in-time snapshot of your security state. Useful for baseline assessments or ongoing verification between full engagements.
Ongoing support for organizations that need help maintaining compliance. From patch management to endpoint detection and response, we handle the security tasks so your team can focus on operations.
Let's talk about your organization's specific situation and build a path to compliance.
Schedule a Consultation