Coast Guard Maritime Cybersecurity Rule: Requirements for MTSA Facilities
Rule Background and Applicability
CloudCentric is a managed IT provider in Mount Pleasant, South Carolina, serving businesses across Charleston and the Lowcountry. Phone (844) 422-7000.
The Coast Guard published the 'Cybersecurity in the Marine Transportation System' rule in the Federal Register on 2025-01-17 at 90 FR 6298, docket USCG-2022-0802. It took effect on 2025-07-16 and sits in 33 CFR part 101, subpart F.
It applies to owners and operators of U.S.-flagged vessels, Outer Continental Shelf facilities, and facilities required to have a security plan under 33 CFR part 105, the MTSA-regulated facilities. This covers waterfront plants on the Cooper, Wando, and Savannah rivers, but it does not apply to foreign-flagged vessels.
The Coast Guard asked for comment on a 2 to 5 year delay for U.S.-flagged vessels only; the subpart's text in the eCFR was unchanged from the 2025-07-16 version when checked on 2026-10-26.
Important Dates and Deadlines
From 2025-07-16, reportable cyber incidents must be reported to the National Response Center without delay.
By 2026-01-12, and annually after, all personnel with access to IT or OT systems, contractors included, must complete cybersecurity training, with OT-specific training for those who use OT.
By 2027-07-16 the owner must designate a Cybersecurity Officer, complete a Cybersecurity Assessment, and submit a Cybersecurity Plan to the Captain of the Port for approval.
The Cybersecurity Assessment is repeated annually, and sooner after a change of ownership.
An approved Cybersecurity Plan is valid for five years and is audited annually; a penetration test is required with each plan renewal.
Cybersecurity drills are required at least twice each calendar year, and an exercise at least once a year.
Network, Account, and Data Security
Under network segmentation, s.101.650(h), the facility must implement segmentation between IT and OT networks and verify that all IT-OT connections are logged and monitored.
Routine maintenance, s.101.650(e), requires that no OT may be connected to the public internet unless required for operation, with a documented justification for any remotely accessible OT system.
To secure the supply chain, s.101.650(f), the facility must monitor and document all third-party remote connections.
Account security, s.101.650(a), mandates that default passwords are changed before use, multifactor authentication is used on remotely accessible OT, separate credentials exist on critical systems, and credentials are revoked when a person leaves.
Resilience, s.101.650(g), requires critical IT and OT systems to be backed up, with backups protected and tested frequently.
For data security, s.101.650(c), logs must be securely captured and stored so only privileged users can reach them.
Physical Security and Device Tracking
Under device security, s.101.650(b), the facility must keep an inventory of network-connected systems and accurate documentation of the network map and OT device configuration.
Physical security, s.101.650(i), dictates that physical access to OT and related IT equipment is limited to authorised staff, and all HMIs and other hardware must be secured, monitored, and logged for personnel access.
The same clause requires unused physical ports to be blocked, disabled, or removed.
Implementing Controls with UniFi Solutions
CloudCentric does not write Cybersecurity Plans and gives no legal advice; the facility's Cybersecurity Officer owns the plan.
A UniFi network produces a live topology map and client list, which feed the network map and inventory the rule asks for; devices behind unmanaged switches still need a walk-down.
VLANs on UniFi switches and the zone firewall on the UCG-Industrial gateway separate IT from OT.
Vendor connections are moved onto a site-to-site or client VPN through the gateway, so each third-party connection has one logged path.
UniFi system logs can be exported in CEF format to a syslog server or SIEM.
UniFi Access door readers log every entry and denial, and UniFi Protect cameras record the room holding HMIs and network cabinets, on the same console as the network.
Limit: no UniFi product is certified to IEC 62443; a design can follow the standard's zones-and-conduits approach, but nothing is described as 62443 certified.
Limit: no UniFi page says the gateway firewall or IDS/IPS understands industrial protocols such as Modbus/TCP, EtherNet/IP, S7comm, PROFINET, or DNP3; rules between zones are written by address and port.