NATIONAL MARITIME CYBERSECURITY PLAN ANNEX A DIRECTIVES AND STATUTORY PROVISIONS Presidential Policy Directive (PPD)-18: Maritime Security: Defines the maritime domain as the world’s oceans, seas, and waterways. PPD-18 affirms: leveraging public and private sector relationships to enhance maritime domain awareness and sharing relevant information with maritime stakeholders; promoting continuity and resilience of the MTS; facilitating free flow of commerce; and encouraging adoption of security measures in commercial practices. As the introduction of the Internet of Things (IoT) grows within the maritime environment, these themes tie directly into cybersecurity. PPD-21: Critical Infrastructure Security and Resilience: PPD-21 updates the national approach and calls for improving overall critical infrastructure security and resilience, and specifically cybersecurity. It defines critical infrastructure broadly, including cyber and other systems as well as physical structures across 16 designated United States critical infrastructure sectors led by sector-specific agencies (SSA). PPD-21 promoted the NIST Cybersecurity Framework for use by critical infrastructure owners. The United States Coast Guard and the Department of Transportation are the co-SSA for the Maritime Transportation System Subsector.15 PPD-41: United States Cyber Incident Coordination: An increase in the frequency of significant cyber incidents requires synchronizing organizational and government incident response. The private and public sectors have shared interests in safeguarding themselves from malicious cyber activities and in managing cyber incidents and their consequences. PPD-41 outlines the principles, concurrent lines of effort, and leads for the Federal government’s national response to significant cyber incidents. The principles include shared responsibility, risk-based response, respecting affected entities, unity of governmental effort, and enabling restoration and recovery. The concurrent lines of effort include threat response, asset response, and intelligence support. Additionally, PPD-41 identifies three ways the Federal government coordinates its activities: national policy coordination, national operational coordination, and field-level coordination. Finally, PPD-41 directs the Secretary of Homeland Security to develop a National Cyber Security Incident Response Plan, in coordination with the Attorney General, the Secretary of Defense, and the heads of other SSAs. 16 15 The United States Coast Guard consults with the National Maritime Security Advisory Committee and similar organizations to better understand and address cyber risks in the marine transportation system subsector. At the local level, Federal Maritime Security Coordinators consult with Area Maritime Security Committees (AMSC). 16 Presidential Policy Directive 41, United States Cyber Incident Coordination (July 26, 2016), https://obamawhitehouse.archives.gov/the-press-office/2016/07/26/presidential-policy-directive-united-states-cyberincident PPD-41 mandated that in coordinating responses to significant cyber incidents, “threat response” activity is led by Department of Justice, acting through the FBI and National Cyber Investigative Joint Task Force; “asset response” activity is led by the Department of Homeland Security, acting through the National Cybersecurity and Communications A-1