NATIONAL MARITIME CYBERSECURITY PLAN INTRODUCTION The Unites States is a maritime Nation consisting of an integrated network of 25,000 miles of coastal and inland waterways, 361 ports, 124 shipyards, more than 3,500 maritime facilities, 20,000 bridges, 50,000 Federal aids to navigation, and 95,000 miles of shoreline that interconnect with critical highways, railways, airports, and pipelines. The Maritime Transportation System (MTS) contributes to one quarter of all United States gross domestic product, or approximately $5.4 trillion. 1 The President has designated cybersecurity of the MTS a top priority for national defense, homeland security, and economic competitiveness. 2 M aritime Transportation System operators are increasingly using information technology (IT) and operational technology (OT) to maximize the reliability and efficiency of maritime commerce, including: assisting with vessel navigation, communications, shipboard engineering management, cargo management, cargo screening, ballast management, safety, physical security, environmental control, emergency response, and even cargo loading and offloading. 3 The proliferation of IT across the maritime sector is introducing previously unknown risks, as evidenced by the June 2017 NotPetya cyber-attack, which crippled the global maritime industry for more than a few days. 4 5 This plan articulates how the United States government can best buy down the potential catastrophic risks to national security and economic prosperity caused by MTS operators’ increasing reliance on IT and OT, while still promoting maritime commerce efficiency and reliability. The National Maritime Cybersecurity Plan (Plan) for the National Strategy for Maritime Security (NSMS) integrates cybersecurity into the NSMS’s principles of: (1) Freedom of the seas; (2) Facilitation and defense of commerce to ensure the uninterrupted flow of shipping, and (3) Facilitation of the movement of desirable goods and people across our borders, while screening out dangerous people and material. 6 The Plan unifies maritime cybersecurity resources, stakeholders, and initiatives, aggressively mitigating current and near-term maritime cyberspace threats and vulnerabilities and complements the NSMS’ seven supporting plans. 7 The Plan identifies Federal 1 United States Committee on the Maritime Transportation System, Why the Maritime Transportation System (MTS) Matters, https://www.cmts.gov/about/why_mts 2 The White House, National Security Strategy, Washington D.C., 2017, page 13. 3 (U//FOUO) COVID-19 Losses to Maritime Industry Likely to Prompt Look at More Automation, DHS, May 1, 2020. 4 Center for Strategic and International Studies (CSIS), Significant Cyber Events since 2006, (Washington D.C.: May 2020). 5 The Maritime Executive, Naval Dome: Cyberattacks on OT Systems on the Rise, Date of Information: 26-July-2020, accessed 27-July-2020, https://www.maritime-executive.com/article/naval-dome-cyberattacks-on-ot-systems-on-the-rise 6 The White House, National Strategy for Maritime Security (NSMS), Washington D.C., 2005, Section III. 7 The White House, National Strategy for Maritime Security (NSMS), Washington D.C., 2005, Annex A. The eight other supporting plans are the National Plan to Achieve Maritime Domain Awareness, Global Maritime Intelligence Integration 1