What Does the Coast Guard’s July 2027 Cybersecurity Plan Deadline Require of Shippers and Terminal Operators?

33 CFR Part 101 Subpart F already requires cyber incident reporting and annual training. By July 16, 2027, every covered vessel and facility also needs a named Cyber Security Officer, a completed Cybersecurity Assessment, and a Coast Guard-approved Cybersecurity Plan — and the agency has confirmed it is not granting the vessel delay it floated when the rule was proposed.

On January 17, 2025, the Coast Guard published a final rule adding minimum cybersecurity requirements to 33 CFR Part 101, Subpart F, covering U.S.-flagged vessels, port and waterfront facilities, and Outer Continental Shelf (OCS) facilities regulated under the Maritime Transportation Security Act (90 FR 6298). The rule took effect July 16, 2025. Two obligations are already live and being inspected. A third, larger set — a named Cyber Security Officer, a completed Cybersecurity Assessment, and an approved Cybersecurity Plan — is due July 16, 2027. For freight operators, 3PLs, and terminal operators that run their own MTSA-regulated facilities, that runway is shorter than it looks once the work is scoped honestly.

What the Coast Guard is enforcing today, and what it isn’t yet

Two Subpart F requirements have been active since the rule’s effective date. Cyber incident reporting has applied since July 16, 2025: any vessel or facility covered by the rule must report a significant cyber incident to the National Response Center at 1-800-424-8802, with reporting guidance detailed in NVIC 02-24, Change 1. Annual cybersecurity training for personnel with access to IT or operational technology (OT) systems carried an initial deadline of January 12, 2026 under 33 CFR 101.650(d), and it is now a recurring obligation — every covered person needs a training event on record within the last 12 months, and new hires must be trained within 5 days of getting system access and no later than 30 days after hire. The Coast Guard’s Policy Letter 01-25 confirms inspectors are already verifying training records during routine MTSA inspections, using a dedicated job aid, and that the “relevant provisions of the Cybersecurity Plan” training topic can be deferred until a facility or vessel actually has an approved Plan.

What is not yet happening: Cybersecurity Plan review and approval. The Coast Guard has confirmed it is not currently reviewing or approving Plans, because the submission deadline itself is still ahead. That is the deadline this piece is about.

Who is actually in scope

Subpart F applies to owners and operators of three categories: U.S.-flagged vessels required to maintain a Vessel Security Plan under 33 CFR Part 104, port and waterfront facilities required to maintain a Facility Security Plan under Part 105 — including facilities handling certain dangerous cargoes — and OCS facilities required to maintain a security plan under Part 106. The practical scoping question is not a vessel’s commercial service, inspection subchapter, size, or whether it shows up in a public PSIX record. It is whether the vessel, facility, or OCS facility is already required to hold a VSP, FSP, or OCS FSP. A mid-market freight forwarder that does not own a terminal has no direct Subpart F obligation; a 3PL that operates its own MTSA-regulated warehouse or berth almost certainly does.

Foreign-flagged vessels are explicitly excluded from Subpart F under 33 CFR 101.605(b), but that exclusion does not mean foreign-flagged traffic is invisible to the rule’s enforcement posture. The Coast Guard has said it will intensify Port State Control scrutiny of foreign-flagged vessels for indicators of poor cybersecurity practice tied to International Safety Management Code compliance, with consequences that can include deficiencies, detention, denial of entry, or Captain of the Port action (Coast Guard Maritime Commons). Terminal operators and 3PLs that route cargo through vessels they do not own still carry counterparty exposure to that scrutiny.

The three deliverables due July 16, 2027

Three distinct requirements land on the same date, and they are sequential, not parallel:

1. Designate a Cyber Security Officer. Under 33 CFR 101.625, every covered vessel and facility must name an individual with cybersecurity oversight responsibility. The CySO develops, implements, and verifies the Cybersecurity Plan — which means the role needs to exist before the assessment work below can really start, not on the deadline itself.
2. Complete a Cybersecurity Assessment. A formal evaluation of IT and OT systems, vulnerabilities, and risk exposure. This is the evidence base the Plan is built from, and it is the step operators most consistently underestimate the time for, particularly where OT systems (terminal cranes, gate automation, refrigerated container monitoring, warehouse management integrations) have never been formally inventoried alongside corporate IT.
3. Submit a Cybersecurity Plan for Coast Guard approval. Under 33 CFR 101.630 and 101.655, the Plan becomes the “Cyber Annex” to the facility’s existing FSP or the vessel’s existing VSP. The Coast Guard has been explicit that this must be a Plan ready for approval when submitted, not a draft filed to beat the clock — the agency may request revisions, and review adds time on top of the deadline.

Once a Plan is approved, two ongoing obligations follow under 33 CFR 101.635: at least two cybersecurity drills per calendar year and at least one exercise per calendar year, with no more than 18 months between exercises, both testing the approved Plan’s implementation. Training, drill, and incident records all have to be retained and producible under 33 CFR 101.640.

The vessel delay the Coast Guard floated, then didn’t grant

When the rule was proposed, the Coast Guard specifically solicited comment on a potential 2-to-5-year delay to the implementation periods for U.S.-flagged vessels. That comment period closed March 18, 2025, and commenters largely supported some form of delay. It has not happened. No follow-up Federal Register notice, no formal decision, no rulemaking action has been published, and the Coast Guard is enforcing the rule on its original schedule. Operators who have been planning around an assumed vessel extension are planning against a date that, as of this writing, does not exist in any published Coast Guard action. The dates that matter remain July 16, 2025 for incident reporting, January 12, 2026 for initial training, and July 16, 2027 for the CySO, assessment, and Plan.

Why mid-market shipping and logistics operators underestimate this

The rule reads, at a glance, like a problem for container-ship operators and major port authorities. In practice, Subpart F’s Part 105 facility scope pulls in bonded warehouses with waterside access, breakbulk and bulk terminals, tank farms, ro-ro facilities, and any freight or 3PL operation that already holds an approved FSP. Two years feels comfortable until the Cybersecurity Assessment reveals that OT systems — crane control networks, gate systems, cold-chain monitoring — were never part of the IT security program’s scope, and now need to be inventoried and folded into a Plan the Coast Guard will actually review.

A realistic runway to July 2027

A sequencing that respects how the three deliverables depend on each other:

• Now: Identify a CySO candidate before the formal designation deadline. The role drives the Cybersecurity Assessment, so waiting until 2027 to name someone means the assessment starts late by definition.
• Next 6–12 months: Run the Cybersecurity Assessment across IT and OT, treating OT discovery as its own workstream rather than a line item inside a general IT risk review.
• Following 6–12 months: Draft the Cybersecurity Plan as an annex structured to slot into the existing FSP or VSP, mapped to the assessment’s findings, and build the training program’s Plan-specific module.
• Before submission: Run an internal readiness review as if a Coast Guard reviewer were reading it — the agency has said the Plan needs to be ready for approval at submission, not merely filed — and submit with enough runway that a revision request does not push past the deadline.

Where operators actually get this wrong

1. Treating the 2027 date as a start date, not a finish line. Assessment and Plan-drafting work for a multi-facility operator realistically takes the better part of a year once OT discovery is included.
2. Treating the January 2026 training deadline as a one-time task. It is an annual requirement under 101.650(d), with a separate 5-day/30-day clock for new hires.
3. Confusing submission with approval. A Plan filed on July 16, 2027 that still needs Coast Guard-requested revisions is not a compliant Plan on that date.
4. Assuming foreign-flagged exclusion means no exposure. A domestic terminal or 3PL routing cargo through foreign-flagged vessels still sits adjacent to the Port State Control scrutiny those vessels now face.

None of this requires a large security team, but it does require someone who owns the CySO role driving the assessment and Plan on a schedule that assumes Coast Guard review takes time. Cyberuptive’s shipping and logistics security practice and shipping and logistics security assessment map directly to the IT and OT scope a Cybersecurity Assessment needs to cover, and our 45-point shipping and logistics cybersecurity checklist is built against this same rule. If you are weighing whether to build this internally or bring in 24/7 SOC coverage for the ongoing monitoring and incident-reporting obligations once the Plan is approved, our breakdown of questions to ask an MSSP finalist is a reasonable place to start, or reach out to talk through where your facilities stand against the 2027 deadline.

Frequently asked questions about the USCG Cybersecurity Plan deadline

What is the USCG Cybersecurity Plan deadline?

July 16, 2027. By that date, every vessel and facility covered by 33 CFR Part 101, Subpart F must designate a Cyber Security Officer (33 CFR 101.625), complete a Cybersecurity Assessment, and submit a Cybersecurity Plan to the Coast Guard for approval (33 CFR 101.630 and 101.655).

Which vessels and facilities are covered by 33 CFR Part 101, Subpart F?

U.S.-flagged vessels required to hold a Vessel Security Plan under 33 CFR Part 104, port and waterfront facilities required to hold a Facility Security Plan under Part 105, and Outer Continental Shelf facilities required to hold a security plan under Part 106. Foreign-flagged vessels are excluded under 33 CFR 101.605(b).

Is the Coast Guard still planning to delay the rule for U.S.-flagged vessels?

No confirmed delay has been published. The Coast Guard solicited comment on a potential 2-to-5-year delay for U.S.-flagged vessel implementation periods when the rule was proposed; that comment period closed March 18, 2025, and as of this writing no Federal Register notice or formal decision has followed. The Coast Guard continues to enforce the original schedule.

What does a Cyber Security Officer (CySO) actually do?

The CySO is a named individual with cybersecurity oversight responsibility for a covered vessel or facility under 33 CFR 101.625. The role develops, implements, and verifies the Cybersecurity Plan, and the Coast Guard may require additional information or revisions to that Plan.

Is cybersecurity training already required today?

Yes. All personnel with access to IT or OT systems have needed annual training since an initial January 12, 2026 deadline under 33 CFR 101.650(d), and it is now a recurring 12-month obligation, with new hires trained within 5 days of system access and no later than 30 days after hire.

Do covered vessels and facilities have to report cyber incidents today?

Yes. Cyber incident reporting to the National Response Center has applied since the rule's July 16, 2025 effective date, with reporting guidance detailed in NVIC 02-24, Change 1.

What happens once a Cybersecurity Plan is approved?

Approved Plans trigger ongoing obligations under 33 CFR 101.635: at least two cybersecurity drills per calendar year and at least one exercise per calendar year, spaced no more than 18 months apart, both testing the Plan's implementation. Records must be retained under 33 CFR 101.640.

Does this rule apply to freight forwarders and 3PLs that don't own a terminal?

Only indirectly, in most cases. Subpart F attaches to the vessel, facility, or OCS facility that already holds a VSP, FSP, or OCS FSP under Parts 104, 105, or 106. A 3PL with no MTSA-regulated facility of its own has no direct Subpart F obligation, but one that operates its own regulated warehouse, berth, or terminal does.