The Coast Guard’s cyber deadline is July 16, 2027.
If your towing vessels are covered by MTSA, you must name a Cybersecurity Officer, complete a cybersecurity assessment, and submit a plan. I’ll tell you whether you’re covered, in plain words, and get you there on a fixed price.
Are your tugs covered?
The cyber rule applies to U.S.-flag vessels that hold a Vessel Security Plan under 33 CFR Part 104. For towing, the test is in 33 CFR 104.105(a)(11).
Likely covered
- A towing vessel over 8 meters in registered length
- That is towing a barge itself subject to Part 104, such as a tank barge under 46 CFR subchapters D or O
Not covered, if this is all the tug does
- Temporarily assisting another vessel’s tow
- Shifting barges at a facility or within a fleeting facility
- Assisting sections of a tow through a lock
- Providing emergency assistance
What’s due, and when
The dates come from the Coast Guard’s final rule (33 CFR Part 101, Subpart F) and its October 2026 guidance, NVIC 02-26.
The rule took effect. Cyber incident reporting to the National Response Center, “without delay,” has applied since then.
Initial cybersecurity training was due for personnel with IT or OT access. Keep your records.
Deadline. Cybersecurity Officer designated, assessment completed, plan submitted for approval.
Six checkpoints between now and July
This is what I walk covered operators through.
Scope
List which tugs and barges are covered.
Officer
Name your Cybersecurity Officer. A third party can fill the role.
Inventory
Document the IT and OT that affect your operations: tug networks, navigation and engine systems, dispatch, remote access.
Assessment
One assessment can cover vessels with a similar footprint. The Coast Guard expects it repeated annually.
Plan
Written from the assessment. One plan can cover similar vessels but must address any differences in cyber risk.
Drills
Plan drills and an annual exercise, and document everything.
Fixed price, written scope
No hourly meter. You’ll know what you’re paying and what you’re getting before you sign.
Readiness Assessment
Which boats are covered, a documented cybersecurity assessment, a ranked gap list, and a readout call.
Operators with a fleet of similar vessels: from $6,500, scoped to your fleet.
Assessment + Cybersecurity Plan
Everything above, plus a submission-ready Cybersecurity Plan drafted from your assessment. Your assessment fee is credited if you add the plan within 30 days.
Outsourced Cybersecurity Officer
I act as your named Cybersecurity Officer: training oversight, drills and exercises, incident-response readiness, and annual assessment updates.
Security awareness training
Role-based cyber training for the personnel the rule requires you to train, with records you can show an inspector.
Prices are starting points. Final price depends on the number of vessels, systems and sites, and is set in writing before work begins.
How it works
20-minute call
You tell me what you tow and how. I tell you whether you’re covered and what to do first.
Written scope
A one-page scope with a fixed price and dates. You approve it, or you walk away.
Done, documented
You get the assessment, the plan or the officer coverage, and a file you can hand to the Coast Guard.
Who you’d be working with
I’m Laurence Kirby, founder of Spiral Security Advisors in Miami. I hold the C|CISO, CISA, CRISC, CDPSE, CEH and CTPRP certifications and have 20+ years across financial services, government and security software. I run the work myself. You won’t be handed to a junior.
I work with South Florida operators, and I’ll work with you remotely for as long as you need.
Questions operators ask
Do I have to hire you or any outside firm?
No. The Coast Guard says there is no requirement to hire a third party to conduct the assessment or develop the plan. What I offer is time saved, a named Cybersecurity Officer if you don’t have one, and a second set of eyes before you submit.
Is penetration testing required?
Not for the initial plan submission due July 16, 2027. It is addressed in the guidance as periodic testing in the five-year renewal cycle.
Will the Coast Guard approve my plan?
I can’t promise approval, and neither can anyone else. As of its January 2026 FAQ, the Coast Guard was not yet approving plans. The goal is a complete, defensible submission on time.
Does my tug need this if I only shift barges at a fleeting area?
Under 33 CFR 104.105(a)(11), a towing vessel that only shifts barges at a facility or within a fleeting facility is excepted. If the same tug also tows covered barges at other times, it may be covered. That’s the kind of detail the call resolves.
What happens if I miss the deadline?
I won’t guess at penalties. The deadline is in the rule, and the safest path is to submit on time. Ask the Coast Guard or your counsel what enforcement could look like for your situation.
Less than a year to go.
Operators who start in the next few months have time to do this properly. Operators who start in June do it in a rush.
Talk to me this weekSpiral Security Advisors LLC · Miami, Florida
Spiral Security Advisors provides advisory services. This page is general information, not legal advice, and is not a Coast Guard determination of coverage or approval. Spiral Security Advisors is not affiliated with the U.S. Coast Guard. Privacy Policy
Sources