33 CFR Part 101, Subpart F is a section of U.S. Coast Guard regulations addressing cybersecurity in the Marine Transportation System. It establishes requirements for covered maritime entities, including cybersecurity planning and measures to manage risks to information technology (IT) and operational technology (OT). The applicable duties depend on the entity and its operations; the regulation, rather than a guidance document, determines what is mandatory.
For defenders, the rules make cyber risk part of maritime security and operational safety. In practice, covered vessel and facility operators use cybersecurity procedures to identify assets and threats, reduce exposure, and prepare to respond to cyber incidents. IT and OT connections matter because an intrusion affecting business networks can potentially disrupt systems that support physical operations. Guidance such as a Coast Guard Navigation and Vessel Inspection Circular may explain how to approach compliance, but it does not replace the regulatory text. Operators should check the current rule and determine which provisions apply to them.