For entities regulated under the Maritime Transportation Security Act (MTSA), recent changes put cybersecurity on the same level of critical importance as physical security. At the heart of this transition is the mandated designation of a Cybersecurity Officer (CySO).  

This is not just a title or an additional duty but a named role with authority to perform diverse responsibilities to oversee an organization’s maritime cybersecurity and ensure compliance with the MTSA cyber requirements. A CySO is an internal hire, not appointed by the US Coast Guard (USGS) or other government organization.

This article explains what MTSA covered businesses need to know about the CySO role, including responsibilities and skillset needs.

Key takeaways

• Designating a CySO is a key requirement of the MTSA’s new cybersecurity regulations.
• MTSA covered entities need to have a CySO onboard and maintaining MTSA cyber compliance on or before the July 16, 2027 compliance deadline. 
• A CySO’s main responsibilities include creating and enforcing a cybersecurity plan and incident response plan; implementing MTSA mandated controls; handling staff cyber training needs; leading audits, exercises, and testing; and dealing with cyber incidents.
• Unlike a typical cybersecurity or IT professional, a CySO must also comprehensively understand maritime security and compliance concerns, including the complete shipboard and/or facility environment they are protecting.

What is a CySO under the MTSA?

A key requirement under the MTSA’s new cybersecurity regulations is the appointment or confirmation in writing of a qualified Cybersecurity Officer (CySO) responsible for overseeing a maritime transportation organization’s cybersecurity plan and handling sensitive cybersecurity data. This role must have significant authority to direct all aspects of maritime cybersecurity, including budget authority, change management responsibilities, and access to the Facility Security Plan.

The full MTSA compliance deadline goes into effect on July 16, 2027. On or before that date, all covered entities must have officially designated their CySO, under whose guidance they must conduct a comprehensive cybersecurity assessment and submit their Cybersecurity Plan to the USCG for approval.

While it is not a legal requirement until mid-2027, MTSA covered entities are strongly advised to name their CySO well in advance—if not as soon as possible—and begin leveraging their expertise to help create a new cybersecurity compliance strategy, assessments, plans, and mitigating controls. Identifying or training candidates with the role’s unique essential skills will be a challenge in itself for many firms.

Under the new rule, individual tenants or operators within an MTSA covered facility may be required to designate their own CySO and file their own cybersecurity plan even if the facility owner manages physical security on their behalf. 

What are a CySO’s main responsibilities?

A CySO is responsible for the development, implementation, and continuous supervision of a company’s maritime cybersecurity. They must also act as the main point of contract for all cybersecurity issues.

Key responsibilities of the CySO role include:

• Creating and enforcing the covered entity’s formal cybersecurity plan and cyber incident response plan, including coordination between IT teams, marine operations, and third-party partners. 
• Implementing MTSA mandated technical controls, which cover account security, device security, and data security. 
• Identifying training needs and conducting or overseeing staff cybersecurity training.
• Leading onsite physical and cyber vulnerability assessments, overseeing regular penetration testing, and conducting mandatory tabletop exercises.
• Ensuring mandated segmentation between IT and operational technology (OT) networks. This includes identifying, evaluating, and addressing supply chain cyber risk associated with vendors and other third parties.
• Escalating and reporting cyber incidents that disrupt operations or threaten safety to the USCG’s National Response Center (NRC). 

What skills does a CySO need?

A qualified CySO must have or acquire a unique range of skills and training well beyond a traditional IT manager role. They must be able to develop, monitor, and enforce cybersecurity practices as well as understand maritime operations, environments, and technology.

Essential CySO skills primarily include:

• Extensive knowledge of both IT and OT/industrial control systems, such as supervisory control and data acquisition (SCADA) systems, vessel propulsion systems, cargo handling systems, and programmable logic controllers (PLCs). 
• Experience with handling Sensitive Security Information (SSI), a specific MTSA designation for sensitive but unclassified data that must be protected from unauthorized release to safeguard transportation security. Examples include security plans, vulnerability assessment reports, critical asset maps, and other operational details related to cybersecurity and incident response.
• Awareness and expertise with maritime-specific cyber threats like GPS spoofing or jamming, attacks on core OT systems (propulsion, engine controls, navigation, etc.) and ransomware threats against restricted vessel or shore-side operational systems. 
• Expertise with using behavioral threat recognition to identify insider threats or external attacks, including state-sponsored advanced threats and acts of terrorism.
• The ability to direct and/or provide training as needed under MTSA guidelines or to ensure effective cybersecurity.

What makes a CySO different from a technical cybersecurity or IT administrator/director is the ability to comprehensively understand maritime security and compliance concerns. A CySO must be familiar with the complete shipboard and/or facility environment they are protecting, be comfortable handling regulated/compliance data, and know how to recognize behavior patterns that point to a strong potential security threat—a competency more akin to a maritime security officer than an IT manager.  

What are top challenges with finding and retaining a CySO?

The big challenge with identifying a qualified CySO is the shortage of people who have strong expertise not just with conventional IT environments, but also with maritime OT systems. 

The CySO is accountable to secure any digital systems that could impact port and ship operations. Challenges with meeting this mandate include:

• • The gap between IT and OT skills. Most cybersecurity professionals have no exposure to maritime OT environments, which can include shipboard machinery, navigation systems, cargo handling equipment, and industrial control systems/sensors.

• Wide accountability. A CySO must establish and maintain governance over regulatory compliance, technical cybersecurity, and physical security controls and plans. They must also be available 24×7 to respond to incidents or issues. 

• High-stakes duties. Unlike a typical corporate data breach, a successful cyberattack that inflicts significant damage on maritime critical infrastructure, such as loss of life and/or environmental impacts, can trigger a Transportation Security Incident (TSI). Follow-on impacts can include economic disruption, supply chain failures, and/or ongoing danger to human health and safety. 

Besides identifying candidates by traditional means, organizations seeking a CySO may choose to either train someone or leverage a specialist third-party vendor or consultant to cover the role.

Frequently Asked Questions

How does a CySO differ from a Facility Security Officer or Vessel Security Officer?

A: A Facility Security Officer or Vessel Security Officer focuses on physical site or onboard security, respectively. A CySO handles IT and OT network cybersecurity risks as well as cyber incident reporting and tracking.

What are some key daily duties of a CySO?

A: A CySO coordinates the monitoring and management of cyber controls in alignment with the Cybersecurity Plan, handle cyber awareness training and record-keeping, and oversee periodic required exercises, drills, audits, scans, and testing.

Can a third-party contractor serve as a CySO?

A: Yes. Operators can outsource the CySO role to a qualified third party as long as they have the necessary domain expertise.

Can the same individual act as CySO for multiple facilities or ships?

A: Yes. Organizations can designate the same qualified CySO across multiple facilities or vessels owned by the same entity.

Does a facility need a CySO even if it does not have significant OT? 

A: Yes. The USCG mandates a designated CySO and cybersecurity assessments for all MTSA-regulated entities regardless of their technology footprint. 

What’s next?

For more guidance on this topic, listen to Episode 162 of The Virtual CISO Podcast with 

Jeremy Price, Managing Director and National Cybersecurity Practice Leader at CBIZ Technology.