The Coast Guard Just Made Maritime Cyber Someone’s Full-Time Job
What the new Office of Maritime Cybersecurity Policy means for your vessels, your facilities, and your July 2027 deadline
September 9, 2026 | By The CyberSurv Team | CyberSurv
Most Coast Guard personnel messages read like paperwork. ALCOAST 266/26, published August 28, isn’t one of them. With that message, the service formally established the Office of Maritime Cybersecurity Policy — CG-MCP — its first dedicated office for governing cyber safety and security across the Marine Transportation System. For years, maritime cyber policy lived in fragments spread across program offices, working groups, and field units. Now it has a front door, named leadership, and a mandate.
If you operate a vessel, facility, or offshore platform regulated under MTSA, this isn’t org-chart trivia. It’s a signal about where enforcement is heading. The regulations this office will administer are already on the books, and the biggest compliance deadline of all sits barely ten months away.
A Policy Shop With a Real Mandate
CG-MCP stands up under the Director of Inspections and Compliance (CG-5PC) as part of the Coast Guard’s sweeping Force Design reorganization. The tasking list reads like a compliance roadmap. The office will review how the service documents, reports, and responds to cybersecurity inspections, deficiencies, violations, and reportable incidents. It will own policy and guidance on incident response, information sharing, and regulatory compliance — right down to the inspector guides and job aids that shape what happens when the Coast Guard walks your deck. It will build cyber training programs for the workforce. And it becomes the program of record for Marine Transportation System Specialist–Cybersecurity (MTSS-C) billets across the entire enterprise.
The office launches with named leadership: Nick Parham as office chief and Commander Brandon Link as deputy. That detail matters more than it looks. Offices with leaders move. Offices waiting on staffing plans stall.
Why the Org-Chart Placement Matters
Plenty of agencies park cybersecurity in a research shop or a CIO’s office, where it produces white papers nobody enforces. The Coast Guard didn’t. It placed CG-MCP inside the directorate that runs vessel and facility inspections. The same organization deciding whether your next exam goes smoothly now owns the pen on maritime cyber policy.
When a regulator builds inspector guides, job aids, and specialist billets, it’s building enforcement infrastructure. The MTSS-C program means trained cyber specialists distributed across Coast Guard units — not just a cell in Washington. Expect the cyber questions during routine inspections to get sharper, more standardized, and much harder to wave off.
The Clock Is Already Running
CG-MCP arrives on the heels of the Cybersecurity in the Marine Transportation System final rule, a first-of-its-kind regulation published in January 2025 and effective since July 16, 2025. Its deadlines aren’t hypothetical:
- Cybersecurity training came due January 12, 2026, and repeats annually. If your records are thin, you’re already out of compliance.
- Your Cybersecurity Plan must reach the Coast Guard for review and approval by July 16, 2027.
- Your first Cybersecurity Assessment must be complete by that same date — then refreshed every year, or sooner if ownership changes.
- Two cybersecurity drills are required every twelve months, and cyber incidents must be reported.
July 16, 2027 sounds distant. It isn’t. Plans don’t just get filed — they get reviewed and approved, and thousands of vessels and facilities will be submitting into the same queue. Submit late and you wait longer, with less room to fix whatever the reviewers bounce back. Operators who treat the deadline as a finish line rather than a starting gun are going to feel the squeeze.
Money, Muscle, and Momentum
The new office isn’t happening in a vacuum. Analysts at CSIS describe this moment as a window for generational change in maritime cybersecurity: $25 billion in modernization funding, cyber retention bonuses reaching $120,000, and expanded authorities have all landed within the past two years. A Government Accountability Office report had faulted the service for cyber workforce gaps and an incomplete strategy. CG-MCP is the structural answer to that critique.
Meanwhile, the threat keeps writing its own case studies. A cyberattack pushed North Carolina’s ports to manual gate operations in August. Researchers at DEF CON 34’s Maritime Hacking Village hijacked a vessel autopilot through an unsigned firmware update. And the FBI just dismantled a scanning network that probed edge devices two million times a day, maritime systems included. The regulator isn’t imagining the risk. It’s racing to catch up with it.
What Smart Operators Do Between Now and July 2027
Waiting for perfect guidance is a strategy. It’s just a bad one. Here’s where we’d focus:
- Audit your training records first. That deadline already passed. Close the gap before an inspector finds it.
- Run your Cybersecurity Assessment now, not in the spring of 2027. Our Maritime Cybersecurity Assessment maps directly to the rule’s requirements and gives your plan a defensible foundation.
- Name and empower a CySO. The rule requires one, and a title without authority won’t survive scrutiny. Our Security Leadership Program puts seasoned security leadership behind that role without a full-time hire.
- Draft the plan early. A plan that comes back with comments this year beats one rejected in mid-2027.
- Make the drills real. Tabletop exercises satisfy the letter of the rule; penetration testing tells you whether your defenses survive contact with an actual adversary.
- Instrument for evidence. Approval is a moment; compliance is continuous. RiskGuard 365℠ provides the continuous monitoring and documentation trail that turns your next inspection from an interrogation into a review.
Final Thoughts
Structure predicts behavior. When a regulator stands up a dedicated office, staffs it with named leaders, and wires it into its inspection machinery, the era of soft expectations is ending. The Coast Guard spent two years writing the rulebook. Now it has built the referee’s office too.
None of this should worry a well-run operation. The requirements — assessments, plans, drills, accountable leadership — are simply what good security looks like when it’s written down. Operators who move now get something the latecomers won’t: time to do it right.
Let’s Explore What’s Possible
CyberSurv helps maritime operators turn regulatory pressure into operational resilience. From MTSA-aligned assessments to security leadership and continuous monitoring, we’ve guided vessel and facility operators through every stage of the compliance journey. Let’s talk about where you stand — before the queue gets long.
