Maritime cybersecurity
Cybersecurity programs for the Coast Guard's Marine Transportation System cyber rule.
Overview
The rule at 33 CFR Part 101, Subpart F requires owners and operators to name a Cybersecurity Officer, assess their networks, and submit a Cybersecurity Plan for Coast Guard approval. We build those pieces with you and keep them current year after year.
Who it is for
Owners and operators of U.S.-flagged vessels, facilities and Outer Continental Shelf facilities required to have a security plan under 33 CFR parts 104, 105 and 106.
What you get
- Cybersecurity AssessmentEvery network analyzed for vulnerabilities in critical IT and OT systems, as § 101.650(e)(1) requires, annually.
- Cybersecurity PlanDrafted to the rule's section format and amended as findings close, ready for COTP, OCMI or Marine Safety Center approval (§ 101.630).
- Cyber Incident Response PlanWritten, practiced and tied to reporting reportable cyber incidents to the National Response Center (§ 101.620).
- Training programAnnual training for all personnel with IT or OT access and the added topics for key personnel (§ 101.650(d)).
- Drills and exercisesDrills at least twice each calendar year and an exercise at least once, no more than 18 months apart (§ 101.635).
- Support for your CySOAnnual audits, KEV tracking and the records your Cybersecurity Officer has to keep (§ 101.625).
How an engagement runs
- 1ApplicabilityConfirm which vessels and facilities fall under Subpart F and who your CySO will be.
- 2AssessMap networks, IT and OT systems and remote connections; find what the rule asks for.
- 3PlanWrite the Cybersecurity Plan and the Cyber Incident Response Plan for approval.
- 4SustainTraining, drills, the annual exercise, the annual audit and the next assessment.
The rule's dates
From the current text of 33 CFR Part 101, Subpart F.
| Date | What is due |
|---|---|
| July 16, 2025 | The rule took effect. Reportable cyber incidents go to the National Response Center without delay. |
| January 12, 2026 | Cybersecurity training due for all personnel and key personnel, then annually. |
| July 16, 2027 | Cybersecurity Assessment complete and Cybersecurity Plan submitted to the Coast Guard for approval. |
More services
| Sheet | Title | Scope | Status |
|---|---|---|---|
| FC-101 | Fractional CISO | A security leader for organizations that cannot justify a full-time one. | |
| FC-103 | Custom solutions | We partner with companies to build the software their work needs. |
Talk to us about Maritime cybersecurity.
A person reads every message and answers, usually within one business day. No pricing page and no sales script: a conversation about your work.
FOXX CYBER LLCCOLORADO SPRINGS, CO
Drawn byJ. P. Price, CISSP, CISM
OwnershipVeteran-owned
FC-102
Contact sales