Cybersecurity Deadline Looms
On July 16, the Final Rule on Cybersecurity in the Marine Transportation System (MTS), published in January of this year, became effective. First published as a proposed rule back in February 2024, its comment period was extended.
According to Jones Walker, “The July 16, 2025, effective date represents not just a regulatory milestone, but the beginning of a fundamental transformation in maritime cybersecurity posture.”
The new rule contains an important deadline for towing companies: “By January 12, 2026, and annually thereafter, all personnel must complete the training specified in 33 CFR 101.650.”
New hires must complete the training within 30 days after hiring.
The final phase requires that owners and operators of covered facilities designate a cybersecurity officer (who must be available and on-call 24/7), conduct a cybersecurity assessment and submit a cybersecurity plan for approval by July 16, 2027. That window should give operators time to adjust and improve their cybersecurity plan, if need be.
The American Waterways Operators, as well as a number of maritime law firms, have been providing resources to help maritime companies comply with this new regulatory landscape. Many companies already have training policies in place, while others are still developing them. AWO has been working on a comprehensive cybersecurity document to include industry best practices and detailed information on how best to navigate in, and comply with, this new world of cybersecurity. AWO sources say they expect to release it within a few weeks and to present it at the organization’s fall convention October 15-16 in Houston.
Operators may find the new requirements to be redundant or unnecessary. Depending on the individual, they might be right. Our audience and the associations that serve them often have sound policies in place well before regulations are in effect, but there should be no question as to the risks that come along with improved connectivity and technology. With almost constant news of data breaches, ransomware and the like, and considering the national security implications of waterway transport, cybersecurity is indispensable — not just in the future, but now.
