New mandatory USCG cyber regulations. What you need to know

The US Coast Guard has issued mandatory Maritime Transportation System cybersecurity requirements effective July 16, 2025 (training to begin July 17, 2025) that apply to U.S.-flagged large commercial vessels and related port facilities; obligations include appointing a Cybersecurity Officer, developing Cybersecurity and Incident Response Plans, conducting penetration testing and two annual cybersecurity drills, and implementing technical controls such as multifactor authentication, network segmentation, device/data management, resilience measures, and supply chain safeguards, with compliance submissions due by July 16, 2027 and a comment period through March 18, 2025; the document also outlines consulting, testing, and training services to help maritime organizations meet these requirements.