The recently released Executive Order (EO) on Maritime Cybersecurity to quote SC Media “was long on lofty policy goals and short on specifics. For example, today’s release did not outline what the new cyber standards are and any specifics on the reporting time period.”

A key point for ALL maritime stakeholders is that the Coast Guard has announced proposed rulemaking that includes a public comment period as part of the standard rulemaking process. Stakeholders – especially FSO’s should absolutely get involved in this process with their IT/OT professionals.

This EO potentially revises Captain of the Port (COTP) authority that will give the COTP the ability to control vessel/facility operations for any clear cyber problem, no need to wait for the bad thing to happen. An analogy might be that in the physical world, if the inspector sees your steering linkage consists of twine, the COTP can say “do not operate” without waiting for the accident. Presumably a known cyber problem, like known malware in the system or a glaring vulnerability, would be the same.

Our advice is that large and medium sized facilities are, or should be doing most of these things (example: use Multi-Factor Authentication for remote access) already, so for them, it is more about putting that in a plan than reinventing their practices. Smaller facilities, where the “network” consists of a home wi-fi, 4 laptops, and a printer, and the consequences of the network going down are essentially zero? These facilities are going to need another option. If the cyber part of the FSA finds no consequences to hacks, then maybe the cyber plan for them could be minimal.

The Bottom Line – FSO’s need to get involved with their IT/OT staff and involve them in your feedback to the Coast Guard through the regulatory process!