Marine Cybersecurity: Key Takeaways from the Coast Guard's Final Rule

The U.S. Coast Guard (USCG) published a final rule on January 17, 2025, addressing Cybersecurity in the Marine Transportation System (the “Final Rule”), which seeks to minimize cybersecurity-related transportation security incidents (“TSIs”) within the maritime transportation system (“MTS”) by establishing requirements to enhance the detection, response, and recovery from cybersecurity risks. Effective July 16, 2025, the Final Rule will apply to U.S.-flagged vessels, Outer Continental Shelf, and onshore facilities subject to the Maritime Transportation Security Actof 2002 (“MTSA”). The USCG also seeks comments on a potential two-to-five-year implementation delay for U.S.-flagged vessels. Comments are due March 18, 2025.

Background

The need for enhanced cybersecurity protocols within the MTS has long been recognized. MTSA laid the groundwork for addressing various security threats in 2002 and gave the USCG broad authority to take action and set requirements to prevent TSIs. MTSA was amended in 2018 to make clear that cybersecurity-related risks may cause TSIs to fall squarely within the authority of MTSA and USCG.

Over the years, the USCG and the International Maritime Organization have dedicated resources and published guidelines for addressing the growing cybersecurity threats arising as technology increasingly integrates into all aspects of the MTS. The USCG