The U.S. Coast Guard’s official Navigation and Vessel Inspection Circular index now lists NVIC 02-26, titled Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities, on the 2026 year table. The Coast Guard’s Maritime Industry Cybersecurity Resource Website places the same circular immediately under 33 CFR Part 101, Subpart F, alongside CG-5PC Policy Letter 01-26 on cybersecurity-assessment scoping, waiver and DoD SAFE work instructions, and the small-entity guides for vessels and facilities. Industry desks dated the public playbook 20–21 October 2026: We Are the Frontier on 20 October, Maritime Technology Review on 21 October, and ExecutiveGov at 21:24 UTC the same day. That listing, and not a new Federal Register rule, is the working primary for this piece.
This is implementation guidance for a rule that is already in force. It is not a 2026 final rule, not an IMO MSC circular, not a rewrite of the dedicated 20 October n0n Korean leak-site piece, and not a finding that every foreign-flag ship calling a U.S. port must file a Coast Guard Cybersecurity Plan tomorrow. The binding instrument remains the 17 January 2025 final rule, Cybersecurity in the Marine Transportation System, 90 FR 6298, docket USCG-2022-0802, effective 16 July 2025 for U.S.-flagged vessels, Outer Continental Shelf facilities, and MTSA-regulated facilities. Coast Guard NVIC background text is explicit that circulars are non-directive: they do not have the force of law, and non-compliance with a NVIC is not itself a violation, though it may indicate non-compliance with the underlying regulation. Operators who brief Thursday as a brand-new cyber statute have over-read the index. Operators who brief it as optional colour with no 2027 filing clock have under-read the rule the circular is written to implement.
What the official stack actually is
The regulation is 33 CFR Part 101, Subpart F. The Coast Guard’s Maritime Commons note of 16 July 2025, published on the effective date, remains the official phased clock. Immediately upon 16 July 2025, all reportable cyber incidents must be reported to the National Response Center. By 12 January 2026, and annually thereafter, all personnel must complete the training specified in 33 CFR 101.650. By 16 July 2027, owners and operators must designate the Cybersecurity Officer, conduct the Cybersecurity Assessment, and submit the Cybersecurity Plan for approval. Requirements named on that Commons note are a Cybersecurity Plan, a Cybersecurity Officer, and measures to maintain cybersecurity in the Marine Transportation System. NVIC 02-26 is the inspection-and-compliance playbook against that clock. It does not move the 16 July 2027 date. It does not reopen the 12 January 2026 training date. It does not create a new incident-reporting number.
The same Commons note is the foreign-flag colour that belongs in a U.S. call file and does not belong in a finding that NVIC 02-26 itself binds every SOLAS ship. The Coast Guard said it will intensify Port State Control scrutiny on indicators of poor cybersecurity practices, specifically those impacting ISM Code compliance on foreign-flagged vessels, and that elevated focus may lead to deficiencies, detention, denial of entry, or Captain of the Port action to control vessel movement. That is an ISM / PSC posture statement from July 2025. It is not a sentence in the NVIC title, and it is not a substitute for a numbered deficiency against a named hull. A DPA who treats Thursday’s circular as an automatic detention instrument has over-read it. A DPA who treats ISM cyber hygiene as invisible to a U.S. PSC inspector because the ship is not MTSA-regulated has under-read the Commons note that still sits on the same cyber resource page.
NVIC 01-20, Guidelines for Addressing Cyber Risks at MTSA-Regulated Facilities, remains the previous facility circular on the Coast Guard’s older cyber page. Industry reads of NVIC 02-26, including CyberOnboard, say the new circular supersedes that 2020 facility guidance under the Subpart F regime. Stay with the official 2026 index listing as the primary. Treat the supersession line as industry colour until a Coast Guard cancellation table for 01-20 is in the master’s pack. Do not brief 01-20 as the current implementation path for the 2027 Cybersecurity Plan.
What industry desks say the circular contains
This desk has the official title, the official index row, the official resource-page placement, and the official 2025 implementation timeline. Enclosure-level structure is still being read from 20–21 October industry notes, not from a page-by-page reprint of the PDF in this article. Maritime Technology Review on 21 October, carrying Coast Guard wording, said the expected standard of performance is set and the exact method of compliance is left up to the owner or operator; that there is no requirement to hire a third party to conduct the Cybersecurity Assessment or develop the Cybersecurity Plan; and that the circular will evolve, with the Maritime Industry Cybersecurity Resource Center as the living repository. The same piece assigned four enclosures: (1) how to structure a Cybersecurity Plan, section by section, aligned with 33 CFR Part 101; (2) a template for designating a Cybersecurity Officer; (3) penetration-testing expectations, not required for the initial 2027 submission, with safety caveats for operational-technology environments; (4) a NIST Cybersecurity Framework risk-filtering method for scoping vessel systems and IT/OT interdependencies. CyberOnboard printed the same 16 July 2027 operating-to-plan deadline, the same assessment-to-plan logic, a cross-reference table from regulatory provisions to plan sections, and a penetration-test frequency of at least once during each Cybersecurity Plan renewal cycle, recommended within the 24 months preceding renewal, and not required for the initial 2027 filing. We Are the Frontier dated the Coast Guard release 20 October and summarised the same 16 July 2027 plan deadline and four-enclosure layout.
Those enclosure numbers are useful for a DPA who has to task a CySO this quarter. They are not a substitute for opening the circular. Performance-based is the briefing fact that matters before any vendor conversation. The Coast Guard, on the MTR read, is not prescribing a product, a vendor, or a mandatory consultant. Documentation and observable evidence of implementation are the inspection language CyberOnboard drew from the circular. A company that buys a dashboard and cannot show how the Cybersecurity Assessment scoped IT and OT, who the CySO is, how incidents go to the National Response Center, and how the plan maps to Subpart F has not completed the 2027 filing problem. A company that waits until spring 2027 to designate the CySO will be compressing assessment, plan drafting, and Coast Guard review into the same months every other MTSA operator is filing.
Do not import the n0n Korean zip publication, a named encryptor event, or a GPS-spoofing casualty into this circular. MTR used GPS spoofing and port-terminal ransomware as scene-setting colour. That colour is not a numbered Coast Guard finding against a named terminal, and it is not a rewrite of Wednesday’s dedicated 12-name leak-site piece. NVIC 02-26 does not name n0n, CyberLogitec, Pusan Newport, or Dongkuk. Keep those files on their own lines.
Operational implications
For a U.S.-flag owner, an MTSA facility operator, or an OCS duty holder, Thursday is a documentation and calendar problem, not a new threat-level product. The 16 July 2027 date is nine months out from this run. The training date of 12 January 2026 is already behind the calendar. Incident reporting to the National Response Center has been live since 16 July 2025. NVIC 02-24, Change 1, remains the reporting clarification for breaches of security, suspicious activity, transportation security incidents, and cyber incidents under 33 CFR Part 101 and 33 CFR Part 6. Operators who have been treating Subpart F as a 2027 problem only have been ignoring two earlier clocks. The circular does not restart those clocks. It tells inspectors and operators how the 2027 plan, assessment and CySO designation are supposed to look.
For a foreign-flag operator calling U.S. ports, Thursday is not an MTSA Cybersecurity Plan filing unless the ship or facility is actually inside the MTSA stack. It is an ISM / PSC hygiene watch against the July 2025 Commons language that still sits on the same Coast Guard cyber page. SMS cyber procedures, evidence of training, and the ability to show how a cyber incident would be reported are the practical pack items. Detention, denial of entry and COTP movement control remain possible outcomes on that Commons note. They are not automatic, and they are not NVIC 02-26 converting every visiting ship into an MTSA-regulated entity. Charterers who put U.S. ports on the voyage order should ask whether the owner’s SMS can survive a PSC cyber conversation, not whether the ship has submitted a Coast Guard Cybersecurity Plan that the rule does not require of that flag.
Vendor and consultant pressure will follow the industry notes that “there is no requirement to hire a third party.” That sentence is a cost and governance fact, not a finding that in-house staff without OT competence can sign an assessment of cargo-handling, ECDIS, or industrial-control networks. The circular, on the MTR read, still expects the assessment to identify IT and OT assets, network connections, external dependencies, vulnerabilities and risks, and it still flags live operational-technology penetration testing as a safety problem. A CySO designation template does not make the master the CySO by default, and it does not make a shoreside IT manager the person who understands a cargo pump PLC. Assign the role, then make the assessment match the ship or the facility that will be inspected.
Do not recast 20–21 October as a new final rule, as a movement of the 16 July 2027 date, as an IMO circular, as a blanket foreign-flag filing mandate, as a rewrite of NVIC 02-24 reporting, or as a dedicated n0n / Hormuz cyber casualty. The confirmed facts are NVIC 02-26 on the official 2026 Coast Guard index, title as implementation guidance for MTSA-regulated entities, placement on the Maritime Industry Cybersecurity Resource Website under Subpart F, underlying rule 90 FR 6298 effective 16 July 2025, Commons phased clocks of immediate NRC reporting, 12 January 2026 training, and 16 July 2027 CySO / assessment / plan, and 20–21 October industry reads of a performance-based playbook with four enclosures and no mandatory third-party consultant.
What Operators Should Note
- Log NVIC 02-26 as implementation guidance, not as a new statute. Official Coast Guard 2026 NVIC index: Cybersecurity Regulations Implementation Guidance for Maritime Transportation Security Act (MTSA) Regulated Entities. Same circular linked from uscg.mil/MaritimeCyber under 33 CFR Part 101, Subpart F. Industry desks dated the public playbook 20–21 October 2026. NVICs are non-directive. The binding rule remains 90 FR 6298 of 17 January 2025, effective 16 July 2025, docket USCG-2022-0802.
- Keep the three Commons dates. The circular does not move them. Reportable cyber incidents to the National Response Center since 16 July 2025. Personnel training under 33 CFR 101.650 by 12 January 2026 and annually thereafter. Cybersecurity Officer, Cybersecurity Assessment, and Cybersecurity Plan submitted for approval by 16 July 2027. Applies, on the Commons note, to U.S.-flagged vessels, OCS facilities, and MTSA facilities. NVIC 02-24, Change 1, remains the reporting clarification.
- Treat enclosure structure as industry colour until the PDF is in the SMS. Maritime Technology Review and CyberOnboard: Enclosure (1) Cybersecurity Plan structure aligned to Part 101; Enclosure (2) CySO designation template; Enclosure (3) penetration testing, not required for the initial 2027 submission, at least once per renewal cycle, OT safety caveats; Enclosure (4) NIST Cybersecurity Framework risk-filtering. MTR carrying Coast Guard: performance standard set, method left to the owner or operator; no requirement to hire a third party for the assessment or the plan. Open the circular. Do not brief a vendor as mandatory.
- Do not convert visiting foreign-flag ships into MTSA filers. The 2027 Cybersecurity Plan is an MTSA / U.S.-flag / OCS / facility filing. The July 2025 Commons note separately flags intensified PSC scrutiny of poor cybersecurity practice as it affects ISM compliance on foreign-flagged vessels, including possible deficiencies, detention, denial of entry or COTP movement control. Put SMS cyber evidence in the U.S. call file. Do not file a Coast Guard plan the rule does not ask that flag to file.
- Do not merge this file with n0n, Hormuz, or a named encryptor. Wednesday’s dedicated 12-name Korean leak-site piece remains that piece. GPS spoofing and terminal ransomware in the 21 October industry write-ups are scene-setting colour, not a Coast Guard finding against a named terminal. NVIC 02-26 does not name those actors and does not change Update 106 or Warning 179-26.
- Start CySO designation and IT/OT scoping now if the 2027 plan is yours to file. Nine months is short once assessment, plan drafting and Coast Guard review are in the same queue as every other MTSA operator. Assign the CySO, map IT and OT, and line the plan against Subpart F. Watch a Coast Guard cancellation of NVIC 01-20, a class implementing note, or a numbered PSC deficiency — not a headline that Thursday invented a new cyber law.
Regulas Shipping will keep lining NVIC 02-26 against the 16 July 2027 Cybersecurity Plan clock and against the already-live National Response Center reporting duty so operators can treat this week’s circular as the MTSA implementation playbook, not as a new statute or a blanket foreign-flag filing order.
