BroCoTec, a Houston-based maritime cyber security specialist, is urging US vessel operators to act now on new Coast Guard cybersecurity regulations, warning they are a ‘banana skin’ for unprepared companies.

The regulations establish cybersecurity requirements for covered U.S.-flagged vessels, facilities and Outer Continental Shelf facilities. The rule became effective July 16, 2025, with phased compliance requirements.

BroCoTec warned major milestones, including designation of the Cybersecurity Officer, completion of the initial Cybersecurity Assessment and submission of the Cybersecurity Plan, are due by July 16, 2027. The cybersecurity requirements further apply to inactive vessels that retain a valid Certificate of Inspection or Certificate of Compliance.

BroCoTec CEO Nat Kemberling cautioned that noncompliance could result in the USCG issuing penalties of up to $43,527. Federal law meanwhile further allows vessel clearance to be refused or revoked.

“Because many operators don’t understand the requirements and are delaying compliance, they could face a bottleneck before July rolls around,” he said. “A significant amount of work is involved which could take weeks or months to sort out. If you think about segmentation alone, making sure crew devices and internet-connected systems don’t provide a pathway into critical OT — it’s a big job. We urge companies to get a plan in place now for a smooth transition to the July deadline. As well as being a time consuming job, there is a risk of heavy financial and operational penalties for non-compliance.”

Mr Kemberling said the regulation addresses a vulnerability that has grown more acute in recent years as vessel connectivity has expanded rapidly with the arrival of faster lower cost satellite internet services. He said many operators are running IT and OT on a single network — a practice that exposes shipboard equipment to cyber attacks.

“We applaud this move from the Coast Guard — it is absolutely essential,” he said. “But it isn’t easy to execute without specialist support. We know that attacks are getting more sophisticated and your IT system security is only as good as the latest threat. And clearly mixing crew comms with OT is a very obvious weak link for cyber criminals to exploit.”

Mr Kemberling said that many vessels still rely on legacy IT systems that were not designed for modern connectivity in mind and carry significant unpatched vulnerabilities. He said this leaves smaller and mid-sized operators — often running one or two person IT departments — particularly exposed as the compliance deadline nears.

“The clear message is don’t nickel and dime your cyber, don’t put off your compliance, as downtime and potential penalties are far more expensive than the upgrade cost,” he said. “Get it right and your operations are much safer and less vulnerable. Robust cyber security is like putting money in a high interest bank account. It pays back long term.”

What operators need to do

BroCoTec is advising US operators to treat compliance with 33 CFR Part 101, Subpart F as an immediate priority rather than a distant deadline, and recommends that owners and operators:

• Conduct an audit of current shipboard network architecture to identify where IT and OT systems remain combined
• Implement network segmentation, firewall isolation and logical access controls between business IT and critical OT systems
• Review satellite and internet-connected equipment, including crew WiFi and streaming services, for pathways into OT networks
• Assess legacy PLCs and other operational technology for known vulnerabilities
• Designate a Cybersecurity Officer responsible for compliance, available to the Coast Guard around the clock
• Complete a Cybersecurity Assessment and submit a Cybersecurity Plan for Coast Guard approval
• Establish a Cyber Incident Response Plan, including reporting procedures to the National Response Center
• Schedule required cybersecurity drills (twice yearly) and exercises (annually), plus personnel training
• Begin remediation well ahead of the July 2027 enforcement date to avoid a late rush on qualified IT and cybersecurity contractors