NATIONAL MARITIME CYBERSECURITY PLAN RISKS AND STANDARDS T part of the MTS relies on outdated telecommunication infrastructure, threatening the ability for MTS stakeholders to protect digital information, the network, and to detect when malign actors are attempting to access protected systems. he MTS subsector is diverse, with businesses of all sizes leveraging IT and OT systems that interconnect with larger maritime systems. Users across the maritime sector access key data and management systems daily for business purposes, making secure access control and user monitoring difficult. Some MTS operators lack the ability to control the security of critical systems because different public and private entities own and operate these interconnected systems. Although cybersecurity standards and frameworks are widely available, businesses often lack the resources or expertise to implement them effectively, leaving them vulnerable to cybersecurity disruptions. Small and mediumsized businesses would benefit from port security or other grant program funding set aside for maritime cybersecurity enhancement projects. Cybersecurity within some ports and facilities is situational, ad-hoc, and often driven by profit margins and efficiency. Unless the private sector has a clear understanding of current and future maritime cybersecurity threats and a financial incentive to invest in maritime cybersecurity measures, some private sector entities may not be inclined to align with maritime partners or Allies. To correct and mitigate these threats, the United States will accomplish the following priority actions. Priority Actions Priority Action 1: The United States will deconflict government roles and responsibilities. More than 20 Federal government organizations currently have a role in maritime security. These organizations regulate, oversee, and/or manage: vessel and personnel safety, transportation standards, physical security, and other maritime industry roles. Common cybersecurity standards however, do not exist and are not consistent across Maritime Transportation Security Act (MTSA) and nonMTSA regulated facilities. Consistent maritime cybersecurity standards, across maritime industry stakeholders, enable greater coordination to address gaps and vulnerabilities to IT and OT systems allowing exploitation to disrupt maritime commerce. Further, when maritime stakeholders develop common maritime cybersecurity standards, it enables public and private entities to share best practices to mitigate unforeseen cyber vulnerabilities. The NSC staff, through the policy coordination process, will identify gaps in legal authorities and identify efficiencies to de-conflict roles and responsibilities for MTS cybersecurity standards. No single entity owns, controls, manages, or regulates businesses or networks used throughout the maritime domain. MTS stakeholders rely on IT and OT systems to communicate with various transportation nodes to facilitate the movement of goods, illuminating the interdependencies that support our economic prosperity. No one entity standardizes or operates the disparate OT systems within the MTS. Additionally, a large 3