Summary: NVIC 02-24 Change 1 (November 12, 2025)

Overview

The updated U.S. Coast Guard Navigation and Vessel Inspection Circular (NVIC) 02-24 Change 1, issued on November 12, 2025, provides comprehensive guidance regarding mandatory reporting requirements for security and cyber incidents within the U.S. Maritime Transportation System (MTS). This revision consolidates and clarifies three overlapping regulations that became effective between 2024 and 2025, aiming to harmonize requirements and reduce duplicate reporting. The NVIC emphasizes a “when in doubt — report” approach for stakeholders.

Key Regulations for NVIC 02-24 Change 1

• 33 CFR 101.305: Requires MTSA-regulated vessels and facilities to report any Breach of Security (BOS), Suspicious Activity (SA), or Transportation Security Incident (TSI).
• 33 CFR 6.16-1 (Executive Order 14116): Mandates all MTS stakeholders—including vessels, harbors, ports, and waterfront facilities, but excluding OCS facilities—to immediately report any actual or threatened cyber incident to the Captain of the Port (COTP), FBI, and CISA.
• 33 CFR 101.620: Directs OCS facilities, and any MTSA entity not already covered by 33 CFR 6, to report Reportable Cyber Incidents (RCI) to the National Response Center (NRC).

Reporting Requirements by Entity

Entity	BOS / SA / TSI	Cyber Incident (33 CFR 6)	Reportable Cyber Incident (RCI) (33 CFR 101.620)
MTSA-regulated vessels & facilities (33 CFR 104/105)	Yes → NRC (mandatory)	Yes → NRC (covers COTP + FBI) + CISA	No (already covered by 33 CFR 6)
Waterfront facilities, harbors, ports (non-MTSA)	No (unless MTSA-regulated)	Yes → NRC + CISA	No
OCS facilities (33 CFR 106)	Yes → NRC	No	Yes → NRC

Mandatory Actions Checklist

1. Breach of Security (BOS) or Suspicious Activity (SA) – MTSA Entities

• Report without delay to the National Response Center (NRC) at 1-800-424-8802.
• Optional: Notify the local Captain of the Port (COTP) directly, but NRC notification remains mandatory.

2. Transportation Security Incident (TSI) – MTSA Entities

• Vessels and facilities (104/105): Immediately notify the local COTP, then follow Vessel/Facility Security Plan procedures, which may include NRC notification.
• OCS facilities (106): Immediately notify the cognizant District Commander, then follow the facility’s security plan.

3. Cyber Incident (Actual or Threatened) – All Vessels, Harbors, Ports, Waterfront Facilities (Excluding OCS)

• Report immediately (without delay, as soon as safely possible) to the NRC at 1-800-424-8802. This single call satisfies reporting to both COTP and FBI, as NRC forwards reports to FBI CyWatch (cywatch@fbi.gov).
• Separately report to CISA via phone at (844) 729-2472 (844-Say-CISA), email at SayCISA@cisa.dhs.gov, or through the CISA Service Portal.

4. Reportable Cyber Incident (RCI) – OCS Facilities or MTSA Entities Not Subject to 33 CFR 6

• Report without delay to NRC at 1-800-424-8802.
• Do not report under 33 CFR 6 to avoid double reporting.

5. Criteria for a Reportable Cyber Incident/RCI

• Substantial loss of confidentiality, integrity, or availability of IT/OT systems.
• Disruption or significant adverse impact on operational capabilities or delivery of goods/services.
• Potential for serious injury, death, or major public health/safety impact.
• Disclosure or unauthorized access to large amounts of non-public personal information.
• Potential operational disruption to critical infrastructure.
• Any incident that may become a TSI.

Routine spam, normal port scans, or accidental plugging in of a USB stick are not reportable incidents.

6. Minimum Information Required in Every Report

• Identity of the reporting party (name and company).
• Exact location (address or latitude/longitude).
• Type of entity (vessel, facility, port, harbor).
• Brief description of the incident and actual or potential consequences.

7. Special Cases

• Unauthorized drone (UAS) over a facility or vessel should be reported as SA to NRC; if the drone lands, crashes, or flies below perimeter fence height, report as BOS.
• Prohibited item found after passenger/cargo screening at a cruise terminal should be reported as BOS.
• Loose ammunition found during screening (without a firearm) is generally not considered SA or BOS unless local law enforcement directs otherwise.

8. Recommended Actions (Not Mandatory)

• Participate in the local Area Maritime Security Committee (AMSC).
• Become familiar with the local Coast Guard Marine Transportation System Specialist – Cyber (MTSS-C).
• For free incident-response assistance, request Coast Guard Cyber Protection Team via NRC or email MaritimeCyber@uscg.mil.
• Consider joining FBI InfraGard.

Summary: One-Phone-Call Rule

For most entities in the maritime sector, except OCS facilities, a single call to the NRC at 1-800-424-8802 followed by notification to CISA fulfills all federal cyber-incident reporting obligations to the USCG, FBI, and CISA. It is recommended to keep this NVIC guidance and the one-page reporting flowchart in the Vessel/Facility Security Officer’s binder and ensure all watchstanders are trained accordingly.