Coast Guard Cybersecurity Final Rule

Many of you have heard that the Coast Guard has released a new regulation concerning cybersecurity plans for vessels and facilities last week. The rumors are true. This is the “Final Rule”, which completes the process that started last February as a “Notice of Proposed Rulemaking”.

Seebald & Associates has taken a close look at this regulation and what it means for you as the Facility Security Officer. For all our clients, we can help you meet these requirements, which will help protect our nation and maritime industry from emerging cyber threats. The regulation focuses on well-recognized best practices but does not take a prescriptive approach or require specific technical solutions. In this way it follows the performance-based approach of existing Coast Guard security regulations but leaves questions to how these requirements will be enforced. We are working closely with the Coast Guard policy makers to determine what the compliance criteria is for these new requirements.

Coast Guard officials, including Captain Andrew Meyers, chief of the Coast Guard’s Port and Facility Compliance office, will be at our FSO Academy & Facility Security Symposium in Savannah February 24-27. This will be an ideal time to learn how the Coast Guard will interpret and enforce these regulations. I strongly encourage you to make every effort to attend this event. Of course, you can also reach out to any of us here at Seebald & Associates and we’ll do our best to answer your questions, or to pass them on to the Coast Guard.

A couple key requirements are vessel and facility operators must designate a Cybersecurity Officer (CySO) and it requires cybersecurity training for all personnel who use IT and OT systems and this training requirement becomes effective six months from now – July 17, 2025.

There are far too many regulations to cover in this blog, here is the link to the entire Final Rule. The executive summary highlights the deliverables well. For now, make sure that your senior leadership is aware of this new requirement, including the training requirement which is effective in only six months. In the meantime, we’ll send out more information as it becomes available, and we hope to see you in Savannah.