Shoreside facilities and terminal operators
Protect maritime operations. Build the evidence behind your cybersecurity plan. GDF scopes IT and OT work with security, engineering and operations, then documents findings and practical corrective actions.
Gather records before an engagement
Choose a guide to identify records, assign owners and prepare questions for your auditor, consultant, counsel or export-control specialist.
These are preparation aids. They do not replace an audit, assessment, legal opinion or specialist decision, and they do not authorize testing.
Read the overviews without a form. Downloads require your name and email; we email a seven-day access link. Organization and phone are optional.
Gather mode, facility, ownership and operational-system facts for surface, port, aviation or pipeline scope review.
File: Fillable PDF planning pack.
Record proposed scope, owners, safety boundaries and permissions before audit, security assessment or physical or cyber testing.
File: Editable CSV preparation checklist.
Browse all preparation packages by subject.
Check each overview for source dates, scope limits and unresolved questions before using a download.
A port authority, terminal operator, tenant and equipment vendor may control different parts of the same operating environment. Establish the systems in scope, their owners, dependencies and who can authorize the work. A controller-only scan does not assess the wider digital environment.
Start with an initial assessment, unresolved findings or one critical recovery question. Define the work before committing to a broader program. Technical assessment, plan-support material and recurring assurance have separate responsibilities and agreed deliverables.
Agree the deliverables, technical lead and specialist responsibilities before work begins.
Establish or update the assessment
Review scope, assets, dependencies and access. Receive evidence-supported findings, an assigned action register and technical plan-support material.
The written scope distinguishes a technical workstream from a complete regulatory assessment.
Close findings or prepare a change
Examine selected vendor access, network boundaries, logging and restoration dependencies. Receive validation evidence, results, limits and remaining corrective actions.
Operations approve methods and stop conditions. Engineering implementation and production changes are separately authorized.
Maintain the operating program
Discuss a defined calendar for reassessment, selected control reviews, evidence updates, training, exercises and management reporting.
Scheduled deliverables, staff and specialist responsibilities are agreed first. Independent audit, monitoring and incident response have separate terms.
Identify the owner, operator, tenants, vendors, relevant IT/OT systems and the people who can authorize each part of the assessment. A port-authority engagement does not authorize access to a tenant's equipment.
Examine identity, engineering access, vendor gateways, segmentation and supporting services. Compare the intended access restrictions with configuration records and approved validation.
Review configuration baselines, backup dependencies, restoration records, logging, time synchronization and escalation. Agree on a representative restore exercise where it is safe and useful.
Provide technical findings, remediation owners, priorities, evidence gaps and plan-support material. The facility owner retains accountability for the plan and regulatory submissions.
The Coast Guard's implementation schedule requires covered entities to complete an initial cybersecurity assessment, designate a Cybersecurity Officer and submit a cybersecurity plan by July 16, 2027. Coverage follows the applicable vessel, facility or Outer Continental Shelf security regime. Being located at a port does not automatically establish coverage.
Cybersecurity assessments recur annually and sooner following an ownership change. Penetration testing is associated with cybersecurity-plan renewal, rather than a blanket annual penetration-test requirement. Annual plan audits are separate and begin no later than one year after initial approval. Reportable-incident reporting took effect July 16, 2025. The initial training deadline was January 12, 2026, with annual training thereafter; the July 2027 plan deadline does not defer these duties.
The Coast Guard also states that an existing physical-security-plan waiver does not automatically exempt an entity from cybersecurity requirements. Resolve applicability, waivers and plan obligations with the owner's compliance adviser. GDF supplies technical analysis and evidence, not legal advice, a regulatory certification or a guarantee of acceptance.
Confirm current Coast Guard filing instructions before submitting a plan. A dated submission notice is not a deadline extension. Cybersecurity Plans are Sensitive Security Information (SSI); they do not belong in public inquiry forms.
Sources checked October 6, 2026. Official sources: Coast Guard implementation timeline (opens in a new tab); 33 CFR Part 101, Subpart F (opens in a new tab); Coast Guard guidance on existing waivers (opens in a new tab).
Methodology
Define facility boundaries, permitted systems, access permissions, operating windows and the person who can stop the work.
Start with architecture, interviews, existing records, configurations and approved passive evidence. Identify fragile equipment and essential dependencies.
Engineering and operations agree on active methods, exclusions, stop conditions and recovery arrangements. Laboratory or representative assets can be used where production testing is unsuitable.
Connect each supported finding to the affected process, access path and operating consequence. Separate observed facts, inferences and untested assumptions.
Deliver priorities, evidence, ownership and retest criteria. Keep implementation and independent audit responsibilities distinct where required.
Separately schedule annual reassessment, corrective-action verification, exercises and evidence maintenance. Ongoing work has a defined allocation and scope.
Evidence commonly examined
What you can expect
Organize the operating boundary, responsible people, records and testing safeguards.
See how scope, evidence, findings, corrective actions and recovery records fit together.
Frequently asked
No. Applicability depends on the regulatory category and operating arrangement. Confirm which legal entities, vessels and facilities are covered before scoping compliance-related work.
No. The rule calls for annual cybersecurity assessments. Penetration testing is associated with plan renewal, while plan audits are separate. Any active testing needs its own approved operational scope.
The method begins with records, architecture and passive evidence. Active validation requires engineering approval, appropriate conditions and recovery arrangements. Unsuitable methods are excluded, and no assessment can eliminate every risk of disruption.
GDF can provide technical findings and plan-support material under an agreed scope. The owner and its qualified compliance advisers establish regulatory obligations and submissions. GDF does not approve a Coast Guard plan or certify complete compliance.
Yes. Review its coverage, currency, supporting evidence and limitations before defining the remaining work. A completely new assessment is not automatically the right next step.
Technical advisory support and formal CySO designation are different services. A designated role requires a separate review of qualifications, duties, staffing, accessibility and contractual terms. It is not included by default.
Facility boundaries, site count, systems, vendors, available records, approved methods and specialist needs determine the scope. GDF provides a written scope before work begins.
Talk with an examiner
Tell us the facility type, owner or operator, assessment deadline and systems involved. Identify the security, engineering and operations contacts who can authorize the work. Keep sensitive architecture and security-plan details out of this form.
Since 1992 · 24/7 dispatch · Court-tested experts
Related capabilities