Port Facility, Terminal and Vessel OT Cybersecurity Assessment
U.S. flagged vessels and port facilities that already carry a Coast Guard security plan must complete a Cybersecurity Assessment and submit a Cybersecurity Plan by July 16, 2027. GDF maps which cranes, gates, terminal operating systems and shipboard networks each party controls, then proves whether vendor and business network paths can actually reach them. Every check is approved by operations, scheduled around vessel calls and cargo windows, and stopped the moment the operation says stop.
Scope the facility
A port is several operations sharing one fence line. The port authority, the terminal operator, the tenants, the vessel operators and the equipment vendors each control different systems, and an assessment that ignores those lines either misses the exposure or touches equipment nobody authorized it to touch. We settle who owns each system and who can sign for it before the first interview, then build the work around berth schedules, crane maintenance and the hours the gate cannot go dark.
Every terminal, tenant and shipboard system in scope, the party that operates it and the person whose approval each part of the assessment needs.
Crane, gate and engine room support connections traced end to end, with the business network paths that could ride along them.
The backups, configuration baselines and restoration steps the terminal would lean on if a critical system had to be rebuilt tomorrow.
The Coast Guard cybersecurity rule, 33 CFR Part 101, Subpart F, applies to the owners and operators of U.S. flagged vessels, facilities and Outer Continental Shelf facilities that must hold a security plan under 33 CFR parts 104, 105 and 106. A Cybersecurity Assessment must be completed no later than July 16, 2027 and annually after that, and sooner than annually when ownership changes. Cybersecurity Plans must be submitted for Coast Guard review and approval by the same date.
The other clocks are already running. Personnel training was due by January 12, 2026 and repeats annually. A penetration test is required in conjunction with plan renewal, and the plan itself must be audited annually beginning no later than one year after its initial approval. The plan is Sensitive Security Information under 49 CFR part 1520, which is why our intake form never asks for it and plan material moves through a protected channel.
An assessment started this quarter leaves time to fix what it finds before those findings become plan commitments. Call (800) 868-8189 and we will walk through what that timeline looks like for your facility.
Port and vessel operators engage us in one of three ways. Each fixes the deliverables, the technical lead and the approvals in writing before work begins, so the people running the operation know exactly what will happen on which shift.
Establish or update the assessment
We review the agreed assets, dependencies and access paths, then deliver supported findings, assigned corrective actions and the technical material your Cybersecurity Plan will draw on. The facility team gets a documented basis for the fixes, and the compliance team gets evidence it can cite.
Close findings or prepare a change
We examine selected vendor routes, network boundaries, logging and restoration steps, and record each approved check, its result and the corrective work that remains. Engineers learn whether the controls they intended are the controls that exist, before a change window or an incident tests them.
Maintain the operating program
An assurance calendar can combine the annual reassessment, selected control reviews, refreshed evidence, exercises and management reporting, so the records your plan committed to stay current when the annual audit comes around.
We confirm the facility and vessel boundaries, the permitted systems, the access, the operating windows and the named person who can halt the work at any moment.
Architecture drawings, interviews, configuration exports and approved passive captures identify fragile equipment and essential dependencies before anyone proposes an active check.
Engineering and operations approve each active method, its exclusions and its recovery arrangements. Where production is the wrong place to ask the question, a laboratory or a representative asset answers it.
Each finding is linked to its access path, the operation it affects and the consequence for cargo, safety or schedule, with observed facts kept apart from inference.
Priorities, evidence, corrective owners and the criteria a retest will use, so the work can be assigned, finished and checked.
Reassessment, corrective verification and exercises scheduled against the obligations that recur every year.
Port assessments here come from a firm that has operated since 1992 and pairs OT work with forensic examination, and its examiners have testified in federal and state courts. When the assessment supports a plan the Coast Guard will review, every finding carries a source, a date and a method another professional can repeat. Meet the GDF team.
Call (800) 868-8189 or request a free consultation to plan this work around your operation.
Free preparation guide
The guide walks your team through the operating boundary, the responsible people, the records to pull and the testing safeguards to agree before the first scoping call. Facilities that arrive with it filled in spend the call on scope instead of on who owns the gate system.
Boundaries, owners, records and safeguards for a port, terminal or vessel assessment.
Format: PDF, also readable online.
Transport mode, facility and system facts for a port scope, plus an editable worksheet for owners, safety boundaries and permissions.
Format: fillable PDF and CSV.
Download the Transportation OT Planning Pack (PDF)
The OT and utility audit preparation guide, the OT security review checklist and the full library of preparation packages cover the wider OT records.
Organize the operating boundary, the responsible people, the records and the testing safeguards before the first scoping call.
See how scope, evidence, findings, corrective actions and recovery records fit together in the report your team will receive.
The first conversation is free and starts the scope with you. Request it now.
Frequently asked
The rule follows the security plan. It applies to owners and operators of U.S. flagged vessels, facilities and Outer Continental Shelf facilities required to hold a plan under 33 CFR parts 104, 105 and 106. We start by mapping which of your vessels and facilities sit inside that set, then build the technical scope around them.
They are separate duties. The Cybersecurity Assessment recurs annually, while the penetration test is tied to plan renewal. We scope each one on its own terms, and any active testing runs under methods, windows and stop conditions that engineering and operations approve.
The work starts with records, architecture and passive evidence. Active checks run only with engineering approval, in an agreed window, with recovery arrangements in place, and methods unsuited to the equipment are excluded from the scope in writing.
Yes. We deliver the technical findings, corrective actions and supporting evidence the plan draws on, written so your compliance advisers and the facility security team can rely on them when they assemble and submit the plan.
Yes. We review the existing assessment's coverage, date, evidence and limits, then scope only the work your facility or vessels still need, so you pay for the gap rather than a repeat.
Yes. We provide technical advisory support to the designated Cybersecurity Officer. If you want GDF considered for a formal designation, we review the duties, availability and contract terms with you as a separate agreement.
By the facility and vessel boundaries, sites, systems, vendors, records and methods in scope. The first consultation is free, and you receive a written scope and price before any work starts.
Talk with an examiner
On the first call a senior practitioner confirms which of your vessels and facilities the rule covers, recommends the assessment depth and schedule, and names the approvals the work will need. The consultation is free. Keep plan material and network details out of this form; we arrange a protected channel for those.
Global Digital Forensics has served clients since 1992. The hotline is answered 24/7.
Related capabilities
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .