# Coast Guard Issues Maritime Cybersecurity Guidance

The U.S. Coast Guard issued NVIC 02-26 explaining how MTSA-regulated U.S.-flagged vessels, port facilities, and Outer Continental Shelf facilities can implement the maritime cybersecurity requirements in 33 CFR Part 101, Subpart F, established by the January 2025 final rule. Covered operators must designate a qualified Cybersecurity Officer, complete a cybersecurity risk assessment, and submit a Cybersecurity Plan to the Coast Guard by July 16, 2027. Third-party assistance is optional, and penetration testing is not required for initial plan submissions.

- The guidance creates potential work in cybersecurity assessments, plan development, and IT/OT security support for covered maritime operators, but does not establish a Coast Guard contract or require operators to hire outside firms.
- Contractors should distinguish optional support services from operators’ mandatory obligations and avoid presenting penetration testing as a condition of initial plan submission.
- With the submission deadline on July 16, 2027, covered operators and prospective service providers have a defined timeframe to scope assessment and planning support.

**Jurisdictions:** federal
**Industries:** Public Safety, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 23, 2026

### Government Entities
- U.S. Coast Guard (USCG)

### Sources
- [
		US Coast Guard releases NVIC 02-26 to guide maritime operators on cybersecurity plans, IT and OT risk assessments - Industrial Cyber	](https://industrialcyber.co/transport/us-coast-guard-releases-nvic-02-26-to-guide-maritime-operators-on-cybersecurity-plans-it-and-ot-risk-assessments) - Industrial Cyber
- [Coast Guard Issues NVIC 02-26 Maritime Cyber Guidance](https://www.executivegov.com/articles/coast-guard-maritime-cybersecurity-guidance) - ExecutiveGov