The Coast Guard Gave Tug Operators a Cyber Deadline. Here’s What I’d Do First.

,

Last week, walking my dog along the Miami River, I watched a towboat push a barge past the bridges. It struck me how little of what keeps that rig running is steel and diesel. There is a network on that boat, dispatch systems, and remote access somewhere. Most owners I talk to have never looked at any of it as a security question.

The Coast Guard is about to make them. Under the cyber rule in 33 CFR Part 101, Subpart F, covered operators must name a Cybersecurity Officer, complete a cybersecurity assessment and submit a cybersecurity plan by July 16, 2027. In October, the Coast Guard published NVIC 02-26 to explain what that looks like.

First, does it apply to you?

If you tow a barge that falls under MTSA, then yes. If you only assist another tow, shift barges at a facility, help a tow through a lock, or give emergency help, no. That exemption is in 33 CFR 104.105(a)(11). Read it against your own boats, not mine.

Two things I’d tell a friend running a small fleet

  1. You don’t have to hire anyone. The Coast Guard says outside help isn’t required for the assessment or the plan.
  2. Penetration testing isn’t part of the first submission. It comes later, in the five-year renewal cycle.

What I’d do between now and July

  • Write down which tugs and barges are covered.
  • Pick your Cybersecurity Officer. A third party can fill the role.
  • List every system on board and ashore that touches operations.
  • Run the assessment, then write the plan from it. One assessment and one plan can cover similar vessels.
  • Keep your training records. That requirement was due in January.

Need a hand?

I do this work for a living. I’m a CISO-level consultant with 20+ years in security and compliance, and I act as an outsourced Cybersecurity Officer for operators who don’t want to hire one full time. If you’re not sure whether you’re covered, book a free 20-minute call and I’ll tell you straight, even if the answer is that you don’t need me. You can also read the MTSA cyber checklist or see maritime fees.

Spiral Security Advisors provides advisory services only. This article is general information, not legal advice or a Coast Guard determination of coverage.