US Coast Guard Opens Dedicated Cybersecurity Office for America's Ports and Waterways
A new federal office will write the rules on digital security for the network of ports, ships, and waterways that keeps American trade moving. It arrives after a government watchdog said the Coast Guard's cyber approach had serious gaps.
Key points
- The US Coast Guard formally created the Office of Maritime Cybersecurity Policy (CG-MCP) to set and enforce digital security rules across America's Marine Transportation System.
- The new office covers roughly 360 commercial sea and river ports that together form the backbone of US maritime trade.
- A February 2025 Government Accountability Office report found the Coast Guard's existing cyber strategy lacked proper risk assessments, performance measures, and clear staff responsibilities.
- CG-MCP will act as the Coast Guard's main point of contact with shipping companies, other government agencies, and international standards bodies.
- The Coast Guard has not confirmed whether the GAO's criticism directly triggered the new office's creation.
America's ports don't run on ropes and radar alone. Every major facility now depends on software-controlled cranes, networked navigation systems, and automated cargo tracking. That connectivity is efficient. It's also a door that criminals can try to open.
The US Coast Guard has created a unit specifically to lock that door: the Office of Maritime Cybersecurity Policy, known as CG-MCP. It'll be the single central authority for cybersecurity rules across the Marine Transportation System, the collective name for the ports, vessels, and waterways that move goods around the country.
What will this office actually do?
CG-MCP will set policy, run compliance checks, and serve as the Coast Guard's official voice on maritime cyber issues with industry and foreign governments. It sits inside the Directorate of Inspections and Compliance, which means it carries enforcement authority, not just advisory status. The office will also track new technologies and attack techniques so the sector can respond before a problem becomes a crisis.
Rear Admiral Robert C. Compher, who oversees prevention policy, said the Coast Guard needs a single body that can develop clear policy, direct a unified compliance strategy, and collaborate with partners. Until now, that function was scattered.
Why now, and what went wrong before?
The timing matters. About 18 months before CG-MCP's creation, the Government Accountability Office, the independent watchdog that audits federal agencies, published findings identifying significant weaknesses in how the Coast Guard handled cybersecurity across those 360 commercial ports. Then a February 2025 GAO report tightened the case further.
| Problem identified | What it meant in practice |
|---|---|
| Inaccurate incident records | Cyber attacks weren't always logged correctly |
| Hard-to-access deficiency data | Inspectors couldn't easily see known weaknesses |
| Strategy misaligned with national plans | Coast Guard cyber goals didn't match federal priorities |
| Staff competency gaps | Personnel with cyber duties lacked defined skill requirements |
The GAO called on the Coast Guard to fix all of these. Our coverage of AI adapting industrial exploits for water-sector hardware on 1 September 2026 showed how quickly operational technology threats are evolving, which makes the absence of a dedicated maritime cyber authority look even more conspicuous in hindsight. The Coast Guard hasn't said publicly whether the new office is a direct response to the GAO findings.
For ordinary people, the stakes are concrete. A disrupted port doesn't just inconvenience shipping companies. It delays goods on shop shelves, fuel at petrol stations, and raw materials factories need.
Should ordinary people do anything?
Not immediately. This is a structural reform aimed at operators of ships and port facilities, not individual consumers. If you work in maritime logistics, your employer may face new compliance requirements in the coming months. Watch for updated Coast Guard guidance on cybersecurity standards, particularly around incident reporting and staff training.
For everyone else: the federal government is trying to harden a stretch of critical infrastructure that had been running without a coherent set of cyber rules. That's overdue, and it's genuinely good news. The harder question is whether CG-MCP gets the staffing and budget to match its mandate, or becomes another well-named office filing well-intentioned guidance nobody enforces.
