Foundations, Statutory Authority & Regulatory Frame
Sections 0 through 5: Regulatory basis, applicability, mapping, timeline, and authoritative definitions.
Section 0 — How to Use This Guide & Document Conventions
The CIRP is one of a small number of documents that Subpart F requires you to actually operate, not merely write. The four verbs in 33 CFR § 101.650(g)(2) are cumulative, and each is separately auditable:
Write a discrete, controlled, approved document with owners and version control.
Put into force: named people, trained, tooled, 24/7 reachable, usable procedures.
Keep current: reviews, amendments, contact re-validation, lessons learned.
Prove it: drills, tabletops, functional tests, documented with corrective actions.
Section 1 — Regulatory Basis & Statutory Authority
"(g) Resilience. Each owner or operator or designated CySO of a U.S.-flagged vessel, facility, or OCS facility must ensure the following measures for resilience are in place and documented in Sections 3 and 9 of the Cybersecurity Plan:
(1) For entities that have not reported to the Coast Guard pursuant to, or not subject to, 33 CFR 6.16-1, report reportable cyber incidents to the NRC without delay;
(2) In addition to other plans mentioned in this subpart, develop, implement, maintain, and exercise the Cyber Incident Response Plan;
(3) Periodically validate the effectiveness of the Cybersecurity Plan through annual exercises, annual reviews of incident response cases, or post-cyber-incident review, as determined by the owner or operator; and
(4) Perform backup of critical IT and OT systems, with those backups being sufficiently protected and tested frequently."
Statutory Authority Chain: 46 U.S.C. 70101–70104, 70124 (Maritime Transportation Security Act - MTSA); Executive Order 12656; 33 CFR 1.05-1, 6.04-11, 6.14, 6.16, 6.19 (COTP Port Security Authority); DHS Delegation 00170.1; Final Rule 90 FR 6447 (Jan. 17, 2025).
Section 2 — Applicability & Scoping Decisions
| Covered Entity Category | Governing Security Subchapter | Records Retention Citation |
|---|---|---|
| U.S.-Flagged Vessels subject to MTSA | 33 CFR Part 104 (VSP) | 33 CFR 104.235 |
| Waterfront Facilities (ports, terminals) | 33 CFR Part 105 (FSP) | 33 CFR 105.225 |
| Outer Continental Shelf (OCS) Facilities | 33 CFR Part 106 (OCS FSP) | 33 CFR 106.230 |
Section 3 — Where the CIRP Lives: Cybersecurity Plan Crosswalk
| § 101.650 Measure | Measure Group | Required Plan Section | CIRP Operational Relevance |
|---|---|---|---|
| (a) Account Security | Credentials & MFA | Section 7 | Mass password reset, token revocation, account disable. |
| (b) Device Security | Inventories & Maps | Section 6 | Hardware/software whitelists, network maps, OT baselines. |
| (c) Data Security | Secure Logging | Section 4 | Privileged log access, forensic log preservation. |
| (d) Training | Personnel Readiness | Section 2 & 4 | Threat recognition, incident reporting to CySO, role training. |
| (e) Risk Management | Assessment & KEVs | Section 11 & 12 | Annual assessment, KEV patching "without delay". |
| (f) Supply Chain | Vendor Connections | Section 4 | Vendor incident notification, 24/7 remote monitoring. |
| (g) Resilience (CIRP) | CIRP, Backups, NRC | Section 3 & 9 | The CIRP document (Sec 9), exercise schedule (Sec 3). |
| (h) Segmentation | IT/OT Boundary | Section 7 & 8 | IT/OT boundary isolation, conduit logging for traversal. |
| (i) Physical Security | HMI & Media Protection | Section 7 & 8 | HMI access logs, physical port disabling, media blocking. |
Section 4 — Codified Compliance Timeline
Subpart F Effective Date. Immediate mandatory NRC reporting active.
Personnel cybersecurity training complete (§ 101.650(d)(4)).
First Cybersecurity Assessment complete & CySO designated in writing.
CIRP maintained, exercised annually (g)(3), backups tested frequently (g)(4).
Section 5 — Key Regulatory Definitions (§ 101.605)
An occurrence that jeopardizes without lawful authority the confidentiality, integrity, or availability of information or an information system.
An incident resulting in substantial loss of CIA, operational disruption, public safety impact, or nonpublic personal data access. Triggers NRC notification without delay.
The qualified individual designated in writing by the owner/operator with authority to implement cybersecurity measures and serve as official contact.
IT: Enterprise data systems.
OT: Programmable systems monitoring/controlling physical processes (ECDIS, SCADA, PLCs, cargo pumps, propulsion).
Building the Cyber Incident Response Plan
Sections 6 through 8: Pre-work, document architecture, and chapter-by-chapter drafting guidance.
Section 6 — Pre-Work & Mandatory Inputs
A CIRP written without these 10 inputs will fail both operationally and on Coast Guard inspection. Conveniently, each input is already mandated elsewhere in § 101.650:
Unique ID, location, IT/OT tier, business/safety function, IP/VLAN, patch owner.
IT/OT conduits, firewalls, jump hosts, satcom links, vendor remote access paths.
Baseline used during incidents to detect unauthorized executables or rogue hardware.
Privileged-only access logs, time synchronization source, tamper-proof retention.
Section 7 — CIRP Document Architecture (15 Chapters)
Section 8 — Detailed Chapter Drafting Guidance & Model Text
Chapter C1 Model Drafting Text (Copy-Paste Template)
================================================================================
CHAPTER 1: PURPOSE, REGULATORY AUTHORITY & PLAN SCOPE
================================================================================
1.1 PURPOSE: This Cyber Incident Response Plan (CIRP) provides predetermined
operational instructions to identify, report, contain, eradicate, and
recover from cyber incidents affecting IT and OT systems on [ASSET NAME].
1.2 STATUTORY BASIS: Mandated under United States Coast Guard regulations in
33 CFR § 101.650(g)(2) (Subpart F). Documented in Sections 3 and 9 of the
Cybersecurity Plan.
1.3 PRECEDENCE: Physical safety of navigation, human life, and environmental
protection outrank all cyber containment actions. The Master / FSO retains
overriding authority per 33 CFR Parts 104/105/106.
C5: Two-Axis Incident Severity & Classification Scheme
| Severity Level | Qualifying Criteria | Operational Actions | Regulatory Reporting Trigger |
|---|---|---|---|
| SEV-1 Critical | Tier 1 OT impact, safety/navigation risk, active ransomware across critical IT/OT. | Activate full CIRT, switch OT to local manual control, sever IT/OT boundary. | NRC WITHOUT DELAY (< 2 Hours) |
| SEV-2 High | Compromise of critical IT or remote OT session without immediate safety impact. | Isolate hosts, disable compromised domain accounts, engage IR retainer. | Within 4 Hours (CISA / CySO) |
| SEV-3 Moderate | Contained single-host malware on non-critical IT, rapidly reset credential phishing. | Standard IT remediation, re-image system, log in incident register. | Internal Tracking (24 Hours) |
| SEV-4 Minor | Blocked port scans, spam, failed brute-force login attempts within lockout. | Automated logging, roll up into monthly logs for annual review. | Monthly Log Review |
C6: Internal CySO Triage Decision Gate (Logic Sequence)
STEP 1: Incident report received -> Assign Incident ID -> Open Form B-2 Log.
STEP 2: Is safety, navigation, propulsion, or cargo stability threatened? YES -> Notify Master/FSO immediately. Execute manual override.
STEP 3: Apply 33 CFR § 101.605 Reportable Cyber Incident definition. Document determination in Form B-3.
STEP 4: If REPORTABLE or UNCLEAR -> Execute National Response Center (1-800-424-8802) notification WITHOUT DELAY.
C8.2: The Cardinal OT Containment Rule
Mandatory Rule: Never take a containment action on an Operational Technology (OT) system without explicit OT Lead / Chief Engineer concurrence and a verified safe state. Disconnecting or powering down an OT controller can induce the exact physical safety consequence the threat actor intends.
Operational Incident Playbook Library (PB-01 to PB-12)
Predetermined technical response procedures tailored for Maritime IT and OT environments
PB-01: Ransomware Attack on IT or OT Network
SEV-1 Critical- Isolate Hosts Immediately: Disconnect infected workstations/servers from Ethernet and Wi-Fi. Do NOT power off systems to preserve volatile memory RAM forensics.
- Sever IT/OT Boundary: Unplug or disable the firewall gateway bridging IT and OT networks (§ 101.650(h)(1)).
- Revoke Domain Credentials: Disable compromised user accounts and terminate active Active Directory/VPN sessions (§ 101.650(a)).
- Execute NRC Reporting: Notify National Response Center at 1-800-424-8802 without delay.
- Verify Backup Integrity: Confirm offline air-gapped backups (§ 101.650(g)(4)) are uncorrupted before restoring.
PB-02: OT / SCADA / Propulsion / Cargo SCADA Disruption
SEV-1 Safety Risk- Safety First: Notify Chief Engineer and Master/FSO immediately. Physical stability and human safety take precedence over data collection.
- Manual Override Transition: Switch affected OT machinery (steering, propulsion, ballast valves, gantry cranes) to local manual control mode.
- Air-Gap Isolation: Physically disconnect remote vendor access modems and IT network links.
- Capture Telemetry State: Photograph HMI alarm screens, PLC status LEDs, and local panel fault codes.
- Notify COTP: Notify USCG Sector COTP if vessel maneuvering or terminal loading capability is impaired.
PB-03: Business Email Compromise (BEC) / Account Takeover
SEV-2 High- Revoke Sessions: Terminate all active M365/Google Workspace sessions and reset user password with MFA re-enrolment (§ 101.650(a)).
- Audit Mail Rules: Inspect mailbox for unauthorized inbox forwarding rules, hidden folders, or altered wire transfer instructions.
- Financial Recall: If wire fraud occurred, notify banking partners immediately and execute IC3.gov financial chain recall.
PB-04: Third-Party Vendor Remote Connection Compromise
SEV-2 High- Terminate Sessions: Kill all active remote VPN/SSH vendor sessions immediately via firewall management console (§ 101.650(f)(3)).
- Issue Written Vendor Demand: Demand written vulnerability/incident details from vendor security desk per contractual duty (§ 101.650(f)(2)).
- Audit Remote Connection Logs: Review 90-day remote access logs for unauthorized commands or lateral movement into OT networks.
PB-05: Unauthorized Removable Media / Device Connected to OT
SEV-2 High- Physical Seizure: Safely remove unauthorized USB drive or rogue cellular modem. Place in anti-static evidence bag.
- Disable Physical Switch Ports: Lock down affected RJ45 switch port via network interface (§ 101.650(i)(2)).
- Audit Approved List: Compare device signature against approved hardware list (§ 101.650(b)(1)).
PB-06: GPS / GNSS Spoofing & ECDIS Navigation Anomaly
SEV-1 Navigational Risk- Cross-Validate Navigation Data: Compare GNSS position against visual bearings, terrestrial radar, and dead-reckoning.
- Switch Sensor Feeds: Change ECDIS position input feed to secondary independent sensor or manual mode.
- Notify VTS & Traffic: Inform local Vessel Traffic Service (VTS) and nearby ships via VHF Channel 16 of GPS anomaly.
PB-07: Malicious or Negligent Insider Activity
SEV-2 High- Revoke Physical & Logical Access: Immediately disable user credentials and confiscate access badges/keys (§ 101.650(a)).
- Preserve Forensic Logs: Freeze user activity logs, endpoint keystrokes, and physical HMI badge entry logs (§ 101.650(c)(1)).
- Escalate to Legal/HR: Engage HR, legal counsel, and law enforcement if criminal sabotage or IP theft is suspected.
PB-08: Unauthorized Access to Exposed Internet Service
SEV-2 High- Block Source IP: Place immediate firewall drop rule on attacking IP addresses or geographic ranges.
- Close Vulnerable Port: Unbind internet-facing service or enforce IP-whitelisted VPN access (§ 101.650(e)(3)(iv)).
- Audit Exposure: Perform memory and log analysis to determine if remote code execution (RCE) occurred.
PB-09: Denial of Service / Satcom Outage
SEV-3 Moderate- Switch Comms Channel: Fail over to secondary satellite link (Iridium/Inmarsat) or terrestrial cellular backup.
- Engage ISP: Request upstream DDoS mitigation or traffic scrub from satcom provider.
- Verify Local OT Stability: Confirm local vessel/facility OT operates autonomously without cloud link.
PB-10: Data Exfiltration / Extortion Without Encryption
SEV-2 High- Identify Exfiltration Conduit: Block egress protocols (FTP, MEGA, Cloud Storage API) at perimeter firewall.
- Scope Data Sensitivity: Determine if nonpublic personal data, SSI, or proprietary CAD drawings were stolen.
- Notify Regulators & Counsel: Engage legal team to evaluate state breach laws and CIRCIA exfiltration reporting rules.
PB-11: Emergency KEV Remediation Path (§ 101.650(e))
Regulatory Trigger- KEV Identification: Identify critical IT/OT system matching CISA Known Exploited Vulnerability catalog.
- Emergency Patch Execution: Deploy vendor patch without delay. If patching is infeasible, deploy documented compensating control (§ 101.650(e)(3)(i)).
- Record in Assessment: File remediation entry in Cybersecurity Assessment and VSA/FSA/OCS FSA records.
PB-12: Loss of Logging / Monitoring Capability
SEV-2 High- Investigate Log Cessation: Check syslog daemons, SIEM agents, and firewall log forwarders for intentional disabling.
- Assume Active Compromise: Treat logging failure as potential anti-forensic activity by threat actor. Elevate severity.
- Restore Local Buffering: Re-enable local syslog buffering to protected storage media (§ 101.650(c)(1)).
Operations, Maintenance, Exercises & Records
Sections 10 through 14: Implementation proof, exercise program, and records retention.
Section 10 — Implementation Checklist & Evidence Artifacts
Signed by owner/operator with explicit 24/7 authority to order containment and disconnection.
Tested satellite phone numbers and pre-printed call trees distributed on bridge/control room.
Physical binder verified present aboard vessel/at facility during power/network outages.
Contracts carrying mandatory vendor incident reporting duties without delay (§ 101.650(f)(2)).
Section 12 — Exercise Program, 12 Maritime Scenarios & Safety Rules
Under 33 CFR § 101.650(g)(3), entities must validate CIRP effectiveness through annual exercises, annual case reviews, or post-incident reviews.
12 Maritime Exercise Scenario Bank Ideas
Section 13 & 14 — Records Retention & Plan Amendment Process
Records must be retained per 33 CFR 104.235 (Vessels), 105.225 (Facilities), or 106.230 (OCS Facilities) for at least 2 years. Material changes flowing from exercises or incidents must be processed as formal Cybersecurity Plan amendments under 33 CFR § 101.630(e).
Assurance, Self-Audit & Standards Crosswalk
Sections 15 through 17: Audit readiness checklist, framework mapping, and common inspector findings.
Section 15 — USCG Inspection Audit Readiness Checklist
Section 16 — International Standards Crosswalk
| CIRP Chapter | NIST CSF 2.0 | NIST SP 800-61 / 800-82 | IEC 62443 / IMO / IACS UR E26/E27 |
|---|---|---|---|
| Roles & RACI (C3) | GV.RR, RS.MA | NIST SP 800-61 Sec 2 | IMO Resolution MSC.428(98) |
| Detection & Triage (C6) | DE.AE, DE.CM | NIST SP 800-92 Logging | IEC 62443-3-3 System Security |
| NRC Notification (C7) | RS.CO-02 | USCG Subpart F (g)(1) | 33 CFR 6.16-1 / CIRCIA |
| OT Containment (C8/C9) | PR.IR, RS.MI | NIST SP 800-82r3 OT Security | IACS UR E26 / E27 Cyber Resilience |
| Backups & Restore (C12) | RC.RP, PR.DS | NIST SP 800-34 Contingency | BIMCO Guidelines Onboard Ships |
Section 17 — Common Inspection Deficiencies & Corrective Fixes
Plan only covers corporate email with no mention of OT, SCADA, ECDIS, or manual machinery overrides.
✔ Fix: Add OT Playbooks (PB-02) and Chief Engineer manual control procedures.Plan requires prior legal or executive approval before calling NRC, causing unlawful reporting delay.
✔ Fix: Pre-authorize CySO in writing to report to NRC without delay.Annexes: Forms Suite, Scripts, Quick-Card & Glossary
Annexes A through E: Operational recording forms, notification scripts, bridge card, and verification notes.
Annex A — Interactive Form Suite (Forms B-1 to B-8)
FORM B-1: CYBER INCIDENT INITIAL REPORT (Submit to CySO Immediately)
================================================================================
Reporter Name / Rank: ________________________ Date/Time (UTC): ________________
Vessel / Facility Location: ___________________ System Affected: _______________
Description of Anomaly: _______________________________________________________
Is Safety, Navigation, or Cargo Stability Impaired? [ ] YES [ ] NO
Initial Severity Assigned: [ ] SEV-1 [ ] SEV-2 [ ] SEV-3 [ ] SEV-4
CySO Acknowledgment Signature: __________________ Date: _______________________
FORM B-2: INCIDENT RUNNING LOG (Contemporaneous Append-Only Record)
================================================================================
Incident ID: CIRP-2026-______
Time (UTC) | Actor / Role | Action Taken / Decision / Event | Auth By
-----------+--------------+----------------------------------+------------------
| | |
| | |
FORM B-3: REPORTABLE CYBER INCIDENT DETERMINATION RECORD (§ 101.650(g)(1))
================================================================================
Incident ID: ______________ Evaluated By (CySO): ______________________________
Regulatory Definition Applied: 33 CFR § 101.605 Reportable Cyber Incident
Facts Relied Upon: 1. __________________ 2. __________________
DETERMINATION:
[ ] REPORTABLE -> Execute NRC Notification WITHOUT DELAY
[ ] NOT REPORTABLE -> Document Reason: ________________________________________
[ ] UNCLEAR -> Doubt resolved IN FAVOR OF REPORTING. Reported to NRC.
FORM B-4: FORENSIC CHAIN OF CUSTODY RECORD
================================================================================
Item ID: ________ Description / Serial No: _____________________________________
Collected By: __________________ Date/Time (UTC): ______________________________
Hash Value (SHA-256): __________________________________________________________
Transferred To: ________________ Purpose: ________________ Date: _______________
FORM B-5: EXTERNAL REGULATORY NOTIFICATION RECORD
================================================================================
Authority | Call Time (UTC) | Person Contacted | Case / Ref # | Notes
-----------+-----------------+------------------+--------------+----------------
USCG NRC | | 1-800-424-8802 | |
USCG COTP | | | |
CISA | | 1-844-729-2472 | |
FBI | | | |
FORM B-6: AFTER-ACTION REPORT (AAR) & LESSONS LEARNED TEMPLATE
================================================================================
Event / Exercise ID: ____________ Date: ____________ Facilitator: ______________
1. Timeline of Significant Events
2. Metrics: Time to Detect: ___ min | Time to Notify NRC: ___ min | RTO: ___ hrs
3. Root Cause Analysis & Control Failures (§ 101.650 Paragraphs)
4. Corrective Action Items & Assigned Owners (Tracked in Form B-7)
5. Plan Amendment Determination (§ 101.630(e)): [ ] Required [ ] Not Required
FORM B-7: CORRECTIVE ACTION REGISTER
================================================================================
Action ID | Finding Source | Corrective Action Description | Owner | Due Date | Status
----------+----------------+-------------------------------+-------+----------+-------
CA-01 | 2026 Exercise | Update OT Manual Valve Chart | C/E | 30 Days | OPEN
FORM B-8: CIRP ANNUAL REVIEW RECORD (§ 101.650(g)(3))
================================================================================
Review Period: 2025-2026 Review Date: ____________ Evaluated By: _____________
[ ] Scope Still Accurate [ ] Contacts Validated [ ] Backup Restore Tested
Outcome: [ ] Reviewed - No Change Required [ ] Plan Amended (Rev ____)
Approved By (CySO): ________________________ Date: _____________________________
Annex B — External Notification Scripts (Scripts 1 to 4)
SCRIPT 1: MANDATORY INITIAL USCG NRC NOTIFICATION CALL (1-800-424-8802)
================================================================================
"This is [NAME], designated Cybersecurity Officer for [COMPANY].
I am reporting a cyber incident affecting [VESSEL NAME / OFFICIAL ID or FACILITY NAME / ID], located at [POSITION / ADDRESS] in the [COTP ZONE] Captain of the Port Zone.
We have determined this to be a reportable cyber incident under 33 CFR § 101.650(g)(1). Discovered at [TIME UTC]. Determination made at [TIME UTC].
Summary of Incident: [NATURE OF INCIDENT]. Systems affected: [IT / OT / BOTH]. Critical systems affected: [YES/NO]. Operational status: [NORMAL / DEGRADED / LOST]. Safety status: [NO INJURIES / NO POLLUTION / VESSEL SAFE]. Actions taken: [ISOLATION / MANUAL CONTROL / OPERATIONS SUSPENDED].
My 24/7 callback number is [PHONE]. May I please have the official NRC Case Reference Number?"
SCRIPT 2: MEDIA & EXTERNAL STAKEHOLDER HOLDING STATEMENT
================================================================================
"[COMPANY] identified a cybersecurity incident affecting certain information systems on [DATE]. We activated our incident response plan immediately, are working with external technical experts, and have notified the appropriate federal authorities. The safety of our crew, vessels, and port facilities remains our highest priority. Operations continue under heightened security protocols. Further updates will be provided as investigation progresses."
SCRIPT 3: VENDOR DEMAND UNDER SUSPECTED REMOTE CONNECTION COMPROMISE
================================================================================
"This is [NAME], CySO for [COMPANY]. Effective immediately, all remote VPN/SSH access for [VENDOR] to our IT and OT networks is suspended pending security verification.
Per our contractual agreement and 33 CFR § 101.650(f)(2), we demand written confirmation of any known security compromise in your environment, remote connection audit logs for the last 90 days, and your 24/7 security contact within 2 hours."
SCRIPT 4: INTERNAL ALL-HANDS / CREW NOTIFICATION
================================================================================
"Attention all personnel: [COMPANY/VESSEL] is currently responding to a potential cybersecurity incident. Please immediately report any system anomaly to the CySO hotline at [PHONE]. Do not restart workstations, do not insert USB devices, and do not forward suspicious emails. Safety of navigation and facility operations remains under normal manual control."
Annex C — Bridge / Control Room Emergency Quick-Reference Card
- SAFETY FIRST: Vessel navigation and crew safety outrank cyber containment. Revert OT to local manual control.
- REPORT IMMEDIATELY: Call CySO 24/7 Hotline: [INSERT PHONE].
- DO NOT: Do not power off PLCs/HMIs, do not delete logs, do not insert USBs.
- ISOLATE NETWORK: Disconnect Ethernet cable from affected workstation or open IT/OT boundary firewall switch.
- NOTIFY NRC: CySO calls National Response Center at 1-800-424-8802 without delay.
Annex D & E — Glossary of Abbreviations & Source Verification
Glossary: AIS (Automatic Identification System), BCP (Business Continuity Plan), CDC (Certain Dangerous Cargo), CIRP (Cyber Incident Response Plan), CIRT (Cyber Incident Response Team), CISA (Cybersecurity & Infrastructure Security Agency), COTP (Captain of the Port), CySO (Cybersecurity Officer), ECDIS (Electronic Chart Display), HMI (Human-Machine Interface), KEV (Known Exploited Vulnerability), MTSA (Maritime Transportation Security Act), NRC (National Response Center), OT (Operational Technology), PLC (Programmable Logic Controller), SCADA (Supervisory Control and Data Acquisition), TSI (Transportation Security Incident), VTS (Vessel Traffic Service).
Verification Notes: Quoted regulations drawn from eCFR Title 33 Subchapter H Part 101 Subpart F (Final Rule 90 FR 6447, Jan. 17, 2025). Verify binding interpretations with cognizant Captain of the Port (COTP).