Coast Guard Cybersecurity Training Requirements

This past January the U.S. Coast Guard published its “Final Rule” concerning cybersecurity plans for vessels and facilities, completing a multi-year effort to establish cybersecurity regulations for the maritime industry.

The regulations require vessel and facility operators to designate a Cybersecurity Officer (CySO) and develop written cybersecurity plans (CSP). Those requirements become effective in July 2027, so we have some time to prepare.

However, the regulations also include a cybersecurity training requirement that becomes effective January 12, 2026. This training requirement applies to all vessel and facility personnel who have access to IT or OT systems. It is focused on educating users to detect and avoid common cyber threats, such as phishing scams. Many organizations already have programs that likely satisfy the intent of the regulation.

We have spoken with officials at Coast Guard Headquarters on this matter. Their guidance is that vessel and facility operators should be prepared to provide training records that document the specific topics listed in the regulation. The person or organization providing the training should have the knowledge required of Cybersecurity Officers. We have also drafted FSP amendments that reflect these requirements for several clients. Including this requirement in the FSP, although not mandatory, is another way of demonstrating compliance and will eventually be required, once the entire CSP requirement becomes effective in 2027.

We continue to work with Coast Guard personnel at the national and local level. We expect that the Coast Guard will issue formal guidance on training and other cybersecurity requirements in the coming months. We will work with all of you to implement the requirements at that time. Until then, we should recognize that malicious cyber actors are some of the most serious threats we all face. Cybersecurity training for your crew is one of the best ways to address these risks.