Maritime Cybersecurity Act

Key Points

• The bill requires the Coast Guard, working with CISA, to conduct annual cybersecurity assessments of internet-connected software and hardware used at regulated port facilities. These assessments must begin within one year of enactment and focus on vulnerabilities that could be exploited by threats.
• Port facility owners must report to the government within 180 days any technology they use that was made by or in a foreign country or entity of concern. They also must certify that their software and hardware meets NIST standards or equivalent, and report any cybersecurity incidents.
• Facilities that cannot certify their technology meets NIST standards are banned from using it, unless the Secretary grants a waiver after determining the national security risk is low and outweighed by the benefit to commerce.
• The Coast Guard can inspect port technology regardless of private licensing agreements or contracts that would normally block such reviews, and without needing consent from the facility owner or any other party.
• The bill specifically targets cranes and other port equipment manufactured by foreign entities or countries of concern, a clear reference to Chinese-made ship-to-shore cranes that handle a large share of cargo at U.S. ports.