Port Cybersecurity EO (E.O. 14116)

Summary

Gives the U.S. Coast Guard clear authority to protect ships, ports, and waterfront areas from cybersecurity threats and cyber attacks.

What problem does this solve?

Existing security rules for ports and vessels did not specifically address modern cyber threats. This order updates the regulations to explicitly include digital systems, allowing the Coast Guard to prevent and respond to cyber attacks on maritime infrastructure.

What does this order do?

Includes cyber systems in security regulations

Updates security rules to explicitly cover digital infrastructure, including data, networks, and systems, allowing the Coast Guard to protect them from damage.

Requires reporting of cyber incidents

Mandates that any evidence of a real or threatened cyber incident involving a vessel or port facility be reported immediately to the FBI, CISA, and the Captain of the Port.

Expands search authority to digital systems

Allows the Captain of the Port to inspect and search any digital systems on a vessel or at a waterfront facility and remove anything not authorized to be there.

Authorizes control of vessels to prevent cyber damage

Permits the Captain of the Port to take full or partial control of a vessel if needed to protect it from cyber-related damage or to prevent it from damaging other facilities.

Adds new definitions for 'cyber incident' and 'damage'

Formally defines 'cyber incident' and 'damage' as they relate to digital systems by referencing existing U.S. laws, clarifying the scope of the new rules.

Clarifies owner responsibility for cyber protection

States that vessel and facility owners, masters, and operators are still primarily responsible for the security of their property, including all digital systems.

Who does this affect?

Vessel and port operators
U.S. Coast Guard
Maritime shipping companies

What is the real world impact?

•

Modernizes port security for the digital age

Strengthens national security by updating old regulations to address modern cyber threats from sophisticated malicious campaigns against the United States, protecting critical supply chains and infrastructure.

When does this start?

This executive order became effective when it was signed on February 21, 2024.