Cybersecurity Assessment – Make the Most of It!

We are now just over a year from the date when facility and vessel operators must have an approved Cybersecurity Plan (CSP) as required by the Coast Guard’s new Subchapter F Cybersecurity regulations. We at Seebald & Associates are in contact with the U.S. Coast Guard, officials, and they tell us that the service is hard at work on appropriate policy guidance to help us all meet those requirements on time.

While we wait on that guidance, we can review the existing regulations, including the requirement to perform a Cybersecurity Assessment (CSA) before submitting the first CSP. This process is similar to that of performing a Facility or Vessel Security Assessment to serve as the foundation for a Facility Security Plan or Vessel Security Plan.

A number of small companies are already grumbling that they have “zero cyber exposure” and should therefore be exempt from these requirements. There are certainly waterfront facilities where the only technology present is the FSO’s mobile phone. However, those same waterfront facilities are probably supported by a larger IT network that, if compromised, might disrupt critical business activities, such as scheduling vessels and workers, communicating critical information, or otherwise enabling seamless operations.

While Coast Guard regulations list many individual subtopics to consider in the Facility Security Assessment process, Cybersecurity Subchapter F lists only two subtopics which speak directly to CSA technical requirements. They are:

• Analyze all networks to identify vulnerabilities to critical IT and OT systems and the risk posed by each digital asset.
• Document and ensure patching or implementing of documented compensating controls for all KEVs in critical IT or OT systems, without delay.

This list is short, but powerful. And if done right, a good initial CSA can limit your overall regulatory exposure and improve your company’s cyber resilience.

Let’s start with limited regulatory exposure.

So to determine if your exposure is really as little as you think, do what the regulation says and analyze all networks to identify vulnerabilities to critical IT and OT systems. Many, perhaps most of your networks and systems will not be “critical”. In those cases, you simply must document that they are segregated from genuinely critical systems by appropriate technical and administrative means. What’s left is what your CSP will address, so congratulations, you have just limited your regulatory exposure.

In some cases, “what’s left” will be so limited that you will be a good candidate for an exemption from all Subchapter F requirements. But the key to that decision is a robust, detailed CSA with plenty of documentation. Take the time to do it well, and you will benefit.

Now let’s talk about how to use the CSA to improve your cyber resilience, regardless of Coast Guard requirements.

Again, I take you back to the requirement to analyze all networks. As we know, many of those networks will not be critical or could not cause or contribute to a Transportation Security Incident, even taking the broadest possible interpretation. That doesn’t mean they are not important to your business. Done properly, a CSA will likely find all manner of systems that have avoided the notice of busy IT and OT managers. Software that is no longer used or supported. User accounts for employees who left the company months ago. Wireless printers or other low-drama hardware that lacks the protection it should have. Connections between systems that don’t need to be connected, or that should at least be better monitored. Lurking spyware or levels of data transmission orders of magnitude beyond what normal business activity requires. If you look, you will find.

Most of these issues may not require immediate attention, but a well-done CSA gives you the chance to identify them and discuss risk management (and budget!) with company senior leadership. Once you’ve identified and discussed potential vulnerabilities, your CySO can “document and ensure patching or implementing of documented compensating controls”, as the CSA regulations require. The process will lead to changes that will improve your cybersecurity for both Coast Guard and non-Coast Guard regulated systems.

If you have any questions regarding your cyber regulatory exposure, please contact Rich Sundland at: richsundland@seebald.com