NATIONAL MARITIME CYBERSECURITY PLAN internationally accepted, outcome-focused, threat-informed risk framework for port OT systems. Currently, no standard exists for assessing risk in OT networks. An OT risk framework will allow maritime stakeholders, including insurers, facility and/or vessel owners and shippers, to share a common risk language and develop common OT risk metrics for self-assessments. International cooperation, through bilateral engagement or multilateral forums, such as the International Maritime Organization, is critical to align domestic risk standards with international cybersecurity risk standards. Transparency and cooperation will inform a framework, that when used, and will raise adversary costs to compromise maritime systems. The United States will create an international port OT risk framework based on the input from domestic and international partners and promote the framework internationally. Priority Action 2: The United States will develop risk modeling to inform maritime cybersecurity standards and best practices. The United Sates Coast Guard 9 issued reporting guidance to MTSA-regulated facilities and vessel owners and operators regarding security breaches and suspicious activity, including those concerning telecommunications equipment, computers, and network systems. The guidance distributed to MTS stakeholders, however, did not account for cyber incidents that breach a system’s defenses or that target administrative systems, unrelated to safe and secure maritime operations. Given the growing number of reports received by the United States Coast Guard regarding maritime cyber events affecting MTSA-regulated facilities, an amendment to the reporting guidance may be necessary to understand the persistence of maritime cyber incidents across MTS owners and operators to help inform new or revised maritime cybersecurity standards. The United States Coast Guard amplified maritime incident reporting guidance, 10 11 including cyber-related vulnerability information in facility security assessments for MTSAregulated facilities, however, gaps remain in cybersecurity threshold reporting. 12 The United States Coast Guard will analyze and clarify the 2016 and 2020 cybersecurity reporting guidance for maritime stakeholders and collect maritime cyber incident reports to identify trends and attack vectors to increase maritime sector situational awareness and decrease maritime cyber risk. Priority Action 3: The United States will strengthen cybersecurity requirements in port services contracts and leasing. To limit adversarial opportunity, contracts or leases binding the United States Government and private entities must contain specific language addressing cyber risk to the MTS. The private sector owns and operates the majority of port infrastructure. The General Services Administration (GSA) provides minimum Federal government guidelines for Federal contracting. Revised Federal government contracting language is needed to protect Federal departments and agencies from the increased pace of technology proliferation. Port services such as, but not limited to, loading, unloading, stacking, ferrying, or warehousing The National Institute of Standards and Technology (NIST) will construct an 9 United States Coast Guard, Reporting Suspicious Activity and Breaches of Security, 2016. 10 United States Coast Guard, Reporting, and Investigation of Marine Casualties Where the United States is a Substantially Interested State, 2017. 11 U.S. Coast Guard, Reporting, and Investigation of Marine Casualties Where the United States is a Substantially Interested State, 2017.12 U.S. Coast Guard, Reporting, and Investigation of Marine Casualties Where the United States is a Substantially Interested State, 2020. 12 U.S. Coast Guard, Reporting, and Investigation of Marine Casualties Where the United States is a Substantially Interested State, 2020. 4