NATIONAL MARITIME CYBERSECURITY PLAN E.O. 13636: Improving Critical Infrastructure Cybersecurity (2013): Directs Federal agencies to coordinate with critical infrastructure owners and operators to improve information sharing and to develop and implement risk-based approaches to cybersecurity. Further, it directs the Secretary of Homeland Security to increase cybersecurity information sharing efforts with the private sector, consult on and promote the NIST Cybersecurity Framework, and identify, develop, and maintain a list of critical infrastructure entities where a cybersecurity incident could reasonably result in catastrophic effects to the nation. E.O. 13691: Promoting Private Sector Cybersecurity Information Sharing (2015): Directs the Secretary of Homeland Security, in coordination with Sector-Specific Agencies and other federal agencies, to strongly encourage the formation of ISAOs. Provides a framework for further sharing of classified and unclassified information with the private sector. Cybersecurity Information Sharing Act of 2015 (CISA 2015): This act improves cybersecurity throughout the United States by promoting increased information sharing about cybersecurity threats and countermeasures. CISA 2015 requires DHS, in consultation with department and agency partners, to develop the Federal government’s capability and process for receiving cyber threat indicators and defensive measures, and directs DHS to share cyber threat information with Federal entities in an automated and real-time manner. CISA 2015 authorizes and encourages private entities to share cyber threat indicators with one another and to monitor their networks for cybersecurity threats, with liability protection, as well as conducting defensive measures. E.O. 13905: Strengthening National Resilience through Responsible Use of Positioning, Navigation, and Timing (PNT) Services (2020): Directs Federal departments and agencies to take risk-based approaches to identify responsible use of PNT across critical infrastructure applications, including maritime applications. These approaches include: understanding how the infrastructure relies on PNT; identifying which PNT services are best suited for each application; enhancing the ability to detect disruption and data manipulation of data from PNT services; and enabling infrastructure owners and operators to manage associated risks to their systems, networks, and assets that depend on PNT services. The Maritime Transportation Security Act (MTSA) of 2002: MTSA addresses port and waterway security and implements International Ship and Port Facility Security Code requirements for the United States. The Act emphasizes the need to protect ports and waterways that are open, exposed, and susceptible to transportation security incidents. MTSA also requires vessels and maritime facilities to conduct vulnerability assessments and develop security plans, and for those assessments to be updated at least every 5 years to account for the changes or evolution of threats and vulnerabilities. Regulations require the owners and operators of MTSA-regulated facilities to analyze vulnerabilities associated with radio and telecommunications equipment, including computer systems and networks. Facility security plans must therefore address cybersecurity vulnerabilities identified in a facility’s security assessment. MTSA regulations include the Integration Center; and intelligence support is led by the Office of the Director of National Intelligence, acting through the Cyber Threat Intelligence Integration Center. A-2