Passenger Vessel Association Cyber Security

kittie-lecroy

Published 2026-10-14 · 37 slides · 0 views

↓ Download

Passenger Vessel Association Cyber Security

Passenger Vessel Association Cyber Security - slide 1 of 37

Passenger Vessel Association Cyber Security - slide 2 of 37

Passenger Vessel Association Cyber Security - slide 3 of 37

Passenger Vessel Association Cyber Security - slide 4 of 37

Passenger Vessel Association Cyber Security - slide 5 of 37

Passenger Vessel Association Cyber Security - slide 6 of 37

Passenger Vessel Association Cyber Security - slide 7 of 37

Passenger Vessel Association Cyber Security - slide 8 of 37

Passenger Vessel Association Cyber Security - slide 9 of 37

Passenger Vessel Association Cyber Security - slide 10 of 37

Passenger Vessel Association Cyber Security - slide 11 of 37

Passenger Vessel Association Cyber Security - slide 12 of 37

Passenger Vessel Association Cyber Security - slide 13 of 37

Passenger Vessel Association Cyber Security - slide 14 of 37

Passenger Vessel Association Cyber Security - slide 15 of 37

Passenger Vessel Association Cyber Security - slide 16 of 37

Passenger Vessel Association Cyber Security - slide 17 of 37

Passenger Vessel Association Cyber Security - slide 18 of 37

Passenger Vessel Association Cyber Security - slide 19 of 37

Passenger Vessel Association Cyber Security - slide 20 of 37

Passenger Vessel Association Cyber Security - slide 21 of 37

Passenger Vessel Association Cyber Security - slide 22 of 37

Passenger Vessel Association Cyber Security - slide 23 of 37

Passenger Vessel Association Cyber Security - slide 24 of 37

Passenger Vessel Association Cyber Security - slide 25 of 37

Passenger Vessel Association Cyber Security - slide 26 of 37

Passenger Vessel Association Cyber Security - slide 27 of 37

Passenger Vessel Association Cyber Security - slide 28 of 37

Passenger Vessel Association Cyber Security - slide 29 of 37

Passenger Vessel Association Cyber Security - slide 30 of 37

Passenger Vessel Association Cyber Security - slide 31 of 37

Passenger Vessel Association Cyber Security - slide 32 of 37

Passenger Vessel Association Cyber Security - slide 33 of 37

Passenger Vessel Association Cyber Security - slide 34 of 37

Passenger Vessel Association Cyber Security - slide 35 of 37

Passenger Vessel Association Cyber Security - slide 36 of 37

Passenger Vessel Association Cyber Security - slide 37 of 37

Description

Passenger Vessel Association Cyber Security Training Rev. 12.19.25 This cybersecurity training framework is provided by the Passenger Vessel Association and when combined with company specific information, satisfies 33 Code of Federal

Download this presentation From Below

"Passenger Vessel Association Cyber Security" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

Passenger Vessel AssociationCyber Security Training Rev. 12.19.25

This cybersecurity training framework is provided by the Passenger Vessel Association and when combined with company specific information, satisfies 33 Code of Federal Regulations (CFR) 101.650(d) training requirements and is consistent with Coast Guard guidance contained in:
Navigation and Vessel Inspection Circular (NVIC) 02-24, CH 1 - Reporting Breaches of Security, Suspicious Activity, Transportation Security Incidents, and Cyber Incidents
CG-5PC Policy Letter 01-25 - Cybersecurity Training for Personnel with Access to Information Technology or Operational Technology Systems Introduction

This cybersecurity training framework is designed to be customized by individual companies to meet their training needs and still be in compliance with the new cybersecurity regulations
Remove red text after inserting the appropriate information
Cybersecurity requirements should be consistent with and complementary to current security requirements in the PVA Alternative Security Program (ASP) or company Vessel and Facility Security Plans (VSP/FSP)
Individuals providing the training content should be familiar with the references provided throughout this training framework. Hyperlinks are used to provide access to additional information based on the needs of the company
Questions regarding the content of this training can be directed to Eric Christensen of the PVA staff at echristensen@passengervessel.com Remove this Slide Before Presenting Training

33 CFR Part 101, Subpart F – Cybersecurity became effective on July 16, 2025. This subpart set minimum cybersecurity requirements for U.S.-flagged vessels, facilities, and Outer Continental Shelf (OCS) facilities to safeguard and ensure the security and resilience of the Marine Transportation System (MTS).
Owners and operators of U.S.-flagged vessels, facilities, and OCS facilities required to have a security plan under 33 CFR parts 104, 105, and 106 are required to complete specified training as per 33 CFR 101.650(d) by January 12, 2026, and annually thereafter. Why is this required?

Main Tenants:
Know your Key Personnel
Recognition & Detection of Cybersecurity Threats & Incidents
Techniques Used to Circumvent Cybersecurity Measures
Procedures for Reporting a Cyber Incident to the Company Security Officer (CSO) or Cybersecurity Officer (CySO)
Operational Technology (OT) Specific Cybersecurity Training for personnel whose duties include using OT Cyber Security Training

(Insert photos of applicable personnel in your operation if desired)
Cybersecurity Officer (CySO): (if assigned prior to 07/16/2027)
Name & Contact info
Company Security Officer (CSO):
Name & Contact info
Facility Security Officer (FSO): (if applicable)
Name & Contact info
Vessel Security Officers (VSO):
The VSO is the Captain on Duty
Additional Personnel identified as Key Personnel:
Such as General Manager, Operations Manager, etc. Get to Know your Key Personnel

Cyberattacks cost the U.S. economy billions of dollars a year. They also pose a threat for individuals and organizations. Businesses can be attractive targets for cyber criminals. Small businesses in particular may lack the means to protect their digital systems.
Surveys have shown that many small businesses feel vulnerable to a cyberattack. Many small businesses cannot afford professional IT solutions. They may also lack time to devote to cybersecurity or may not know where to begin. Why Cybersecurity Matters

33 CFR 101.615 Defines a Cyber Incident as:
An occurrence that actually jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system, or actually jeopardizes, without lawful authority, an information system. Recognition & Detection of Cybersecurity Threats & Incidents

Common Threats:
Malware (malicious software) is software designed to harm a computer, server, or computer network. Malware can include viruses and ransomware.
Viruses are harmful programs intended to spread from device to device like a disease. Cyber criminals use viruses to gain access to your systems. This can cause significant and sometimes unrepairable issues. Recognition & Detection of Cybersecurity Threats & Incidents

Common Threats:
Ransomware is a type of malware. It infects and restricts access to a computer until the owner provides some sort of ransom. Ransomware can encrypt data on a device, and demand money in return for a promise to restore it. Ransomware exploits unpatched vulnerabilities in software and is usually delivered through phishing emails. Recognition & Detection of Cybersecurity Threats & Incidents

Common Threats:
Spyware is a form of malware. It gathers information from a target and sends it to another entity without consent. Some spyware is legitimate and legal. It may operate for commercial purposes, like advertising data collected by social media platforms. Malicious spyware, however, illegally steals information and sends it to other parties. Recognition & Detection of Cybersecurity Threats & Incidents

Common Threats:
Phishing is a common type of cyberattack. It can use things like links in an email to infect your system with malware to collect sensitive information. Phishing emails can appear legitimate or appear to be sent from a known entity. These emails often entice users to click on fraudulent links or open attachments containing malicious code. Be cautious about opening links from unknown sources. If something seems suspicious from a known source, don’t click on it - ask the source directly if it's legitimate. Recognition & Detection of Cybersecurity Threats & Incidents

According to Coast Guard Cyber Command, in 2024 Marine Transportation System (MTS) cyber incidents involved the use of valid accounts in 42% of reported cases.
Access to these accounts came from:
Phishing,
Leaked credentials, and
Occasionally brute force cracking weak passwords
Administrator accounts are the primary targets and their compromise often led to the most damaging cyber incidents. Techniques Used to Circumvent Cybersecurity Measures

Examples Include:
Using another person’s access credentials
Attempting to bypass cybersecurity measures
Introduction of malware via a USB
Phishing as an initial attack accounted for 25% of reported MTS cyber incidents highlighting the need for user awareness training Techniques Used to Circumvent Cybersecurity Measures

Many of these cases involved business email compromises, or using legitimate accounts to send phishing emails to internal and external contacts, making detection far more difficult and possibly expanding the impact on the MTS.
Domain spoofing continues to be an issue for the MTS, where malicious cyber actors create fraudulent company websites with common functionality, such as submitting bookings and completing financial transactions with the intent to steal customer information or install malicious software on their systems. Techniques Used to Circumvent Cybersecurity Measures

Employee Training – Employees & work-related communications are the leading cause of small business data breaches
Secure Networks – Safeguard your internet connection by encrypting information and using a firewall
Use Antivirus Software & Keep Software updated
Enable Multi-Factor Authentication
Monitor & Manage Cloud Service Provider accounts
Secure, Protect, and Back up Sensitive data Cybersecurity Best Practices

33 CFR 101.615 defines a Reportable Cyber Incident as:
An incident that leads to or, if still under investigation, could reasonably lead to any of the following:
Substantial loss of confidentiality, integrity, or availability of a covered information system, network, or OT system;
Disruption or significant adverse impact on the reporting entity's ability to engage in business operations or deliver goods or services, including those that have a potential for significant impact on public health or safety or may cause serious injury or death;
Disclosure or unauthorized access directly or indirectly of nonpublic personal information of a significant number of individuals;
Other potential operational disruption to critical infrastructure systems or assets; or Incidents that otherwise may lead to a transportation security incident as defined in 33 CFR 101.105. Reportable Cybersecurity Incidents

The cyber domain includes countless malicious but low-level events, such as routine spam, phishing attempts, and other nuisance events that are normally addressed by standard anti-virus programs and cyber hygiene protocols.
Accidental violations of acceptable use policies, such as plugging in an unauthorized portable hard drive or memory stick, is not considered a cyber incident.
MTS stakeholders should report events that are out of the ordinary in terms of sophistication, volume, or other factors which, from the operator's perspective, raise suspicions and may result in a Transportation Security Incident (TSI). What isn’t Reportable?

NVIC 02-24, Change 1 Defines a Breach of Security as:
An incident that has not resulted in a Transportation Security Incident (TSI), in which security measures have been circumvented, eluded, or violated
For purposes of cybersecurity, this definition includes a breach of telecommunications equipment, computer, and network system security measures where those systems conduct or support functions described in Vessel Security Plans, Alternate Security Programs, or Facility Security Plans, or where successful defeat or exploitation of the systems could result or contribute to a TSI. Breaches of Security (BoS)

Unauthorized access to restricted or secure areas
Unauthorized circumvention of security measures, including host and network defenses performing access control
Intrusions into telecommunications equipment, computer, and networked systems having a connection to security plan functions (i.e. access control, cargo control, monitoring), unauthorized root or administrator access to security and industrial control systems, successful phishing attempts or malicious insider activity that could allow outside entities access to internal IT systems that are linked to the MTS, or those that could otherwise result in a TSI Examples of Breaches of Security

Instances of viruses, Trojan Horses, worms, zombies or other malicious software that have a widespread impact or adversely affect the information or operational technology of one or more on-site mission critical servers that are linked to security functions or could otherwise result inTSI
Any denial-of-service attacks that adversely affect or degrade access to critical services that are linked to security functions or could otherwise result in a TSI Examples of Breaches of Security

NVIC 02-24, Change 1 Defines Suspicious Activity as:
An activity that may result in a Transportation Security Incident (TSI).
Examples of Suspicious Activity:
Unfamiliar persons in areas that are restricted to regular employees
Unauthorized personnel accessing IT spaces
Potentially dangerous devices found by screeners prior to loading persons or cargo or items found on or near the facility that seem out of place
Vehicles parked or standing for excessive amounts of time near the facility perimeter
Unusual behavioral patterns
Unauthorized Unmanned Aircraft System Suspicious Activity (SA)

Cybersecurity-related SA should be distinguished from nuisance events that are part of the normal internet landscape, such as
Persistent scanning of networks,
Spam emails, and
Similar unsophisticated events.
Nuisance events should be monitored for signs of escalation in volume, persistence, or sophistication that could be indicative of malicious efforts that should be reported. Suspicious Activity (SA)

NVIC 02-24, Change 1 Defines a Transportation Security Incident as:
A security incident resulting in a significant loss of life, environmental damage, transportation system disruption, or economic disruption in a particular area
Report all potential Transportation Security Incidents, Breaches of Security, and Suspicious Activity to your immediate supervisor
Captain on Duty for Vessel personnel
General Manager for Office personnel Transportation Security Incident (TSI)

If you think a BoS, SA, TSI, or Cyber Incident has occurred, you must report!
Vessel Crew:
Stay Calm
Immediately notify the Captain on Duty
Captain on Duty to notify Company Security Officer (CSO) and Cyber Security Officer (CySO) if identified before 07/16/2027
Office or Facility Personnel:
Stay Calm
Immediately notify the (insert position here)
(insert position here) to notify Company Security Officer (CSO) and Cyber Security Officer (CySO) if identified before 07/16/2027 Reporting Procedures for Frontline Staff

OT-Specific Cybersecurity Training Operational Technology, (OT), means programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems or devices detect or cause a change through the monitoring or control of devices, processes, and events. [33 CFR 101.615]
Examples include autopilot, remote camera control, engine control systems, etc. More examples can be found in the PVA Cyber Risk Management Best Practices located in the Member Resource area of the PVA website under Security Tools.

OT-Specific Cybersecurity Training Reminder – as part of the PVA ASP Cyber Assessment in 2022, all companies were required to identify their vessel and facility specific OT
List of Specific Operational Technology and Related Training:
If None, so state

Questions?

Key Personnel Training

Key Personnel Training Key personnel training with access to IT or remotely accessible OT systems must also have cybersecurity training in the following additional topics:
Understand your roles and responsibilities during a cyber incident and response procedure
Maintain current knowledge of changing cybersecurity threats and countermeasures

Key Personnel Training Understand your roles and responsibilities during a cyber incident and response procedure

Insert company specific roles and responsibility information

Key Personnel Training Maintain current knowledge of changing cybersecurity threats and countermeasures
Examples:
Information pages from Cybersecurity and Infrastructure Security Agency (CISA)
Sector specific Information Sharing and Analysis Center (ISAC)
Area Maritime Security Committee

Reporting Cyber Incidents NRC and CISA For the purposes of cyber incident reporting in accordance with 33 CFR Part 6, a notification, without delay, directly to the NRC is strongly recommended and fulfills the requirement to notify the local COTP.
Additionally, a notification directly to the NRC will be immediately forwarded to the FBI CyWatch at cywatch@fbi.gov which the FBI will accept as a report, and therefore, fulfills both the requirement to report to the COTP and the FBI.
A separate report must be made to CISA at (844) Say-CISA (844-729-2472),
SayCISA@cisa.dhs.gov or at CISA Service Portal

Training Delivered by Key Personnel Training approved by the owner/operator or CySO may incorporate a range of delivery approaches, including, but not limited to, virtual, in-person, or self-paced instruction.
The owner/operator should determine the training provider, with options including in-house employees, contractors, or third-party entities.
The owner/operator is responsible for selecting training that satisfies their operational needs and meets regulatory requirements.

Contractor Training Prior to authorizing IT & OT systems access for a contractor or third-party employee at the vessel or facility, the owner/operator should:
Train the contractor using the company developed training,
Monitor or accompany contractor on-site, or
Evaluate the third-party entity’s existing cybersecurity training program for regulatory compliance and specific alignment to 33 CFR 101.650. If acceptable and meets compliance:
Maintain a record of this decision and keep record of the decision with the ASP.
Review third-party training programs for currency of information and compliance annually.
All records should be available for Coast Guard inspection upon request

Documentation and Recordkeeping Requirements Records Documenting cybersecurity training may be kept in hard copy or electronic format (including in a Learning Management System) and must include the following information at a minimum:
The date of each session,
Duration of session,
A description or outline of the training demonstrating how personnel are trained, and
A list of attendees.

Documentation and Recordkeeping Requirements In addition to documenting the minimum training data, the following information needs to be documented:
How key personnel are defined,
How training is delivered, which may utilize a combination of delivery options, as noted above,
The processes or procedures for physical accompaniment or monitoring of untrained personnel as well as the processes, procedures, and/or automated systems utilized for remote “escorting” of untrained personnel, and
Contractor training records, if applicable

Passenger Vessel Association Cyber Security

Related Topics

Share

Embed code

Download this presentation From Below

Presentation Transcript