If you operate an MTSA-regulated facility, a U.S.-flagged vessel or an OCS facility, the Coast Guard just told you how it expects your cyber rule submission to look.
On 20 October, the U.S. Coast Guard released Navigation and Vessel Inspection Circular (NVIC) 02-26. It is the compliance guide for the Marine Transportation System cyber rule in 33 CFR Part 101, Subpart F, which took effect on 16 July 2025. The circular walks owners and operators through the three things the Coast Guard has to approve by 16 July 2027: a designated Cybersecurity Officer (CySO), a Cybersecurity Assessment, and a Cybersecurity Plan.
What is in NVIC 02-26:
• Enclosure 1: section-by-section recommendations for writing the Cybersecurity Plan.
• Enclosure 2: a sample CySO designation letter.
• Enclosure 3: penetration testing expectations for the five-year plan renewal cycle, with safety measures for OT. Initial 2027 submissions do not need a penetration test.
• Enclosure 4: an optional risk-filtering method based on the NIST Cybersecurity Framework to scope the environment, find the critical IT and OT systems, and weigh the interdependencies between them.
The rule stays performance-based. The Coast Guard sets the standard, and each owner or operator decides how to meet it. The Coast Guard also states that hiring a third party to do the assessment or write the plan is not required.
Who this affects, from the dock to the cloud:
• Terminals and port facilities: cargo handling, tank farm and transfer controls, gate and access systems, and the DCS or SCADA behind them.
• Vessels: navigation, propulsion, ballast and cargo systems, and the shore links that reach them.
• OCS facilities: offshore production controls and the remote access paths back to shore.
• Enterprise and cloud: the IT systems, vendors and remote support connections the OT depends on.
What the Red Tiger team recommends now:
1. Put a name on the CySO role. Use the sample letter in Enclosure 2 and make sure that person has the authority to work across the security, IT and operations teams.
2. Scope before you assess. Walk the facility from the perimeter down to the field devices, build the asset inventory, and use the Enclosure 4 risk-filtering method to decide which IT and OT systems are critical and how they depend on each other.
3. Write the plan to Enclosure 1. Map each section of your Cybersecurity Plan to the circular's recommendations so the Coast Guard reviewer can follow it, and tie it to the Facility Security Plan you already have.
4. Get ahead of the penetration test. It is not required for the first submission, but plan now for how a test will run safely on live OT during the five-year renewal.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Coast Guard Maritime Cyber resource center (NVIC 02-26): https://www.uscg.mil/MaritimeCyber/
Coverage: https://www.executivegov.com/articles/coast-guard-maritime-cybersecurity-guidance
Check out our resources and book a follow-up call with our team.
