NATIONAL MARITIME CYBERSECURITY PLAN Information Technology and Operations Technology IT cybersecurity standards and frameworks are widely available, including CISA’s Cyber Essentials, 31 the Top 10 Cybersecurity Mitigation Strategies published by the National Security Agency, 32 and the NIST Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity. 33 Although cybersecurity standards and frameworks are widely available, implementation is often challenging, especially for small and medium-sized businesses that may lack the resources or expertise to implement these controls. Beyond the IT and OT environments directly controlled by the maritime subsector, there are additional vulnerabilities in related systems. Of particular concern are vulnerabilities in electromagnetic spectrum (EMS) technologies, which provide for global connectivity and positioning. EMS systems include satellite signals from the Global Positioning System (GPS), voice communications, and data communications for intra-ship systems, inter-ship systems, and ship-to-shore systems. Growth of Innovative Technologies Ports, waterfront facilities, vessels, and Federally regulated waterways leverage automation and data analysis tools to facilitate the throughput and distribution of maritime commerce, goods, and services to domestic and international markets. The expectation is this trend will increase with research, development, and deployment of smart ships and autonomous ships. 34 Over the past 5 years, the MTS has endured malicious cyber activities affecting control systems, security systems such as security cameras and access control technology, navigation systems, and business networks, highlighting that these systems are even more vulnerable. Malicious software can target control systems within critical infrastructure, corrupting processes and potentially deleting or corrupting data. Some port owners and operators outsource cybersecurity functions while others manage it organically; a situation that further complicates a comprehensive understanding of the network environment and information flow in the MTS. Cybersecurity firms offer differing levels of services and must understand the requirements of the owners and operators along with critical business functions. Additionally, service providers may have foreign ties through investment or other means of influence. Owners and operators must exercise diligence when outsourcing cybersecurity services. Widening the risk, the cybersecurity environment lacks cohesive and practical uniform standards of cybersecurity practices from across the public and private sectors. 31 https://www.cisa.gov/sites/default/files/publications/19_1106_cisa_CISA_Cyber_Essentials_S508C_0.pdf 32 https://www.nsa.gov/Portals/70/documents/what-we-do/cybersecurity/professional-resources/csi-nsas-top10cybersecurity-mitigation-strategies.pdf?v=1 33 https://www.nist.gov/cyberframework 34 Maritime Information Services, China to accelerate smart ship development after CSSC and government agree deal, https://www.porttechnology.org/news/china-to-accelerate-smart-ship-development-after-cssc-and-government-agreedeal/, retrieved July 20, 2020. A-8