Here is a list of cybersecurity final rule requirements and when they are required.

Cybersecurity Plan Requirements: Required by July 2027

  1. Develop and maintain:
    • Cybersecurity Plan including seven account security measures.
    • Cyber Incident Response Plan with instructions and roles for responding to incidents.
  2. Account Security Measures:
    • Enable automatic account lockout after repeated failed logins.
    • Change default passwords or implement compensating security controls.
    • Maintain minimum password strength.
    • Implement multifactor authentication for IT and remotely accessible OT systems.
    • Apply least privilege principle to administrator accounts.
    • Use separate user credentials for critical IT and OT systems.
    • Remove/revoke credentials when personnel leave the organization.
  3. Device Security Measures:
    • Maintain a list of approved hardware, firmware, and software.
    • Disable executable code on critical IT and OT systems by default.
    • Keep an accurate inventory of network-connected systems.
    • Develop and document network maps and OT device configurations.
  4. Data Security Measures:
    • Securely capture, store, and protect logs.
    • Deploy encryption for sensitive data and IT/OT traffic.

Personnel and Training:

  1. Appoint a Cybersecurity Officer (CySO) to: Required by July 2027
    • Oversee plan implementation.
    • Conduct audits and updates of the Cybersecurity Plan.
    • Arrange for cybersecurity inspections and training.
    • Record and report incidents.
  2. Training Requirements: Required by January 17, 2026
    • Complete cybersecurity training for all personnel within 6 months and annually thereafter.
    • Provide specific OT training for relevant personnel.

Drills and Exercises: Required by July 2027

  1. Conduct two cybersecurity drills annually.
  2. Conduct at least one cybersecurity exercise every calendar year.

Assessments and Documentation: Required by July 2027

  1. Conduct a Cybersecurity Assessment within 24 months and annually thereafter.
  2. Submit the Cybersecurity Plan to the Coast Guard for approval within 24 months.
  3. Maintain penetration test results and ensure their availability to the Coast Guard.

Compliance and Reporting: Required by July 2027

  1. Report all cybersecurity incidents to the National Response Center (NRC) immediately.
  2. Request waivers or equivalency determinations for specific requirements if needed.