October 22, 2026
NVIC 02-26
October 19, 2026
NAVIGATION AND VESSEL INSPECTION CIRCULAR NO. 02-26
Subj: CYBERSECURITY REGULATIONS IMPLEMENTATION GUIDANCE FOR
MARITIME TRANSPORTATION SECURITY ACT (MTSA) REGULATED ENTITIES
1. PURPOSE.
This NVIC provides information and guidance on the implementation of
cybersecurity regulations for MTSA-regulated entities. These regulations were published in
the Federal Register on January 17, 2025 (90 FR 6298) and are available in Title 33, Code of
Federal Regulations, Part 101 (33 CFR 101). This NVIC is also intended to clarify the
regulatory text, aid the cyber risk management process for the maritime industry, and present the Coast Guard’s preferred means of complying with the subject regulations.
2. DISCLAIMER.
a. This NVIC is intended only to provide clarity regarding existing requirements under the
law. It does not change any legal requirements and does not impose new requirements on
the public. Not all recommendations will apply to all entities, depending on individual
operations, systems, equipment, or other factors. The Coast Guard recognizes that the
entities comprising the Marine Transportation System (MTS) are varied in cybersecurity
resources, programs, and overall/specific risks. Owners/operators may use a different
approach that has greater or lesser complexity than this NVIC recommends, if that
approach satisfies the applicable legal requirements. Entities are strongly encouraged to
utilize best practices and industry standards, such as the NIST Cybersecurity Framework,
and to mature their cybersecurity programs in a timely fashion to address evolving threats,
vulnerabilities, and associated risks.
b. Throughout this NVIC, “must”, “should”, and “may” are used purposefully. While the
regulations set minimum requirements and are generally referenced by “must,” the
guidance in “should” and “may” statements highlight recommended practices that are
consistent with global cybersecurity standards.
3. TIMELINE.
On January 17, 2025, the Coast Guard updated its maritime security regulations
by establishing minimum cybersecurity requirements for U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities required to have a security plan under 33 CFR Parts 104, 105, and 106. The cybersecurity regulations came into effect on July 16, 2025, and are available in 33 CFR 101 Subpart F. MTSA regulated entities are required to operate in accordance with this regulation and their submitted Cybersecurity Plan (CSP) as of July 16, 2027.