USPA publishes a Port Houston maritime cyber risk analysis with the 2027 Coast Guard deadline in view

HOUSTON, Texas

USPA Nationwide Security on Thursday published a public-source risk analysis of maritime cyber-physical exposure at Port Houston and the Houston Ship Channel, a 7,716-word monograph that sets the Coast Guard's July 16, 2027 submission deadline against the conditions its author found at the waterline between industrial control systems and physical security.

The paper, "Port Houston Maritime Cyber-Physical Security & Compliance Risk Analysis," is credited to Michael Evans Jr., the company's Associate Manager of Maritime Operations. It runs 24 sections with 14 tables, three diagrams and 26 cited sources.

Its central argument is a distinction that facility operators can get wrong in either direction. Applicability follows the regulated operator under 33 CFR Part 101 Subpart F, not port geography, so a company does not become regulated by being near the Ship Channel, and a regulated facility does not become exempt by contracting the work out. The analysis also separates the public facilities Port Houston operates from the privately operated petrochemical berths along the channel, which carry different ownership, different processes and different security-plan boundaries.

What the analysis sets out

The monograph treats the 2027 milestone as a set of separate obligations rather than one filing: a Cybersecurity Assessment, a Cybersecurity Plan, and a designated Cybersecurity Officer, each with its own evidence trail. Its roadmap starts with the duties already in force, training compliance, current approved Facility Security Plan boundaries and an appointed cross-functional sponsor, and only then moves to function-led inventory, vendor and remote-access mapping, and scenario testing.

On reporting, the analysis works from the Coast Guard's 2024 reporting circular as updated by Change 1 in November 2025, which distinguishes breaches of security, suspicious activity, Transportation Security Incidents, cyber incidents and reportable cyber incidents. It names the National Response Center as the established reporting channel and warns against treating a working relationship with the local Captain of the Port or an Area Maritime Security Committee as an automatic substitute for a required report.

The physical consequence is the thread that runs through the document. Terminal operating systems, safety instrumented systems, remote vendor access and shared credentials sit on the same plant floor as gates, berths and loading arms. The paper's incident flow runs from initial observation through safety action, classification against applicable reporting rules, and preservation of records, and it argues that continuity decisions have to stay consistent with process safety rather than with uptime.

Two deliberate omissions

The analysis leaves every quantitative risk score in its register unassigned instead of estimating one, and it treats Coast Guard NVIC 02-26 as implementation guidance to be verified in its full official form. The research cutoff is stated as November 5, 2026.

The document carries an explicit scope statement: it is not a Coast Guard-approved Facility Security Assessment, not a submitted Cybersecurity Assessment or Plan, not a Port Houston assessment, and not a legal compliance opinion. It identifies no verified intrusion at any named terminal.

Who it is written for

Facility Security Officers, designated or prospective Cybersecurity Officers, terminal operators and the contractors who hold remote access to their systems. The practical value is in the sequencing: what can be established now from existing records, what requires engineering involvement, and where an owner has to accept applicability and resourcing before assessment work begins.

The full analysis is published at uspasecurity.com/port-houston-maritime-cybersecurity-risk-analysis. Evans's professional record and maritime assignments are listed on his management profile.

Facility operators working toward the 2027 milestone can reach USPA's maritime operations desk to discuss assessment scope and physical-digital coordination. Control-system diagrams, network details and vulnerability findings are not handled through a public inquiry form.