Port Houston Maritime Cyber-Physical Security & Compliance Risk Analysis

Scope and independence. This is an independent, prospective risk and compliance analysis prepared for consideration by maritime facility operators and their advisers. It does not represent an assessment performed at Port Houston or any named private terminal, a Coast Guard-approved Facility Security Assessment, a submitted Cybersecurity Assessment, or a government-issued compliance opinion. There is no claim that USPA operates a named port facility, serves as its designated Cybersecurity Officer, or has access to restricted control-system information. Detailed facility diagrams, security vulnerabilities and response credentials belong in protected operator records, not this public publication.

Executive Abstract

The U.S. Coast Guard's maritime cybersecurity regulation places a dated set of obligations on owners and operators of covered U.S.-flagged vessels, facilities and Outer Continental Shelf facilities. The final rule took effect July 16, 2025; specified training requirements had to be addressed by January 12, 2026; and initial Cybersecurity Assessments, Cybersecurity Officer designations and Cybersecurity Plan submissions converge on July 16, 2027. The applicable provisions occupy 33 CFR Part 101, Subpart F. The October 2026 Navigation and Vessel Inspection Circular (NVIC) 02-26 provides implementation guidance, which should be read alongside the regulation rather than substituted for it. ^{S01S02S03S09S10S14}

For the Houston Ship Channel, the central technical problem is the interaction of digital services and safety-critical industrial work. Container terminals use systems supporting equipment dispatch, access credentials and cargo flow. Petrochemical berths depend on appropriate process control, transfer supervision, isolation, emergency response and coordination with vessels. The same region includes public terminals operated by Port Houston and private industrial facilities with their own owners, operating arrangements and regulatory responsibilities. A single generic map or security plan cannot establish which covered entity owns a particular obligation. ^S15S16S17

This monograph proposes a facility-by-facility method for distinguishing the statutory baseline from technical guidance, mapping information technology (IT) and operational technology (OT) dependencies, assessing failures that could affect cargo operations or human safety, and setting evidence-based management controls. It includes a structured assessment template, a 12-scenario risk register, a safe operational boundary model, an illustrative risk-scoring method, a compliance crosswalk and a staged work program through the July 2027 deadline. Each proposed control is tied to an owner, evidence requirement and reassessment trigger.

The analysis treats cyber incidents, natural equipment failure, supplier interruption and procedural error as potentially interacting disturbances. Scenarios involving altered process values or failed crane controls are hypothetical; none is presented as a verified intrusion at a specific Houston facility. The intended readers are facility executives, Facility Security Officers, Cybersecurity Officers, maritime operations managers, process-safety leaders, General Counsel and the contractors who support them.

1. Evidence Architecture and Limits of the Assessment

The originating brief proposed three broad threat categories: advanced persistent threats, cyber-physical extortion and credential-based access compromise. Those categories are retained, but the publication does not infer local attack likelihood from general national warnings. Evidence is classified according to what a source can actually establish. The federal rule defines binding duties; Coast Guard circulars help explain accepted compliance approaches; NIST guidance informs engineering decisions; Port Houston and Army Corps material establish public geographic and operating context; hypothetical exercises explore potential consequences under stated assumptions. ^{S01S14S17S19S20}

Table 1. Evidence and inference classification

No plant drawings, access-control configuration, industrial-network topology, cybersecurity test results, confidential Facility Security Plan, insurance schedule or verified vendor assignment was provided for this research. The findings therefore cannot be used as the completed Cybersecurity Assessment for a specific facility. A properly scoped assessment requires authorized evidence and engagement with the people who are accountable for the relevant operating systems. References to control categories describe defensible measures, not the configuration of any real Port Houston or petrochemical installation.

2. The Houston Ship Channel as an Interdependent Operating System

The Houston Ship Channel extends approximately 52 miles and connects public cargo facilities, private industrial waterfronts and deep-draft maritime routes. USACE's project descriptions identify Bayport and Barbours Cut access channels and ongoing navigation improvements. Port Houston describes eight public facilities and its role in maintaining and expanding channel-related infrastructure. In this monograph, Port Houston names the public port authority and its facilities when the context requires that distinction; Houston Ship Channel describes the broader collection of independent operators and shared navigation dependencies. ^S15S16S17

A channel-wide disruption need not begin with a channel-wide failure. Loss of one terminal's scheduling system may create truck or vessel queuing without closing the waterway. An equipment condition at a petrochemical berth may require a controlled cessation of transfer while neighboring sites continue operating. A casualty affecting navigation may call for a Captain of the Port order whose geographic extent depends on the actual event. The proposed analysis follows these dependencies without assuming that any digital anomaly would automatically shut down all 52 miles of channel.

Table 2. Operational domains and responsibility boundaries

A credible continuity model must distinguish congestion from a legal closure, equipment unavailability from hazardous release, and the operational footprint of a terminal from the governance of the entire channel. The public data establish regional importance, while individual impact estimates require confidential asset inventories, production information and approved safety assumptions.

3. Statutory Applicability: Determine the Covered Entity First

Section 101.605 applies Subpart F to owners and operators of U.S.-flagged vessels, facilities and Outer Continental Shelf facilities required to maintain security plans under 33 CFR Parts 104, 105 and 106. The text excludes foreign-flagged vessels subject to Part 104 from this particular Subpart F application. A facility's physical location near Houston, its presence within a port complex, or its commercial dependence on a covered facility does not by itself determine whether the entity has a separate regulatory Cybersecurity Plan obligation. ^S03

A sound applicability review begins with the regulated entity name, location, relevant Part 105 security-plan requirement, current facility boundaries and the applicable Coast Guard authority. It must separately identify contracted systems and tenants that affect the facility's cybersecurity risks. The owner/operator remains responsible for the requirements placed on it by §101.620 even where a consultant, network contractor or managed service provider performs tasks under contract. The precise legal allocation in a particular leasing structure should be reviewed against facility documents and counsel's interpretation. ^S04

Table 3. Facility-level applicability worksheet (template, not completed findings)

This worksheet should be completed before anyone assigns a uniform compliance deadline to an unspecified tenant or treats all petrochemical installations as if Port Houston itself operates them.

4. The Rule, the Circular, and the Compliance Calendar

The final rule is codified in Subpart F and established the governing obligations. Coast Guard implementation materials identify the July 16, 2027 date for the initial Cybersecurity Assessment and Plan submission, along with CySO designation. Under §101.655 the Plan is submitted for review and approval; submission by the deadline does not imply that final approval will necessarily have occurred by that date. Section 101.630 describes Coast Guard review and the circumstances in which an acknowledgement can permit continued operation while review is pending. ^S02S06S10

The October 19, 2026 NVIC 02-26 is reported to include four enclosures: Plan development and maintenance; a sample CySO designation letter; penetration testing guidance; and scoping/assessment guidance. These resources support implementation. The rule itself determines whether a step is compulsory, while selected methods described in guidance may be optional. The public source audit notes a verification limitation: the official NVIC PDF endpoint was identified but returned an access restriction during this research; its exact language and enclosure references must be checked against a downloaded official copy before legal sign-off. ^S14

Table 4. Milestones and governing provisions

Regulatory dates and applicability may be affected by subsequent amendments, waivers or site-specific Coast Guard decisions. The register should therefore contain a review owner who checks the law and agency notices before each major milestone.

5. Accountable Governance and the Cybersecurity Officer

Under §101.620 the owner or operator must designate a CySO in writing, by name and title, with 24-hour Coast Guard accessibility. Section 101.625 allows one person to cover more than one eligible operation, permits assigned supporting duties, and keeps ultimate responsibility for those CySO duties with the designated officer. The owner's broader compliance accountability remains under §101.620. A contracted CySO is possible where that arrangement genuinely meets the legal and operational requirements. ^S04S05

For petrochemical and port operations, cybersecurity decisions frequently affect process safety, physical security, engineering configuration and production availability. The proposed governance charter gives the CySO authority to obtain the evidence needed for assessment and escalation, while leaving equipment operation to qualified controllers and life-safety decisions to those authorized under the facility's operating systems. The CySO should be able to stop an unsafe assessment method, escalate a critical vulnerability, and obtain independent engineering evaluation of compensating controls.

Table 5. Proposed decision-rights matrix

A service contract is useful only when it defines what the provider may inspect, what incident information it must disclose, and how disagreements over safety or remediation are resolved. A consultant's recommendations cannot silently substitute for authorized operator acceptance of residual risk.

6. Scoping by Functions Before Devices

An inventory of device names is an incomplete risk assessment if the organization cannot explain which operating functions depend on them. NIST's enterprise business impact guidance begins with mission-essential functions and the assets that support them. That order is especially valuable where machinery, access-control systems and enterprise applications have intertwined dependencies. The 2026 Coast Guard policy materials also emphasize initial assessment scoping as a foundation for the Plan. ^S13S20

The facility should first define its minimum safe operating conditions: what must be available to permit a cargo movement, a vessel transfer, a personnel entry, or a credible emergency response. It then maps the systems and people required by those conditions, including sources of energy, communications, decisions and data. The aim is to identify consequences of losing confidence in a signal as well as consequences of losing a signal entirely.

Table 6. Function-led scoping model

The facility-specific assessment should treat process safety and cyber risk as linked but separate disciplines. A successful network control can still leave an unsafe process configuration; a robust physical isolation procedure can limit consequences even after loss of a digital service.

REGULATED ENTITY & COVERED OPERATING FUNCTION
                     |
                     v
PEOPLE + DIGITAL SERVICES + PHYSICAL EQUIPMENT
                     |
                     v
DEPENDENCIES, HANDOFFS AND FAILURE MODES
                     |
                     v
SAFE-STATE DECISION + RESPONSE AUTHORITY
                     |
                     v
VERIFIABLE CONTROL + EVIDENCE + REVIEW TRIGGER

7. Public Container Terminals and Private Liquid-Bulk Berths

A public container terminal and a petrochemical transfer facility share maritime interfaces without having interchangeable hazards. At a container facility, the principal critical functions may involve crane control, yard sequencing, equipment movement, gates and cargo visibility. At a liquid-bulk berth, transfer authorization, vessel/shore communication, level monitoring, overfill prevention, isolation and emergency response need different technical evidence. Port Houston identifies ongoing investment in ship-to-shore cranes and terminal infrastructure, but this publication makes no claim about the configuration or security of any named crane, control cabinet or vendor system. ^S16

For every site, the assessment should create an explicit interface register: terminal control to vessel operations; site access to badge authorization; enterprise scheduling to physical activity; remote support to sensitive equipment; and alarm notification to decisions. Where an interface is only administrative, the analysis should not overstate its ability to move into OT. Where a link does touch process control, the safety consequences must be examined by people qualified for that particular installation.

Two illustrative tests help expose weak assumptions. First, can the site distinguish a network outage from a loss of process control integrity, and what operating condition is safe during diagnosis? Second, can operators continue essential security and emergency tasks when cargo systems are unavailable, without granting broad access or relying on stale electronic lists? Answering those questions requires exercises and documented evidence, rather than technical diagrams alone.

8. Network Segmentation, Trust Boundaries and Remote Support

Section 101.650 includes network-segmentation and routine-maintenance measures; it does not dictate that every industrial asset be literally air-gapped. NIST SP 800-82 Rev. 3 provides a detailed engineering reference for OT security and emphasizes safety, reliability and performance considerations. A defensible architecture may combine segmented zones, tightly controlled conduits, authenticated administrative paths, industrial monitoring, time-bound vendor access and documented fail-safe behavior. The exact combination depends on the site's operational design and safety assessment. ^S09S19

Many remote maintenance relationships exist because specialist technicians need to support equipment without permanent local access. The proper question is whether the facility can identify and authorize each remote session, constrain the session to an approved purpose, observe changes, and terminate access when the maintenance window ends. Shared credentials, undocumented vendor connectivity and changes outside approved schedules undermine that control. Suppliers should be required to disclose vulnerabilities and reportable incidents under the contractual arrangements contemplated by the rule.

PUBLIC / PARTNER SYSTEMS
          |
          v
CONTROLLED ENTRY AND AUTHENTICATION
          |
          v
DOCUMENTED BUSINESS-TO-OT BOUNDARY
          |
          v
APPROVED MONITORING AND CHANGE CONTROL
          |
          v
AUTHORIZED OPERATIONAL SYSTEMS
          |
          v
INDEPENDENT SAFETY FUNCTIONS AND SAFE-STATE DECISIONS

This is a conceptual governance diagram, not a proposed routing topology for a particular facility. Detailed system maps, vulnerability locations and remote-access mechanisms should remain in protected operator records. Any proposed change must be tested under an approved engineering and operational safety process.

9. Identity, TWIC and Physical-Digital Access

TWIC and facility access controls have distinct legal conditions. Section 105.255 requires secure-area authorization and describes electronic or visual TWIC inspection depending on Risk Group classification. It would be inaccurate to describe every Houston facility as requiring a uniform dual-factor or biometric gate configuration. A cyber assessment should analyze how digital access services support the facility's lawful entry process and how entry remains controlled during a network fault. ^S11

Physical access to IT/OT equipment may matter even when a worker has no logical account. The Coast Guard's 2025 final-rule FAQ discusses physical access considerations relevant to training populations. Appropriate controls include documented escort rules, restricted equipment areas, maintenance authorization and prompt revocation of credentials, balanced with the ability of authorized emergency personnel to act safely. ^S22

Table 7. Access-control assurance questions

A cyber control that unexpectedly blocks a lawful emergency response can create its own safety risk. Security, operations and emergency personnel should agree on controlled exceptions before an incident requires them.

10. Supply-Chain Assurance and Third-Party Accountability

A maritime facility depends on suppliers for equipment servicing, network administration, communications, software support, guard services and specialized engineering. Outsourcing may be sensible, but it does not erase the owner/operator's statutory responsibilities. Cybersecurity procurement and vulnerability-notification provisions should be read directly against §101.650, with specific contracts amended to ensure the facility receives timely and usable information. ^S04S09

The proposed vendor assessment evaluates four questions: Which critical function does the vendor enable? What access can the vendor exercise? What incident or loss would the facility learn about, and how quickly? What evidence can the vendor provide to prove that permissions, restoration and change-management controls are operating? A supplier may comply with a commercial security questionnaire while still failing an operational handoff during a real incident.

Table 8. Vendor-criticality and control record

Suppliers should receive only the information necessary to fulfill their contractual scope. Highly detailed cyber vulnerability reports or restricted security plans should remain controlled under the facility's information-handling requirements.

11. Vulnerability Management, KEVs and Safe Remediation

The rule directs covered operators to identify and address known exploited vulnerabilities in critical IT or OT systems without delay, including documented compensating controls where direct patching is inappropriate. This requirement makes the asset inventory and system-criticality classification operationally important. A vulnerability cannot be prioritized responsibly when a team does not know which function the affected asset supports or who can authorize a safe maintenance interruption. ^S05S09

CISA's Known Exploited Vulnerabilities catalog offers evidence about vulnerabilities observed in actual exploitation. It does not establish that a particular terminal is compromised. The program should connect KEV awareness to vendor notices, asset exposure, engineering constraints and approved remediation windows. Industrial devices often require vendor-qualified testing; an unscheduled patch or broad active scan can cause an availability or safety problem. NIST's OT guidance discusses the need for such tailoring. ^S19S23

An effective exception record includes the vulnerability, affected business function, temporary safeguards, approving authority, monitoring arrangements and the condition that ends the exception. A generic note reading “accepted risk” supplies little assurance without evidence about duration, consequence and accountability.

12. Cybersecurity Training, Drills and Exercises

Section 101.650(d) distinguishes personnel with access to IT/OT, key personnel, new personnel and the separate plan-specific curriculum due after Plan approval. Training specified in that provision includes recognizing threats and incidents, reporting to the CySO and OT-specific instruction when a role uses operational technology. Initial deadlines for specified training occurred in January 2026; the schedule continues with annual and onboarding obligations. A facility should assess existing compliance now rather than postponing all training until its Cybersecurity Plan submission. ^S09

Drills and exercises have separate frequency requirements. Section 101.635 calls for at least two drills each calendar year and at least one exercise each calendar year, with no more than 18 months between exercises. Their quality depends on whether they actually test notifications, operational decisions, available resources and the safe interaction of the security and engineering teams. The exercise record should document what happened, who made decisions and which corrective actions were closed. ^S07

Table 9. Role-targeted training and exercise architecture

An exercise involving a chemical-transfer facility should be coordinated with process-safety managers and designed so simulation never causes unintended movement of live equipment. Exercises can test information and decision-making without introducing disruption into production control.

13. Operational Resilience, Backups and Restoration Confidence

The capacity to restore data is different from confidence that an industrial process may resume safely. Equipment logic, engineering documentation, access policy, operating parameters and independent safety checks may all be required before returning to service. NIST SP 1339, published in June 2026, specifically addresses OT backup preparation, integration with change management, integrity testing and recovery exercises. Under §101.650 the regulated program also includes backup and resilience measures. ^S09S21

A credible restoration sequence begins with a declaration of the safe operating state and identification of the person who can authorize recovery. Engineering must verify the integrity of the restored configuration; operations must validate the process; the CySO or technical team must assess whether the threat remains active. The facility should document which functions can proceed under restricted operation and which require a full controlled restart.

Table 10. Restoration gate checklist

The plan should account for the possibility that a clean system backup contains an obsolete configuration or that a trusted digital record conflicts with physical observations. Independent confirmation of process state helps avoid a hasty restart based on an incomplete technical report.

14. Physical Security, TSCM and Communications Privacy

Cybersecurity governance intersects with physical protection because network cabinets, contractor access points, vessel interfaces, radios and administrative rooms occupy the same operational environment. A physical security assessment may examine controls for critical equipment spaces, chain of custody for suspicious devices and authorized access during emergencies. TSCM can be relevant to a particular confidential meeting or suspected unauthorized transmission, but a TSCM sweep is not a universal statutory requirement under the maritime cyber rule, nor a substitute for OT security assessment.

Radio-dense maritime facilities create technical limitations. Marine radio, radar, telemetry and ordinary maintenance equipment can complicate interpretation of emissions. The assessment should begin with an authorized purpose, defined scope and qualified personnel. It should avoid broad claims that detecting a wireless signal establishes hostile interception or proves the absence of a hidden device. Sensitive corporate discussions may benefit from room-security practices, access logs and clear rules for recording devices, regardless of whether a specialized examination is justified.

Physical guards have a useful role in observing, documenting and reporting unusual access, failed controls and unsafe conditions, within their training and authority. They should not be represented as cyber engineers, process operators or federal compliance certifiers unless individually qualified for those functions.

15. Threat Mechanisms: Separate Capability from Local Evidence

The originating brief invoked state-sponsored prepositioning, financially motivated ransomware and credential compromise. Those are meaningful categories for a defensible risk register. They do not establish an active campaign against a named Houston operator. Incident analysis should remain grounded in verified events; an actor label attached to an unverified breach scenario provides no additional analytical certainty.

Table 11. High-consequence threat and disturbance matrix

The consequence of an anomaly depends on the safeguards around it. For example, an unexpected system value does not automatically cause hazardous overfill where independent protection and sound operating procedures are effective. Likewise, a cyber incident does not automatically authorize or require a full channel closure. Those outcomes are decisions and processes governed by observed facts and the competent authorities.

16. Compound Scenario A: Container Operating-System Disruption

Illustrative only; no assertion of a Port Houston incident. Consider a terminal that experiences a prolonged loss of confidence in its cargo sequencing and associated business services during a busy vessel window. The starting disturbance might involve a supplier error, a corrupted update or malicious compromise; the exercise does not require assuming a particular exploit. If personnel cannot verify container identity, movement authorization or the availability of required equipment safeguards, operations may need to pause affected movements while maintaining perimeter and emergency functions.

The first decision point is whether the safety-critical equipment remains trustworthy and independently controlled. The second is whether business and equipment-support systems have shared dependencies that prolong disruption. The third concerns the consequence of rescheduling ships and land-side access when normal data exchange cannot be trusted. An exercise should record the time needed to confirm which functions are affected and who can authorize constrained operations.

Decision sequence: Establish safe state → authenticate current operating information → isolate affected function administratively and technically where authorized → preserve incident evidence → coordinate vessels, trucks and staff → validate restoration → obtain release-to-operate approval. None of these steps calls for unapproved live penetration testing or speculative operation of crane controls.

17. Compound Scenario B: Petrochemical Berth Transfer Uncertainty

Illustrative only; no assertion of a Port Houston incident. A private liquid-bulk facility observes inconsistent digital indications during a transfer that depends on several measurement and communications systems. The cause is unknown. Controls that rely on those signals should not be presumed accurate until appropriately checked. Facility operators would follow approved transfer, isolation and emergency procedures; the cyber team would preserve evidence and investigate the digital systems without displacing process-safety authority.

This scenario tests a distinction that is easy to lose in cybersecurity planning. A cyber investigation may take hours while the operational choice to suspend an unsafe transfer is immediate. The facility needs a defined rule for making that choice, a way to communicate with the vessel and adjacent responders, and a record of conditions necessary for safe resumption. An environmental release, fire or channel restriction is a possible downstream consequence only under additional specific failure assumptions; it must not be described as the inevitable result of a data anomaly.

The tabletop should examine control-room communications, independent observations, contractual custody boundaries, notifications to the facility's qualified responders and the preservation of relevant incident records. Any exercise injects should avoid identifying actual valve settings, access points or exploitable equipment configurations.

18. Compound Scenario C: Access and Communications Disruption

Illustrative only. A facility's electronic entry-verification service becomes unavailable during a contractor changeover, while a concurrent communications outage reduces visibility of the operating status. This condition may arise from network failure without an adversary. It exposes the difficulty of balancing entry control, emergency access and a high volume of service personnel. The response should follow the legally applicable TWIC and access procedures rather than improvising a bypass.

Operational leaders should identify whether the facility can continue under approved manual controls, which areas require suspension of access, how escorts are assigned, and how each entry is documented. The communications plan must distinguish ordinary administrative delay from an event that could compromise safe vessel-interface operations. The exercise should test resource limitations: sufficient authorized escorts, working independent communication paths and a designated person empowered to resolve conflicting priorities.

This scenario illustrates that resilience is not measured only by network recovery time. It also depends on sustained lawful control of physical spaces and an auditable account of who was permitted to perform sensitive activities while electronic services were degraded.

19. Quantitative Risk Model and the Limits of Scoring

A conventional risk matrix may help a facility compare planning priorities, provided the scoring method is explicit. The proposed demonstration uses an ordinal likelihood band from 1 (rare under documented site conditions) to 5 (frequent under documented site conditions) and an impact band from 1 (limited recoverable interruption) to 5 (credible catastrophic safety or mission consequences). The product is a ranking aid, not a measured probability, expected monetary loss or proof of future incident frequency.

An example scenario with likelihood 3 and impact 5 yields an ordinal score of 15. If proposed controls plausibly reduce likelihood to 2 while impact remains 5, the residual score becomes 10. That numerical change should not appear in a final audit record until the controls are implemented, tested, and a qualified assessor explains the basis for the revised likelihood. In high-consequence industrial settings, low-frequency events may remain intolerable regardless of their matrix placement.

Table 12. Illustrative 5×5 scoring convention

Scoring rule: 1–5 = lower ordinal priority; 6–10 = moderate; 11–15 = elevated; 16–25 = critical review priority. These thresholds are proposed editorial conventions, not Coast Guard or NIST-prescribed ratings. The risk register in the Base44 package records scenario assumptions, proposed controls and evidence requirements; it intentionally leaves unvalidated facility likelihood values blank.

20. Incident Reporting, Evidence and Multi-Agency Coordination

Reporting is a legal decision with time-sensitive consequences. The Coast Guard's 2024 reporting circular, updated by Change 1 in November 2025, distinguishes breaches of security, suspicious activity, Transportation Security Incidents, cyber incidents and reportable cyber incidents. Subpart F also imposes reporting obligations by reference to other applicable provisions. Owners and operators should maintain a tested decision tree grounded in the actual definitions rather than treating routine blocked probes or every suspicious email as a compulsory federal cyber report. ^S04S09S12

The National Response Center is the established Coast Guard reporting channel; official Coast Guard material identifies 1-800-424-8802. An operator's contacts with the local Captain of the Port, other agencies and the Area Maritime Security Committee may be important, but those relationships should not be described as automatic substitute routes for required reports. The precise reporting trigger, recipients and timing must be checked against current regulations and guidance during legal review. ^S12S18

POTENTIAL CYBER / PHYSICAL SECURITY CONDITION
                     |
                     v
SAFETY ACTION AND IMMEDIATE OBSERVATIONS
                     |
                     v
FACILITY INCIDENT LEAD + CySO + FSO
                     |
                     v
CLASSIFY EVENT AGAINST APPLICABLE REPORTING RULES
                     |
           +---------+---------+
           |                   |
           v                   v
REQUIRED FEDERAL REPORT   SITE / VENDOR / LOCAL RESPONSE
           |                   |
           +---------+---------+
                     |
                     v
PRESERVE RECORDS; CORRECT; VALIDATE; CLOSE

The incident file should record who first observed the condition, which actions were authorized, when external notifications occurred and whether continuity decisions were consistent with process safety. Chain-of-custody controls should be proportionate and should not prevent immediate emergency action.

21. A 2026–2027 Implementation Roadmap

The compliance horizon is finite, but a realistic work program begins with the duties already in force. Operators should verify training compliance, identify their current approved security-plan boundaries and appoint a cross-functional executive sponsor immediately. The remaining work can be organized by evidence readiness rather than assuming that all facilities start at the same level of maturity.

Table 13. Proposed staged delivery program

This schedule is an illustrative management workback, not an extension or modification of federal deadlines. It should be adjusted for each covered facility's actual preparedness, Coast Guard guidance and approvals. An approved plan is a living program; owners must preserve evidence of execution, train new participants, review vulnerabilities and amend the Plan when required.

22. Board-Level Assurance Metrics and Decision Questions

A compliance dashboard becomes useful when its measures tell management whether critical work can continue safely. Total numbers of scanned devices or completed training slides provide limited assurance without knowing the quality of scope and whether exceptions remain unresolved. The proposed scorecard therefore measures decisions and supporting evidence: covered functions with approved owners, critical suppliers whose access is documented, open safety-relevant findings, completion of required assessments, status of incident notification exercises and the availability of tested recovery evidence.

Table 14. Executive assurance indicators

The governance question for leadership is whether each material risk has an accountable decision maker and whether that person receives reliable evidence early enough to act. A favorable dashboard cannot compensate for an unsafe operating condition, an inaccurate applicability determination or an undisclosed dependency on a single vendor.

23. Management and Contractor Coordination in Practice

USPA Nationwide Security's maritime security and protective-services work provides an appropriate context for discussing how qualified physical security personnel can support the operating program: authorized patrols, controlled access, observation, reporting, incident coordination and the operational discipline required when conditions change. Specific services and capabilities must match actual contracts, qualifications and site authorizations. Cybersecurity engineering, regulated CySO services, OT penetration testing and Coast Guard Plan approval are distinct functions that should only be represented where the personnel and authorizations genuinely exist.

A properly drafted statement of work for site patrol or contract security should name the facilities and areas covered, clarify guard responsibility around equipment and controlled rooms, identify observation/reporting escalation, coordinate with the FSO and CySO, and prohibit unauthorized intervention in live industrial control systems. If a device or alarm is abnormal, the guard's role may be to protect the scene, communicate details and follow lawful emergency instructions. The technical team and operations leadership remain responsible for determining system integrity and process safety.

Procurement teams should evaluate the practical competence of all providers involved, including insurance and licensing requirements where applicable, prior experience with maritime access controls, incident documentation and continuity staffing. Marketing claims about an entire national network do not demonstrate suitability for a specialized assignment without the contract-specific evidence that a port operator requires.

24. Research Gaps, Regulatory Review and Executive Conclusion

Before publication or use in regulated decision-making, the editor and facility's counsel should confirm the exact NVIC 02-26 text and enclosure references, check for any post-cutoff rulemaking, validate the responsible facility operator in each use case and confirm local Coast Guard submission instructions. The analytical scenarios should be rewritten around an inspected facility only after authorized engineering and process-safety evidence is available. Cyber incident reports, contingency plans, security-sensitive layouts and other protected records should remain in the operator's controlled environment.

The 2027 program provides an unusually clear opportunity for disciplined preparation. The decisive work is practical: accurate scoping, durable assignment of responsibility, a defensible record of digital and physical dependencies, evidence of training and monitoring, safe industrial recovery procedures and timely communication with the competent Coast Guard authority. The resulting Cybersecurity Plan must describe the regulated operator's real systems and controls. A polished policy document without that operational foundation would provide limited assurance when the facility faces an interruption.

For port executives, the most revealing evidence may come from a simple test: select a critical maritime function, remove a single supporting digital or supplier service in a tabletop scenario, and ask who can make the next safe decision using information they trust. The quality of that answer will expose both practical resilience and the governance work still required before submission.

Glossary

AMSC — Area Maritime Security Committee: Regional maritime security coordination forum. COTP — Captain of the Port: Coast Guard official with applicable jurisdictional powers. CSA — Cybersecurity Assessment: Assessment required by the relevant cybersecurity regulations. CSP — Cybersecurity Plan: Document developed and submitted for Coast Guard review and approval under Subpart F. CySO — Cybersecurity Officer: The formally designated officer with defined duties under §§101.620–101.625. FSP — Facility Security Plan: Security plan required for applicable facilities under Part 105. FSO — Facility Security Officer: A facility security role distinct from the CySO. ICS — Industrial Control System: Systems supporting monitoring and control of physical processes. IT — Information Technology: Enterprise information-processing technologies. KEV — Known Exploited Vulnerability: Vulnerability with evidence of active exploitation in the CISA catalog. MTSA — Maritime Transportation Security Act: Statutory framework for maritime transportation security. NRC — National Response Center: Federal reporting point for specified maritime and other incidents. NVIC — Navigation and Vessel Inspection Circular: Coast Guard guidance document. OCS — Outer Continental Shelf: Offshore facility category addressed by Part 106. OT — Operational Technology: Technology monitoring or controlling physical operations. SCADA — Supervisory Control and Data Acquisition: Category of industrial monitoring/control technology. SSI — Sensitive Security Information: Protected security information governed by applicable rules. TSCM — Technical Surveillance Countermeasures: Authorized measures to assess technical interception risks. TWIC — Transportation Worker Identification Credential: Credential used in legally specified maritime access procedures.

Authoritative Citation Registry