// for tsa’s cybersecurity directives and the coast guard’s cyber rule
Every requirement.
Every deadline.
Every document.
TSA’s cybersecurity directives and the Coast Guard’s cyber rule each add a yearly cycle of plans, assessments, training, drills, reports and records, and most of it is Sensitive Security Information. The guidance keeps changing. Securidigm Signal and Harbor map every paragraph, run every deadline and draft every document from your answers, traced to the rule, on your own computer.
- Briefing, October 2026
- Every number and quote sourced
- Signal · Harbor
- 565TSA directive paragraphs, each accounted for in Signal
- 172Subpart F paragraphs, each accounted for in Harbor
- 8Coast Guard guidance releases in eleven months
- 5incident reporting clocks across three regimes
// the short version
The briefing in 60 seconds.
The full briefing, with every source, is a 24-page PDF you can share with your team.
- The burdenEach regime adds a yearly cycle of plans, assessments, training, drills, reports and records, all of it Sensitive Security Information.
- The moving targetTSA renews its five cyber directives a year at a time and revises them as it goes. A permanent rule, proposed in 2024, is still not final.
- The confusionCoast Guard plans are due July 16, 2027, yet operators are asked not to submit full plans yet. Eight guidance releases in eleven months. Five reporting clocks.
- The fixSignal (TSA) and Harbor (Coast Guard) map every paragraph, run every deadline and draft every document from your answers, traced to the rule.
- Local by designOne HTML file. No install, no account, no outside connections. AES-256 encrypted in your own folder. Your IT team can verify all of it.
// two regulators, two rulebooks
Open the rules that apply to you.
TSA’s directives for pipeline and rail, the Coast Guard’s rule for maritime. Click a panel to open it.
TSA · pipeline & rail → SignalFive directives. Renewed a year at a time.Each directive expires and is reissued, usually with changes. Operators have lived under these directives since the Colonial Pipeline attack in 2021; a permanent rule was proposed on November 7, 2024 and is still not final.
| Directive | Covers | Current |
|---|---|---|
| Pipeline-2021-01 | Pipelines and LNG | 01G · Jan 2026 – Jan 2027 |
| Pipeline-2021-02 | Pipelines and LNG | 02G · May 2026 – May 2027 |
| 1580-21-01 | Freight rail | 01E · posted Jan 2026 |
| 1582-21-01 | Passenger rail and rail transit | 01E · posted Jan 2026 |
| 1580/82-2022-01 | Freight and passenger rail | 01E · posted May 2026 |
The TSA cycle never stops.
An approved Implementation Plan isn’t the finish line. The directives require this cycle every year, and all of it is Sensitive Security Information.
- TSA-approved Implementation Plan
- Amendments filed on deadline after changes
- Assessment Plan updated for TSA every year
- Annual report on last year’s assessments
- Every measure assessed within three years
- Architecture design review at least every two years
- Incident response plan exercised every year
- Coordinator and alternate reachable 24/7
- Incidents reported to CISA within 72 hours
- Every record inspection-ready, marked SSI
“inapplicable, confusing, extremely costly, and disruptive to owners/operators”
“TSA did not ensure all pipeline operators timely adhered to security requirements”
Coast Guard · maritime → HarborThe rule doesn’t end in 2027.2027 is the starting line. The annual cycle runs for as long as you operate.
- In force · Jul 16, 2025
Report incidents
Reportable cyber incidents go to the National Response Center without delay, unless already reported under 33 CFR 6.16-1.
- Passed · Jan 12, 2026
Training done
Cybersecurity training for everyone with access to IT or OT systems.
- Next · Jul 16, 2027
Officer, assessment, plan
Cybersecurity Officer designated, Cybersecurity Assessment complete, Cybersecurity Plan submitted.
- Then, every year
The cycle
Assessment and training; once the Coast Guard approves the plan, an audit, two drills and an exercise. Plan renewal and a penetration test every five years.
// the paradox
Submit by July 16, 2027. But don’t submit yet.
“refrain from submitting full CSPs until further notice”
“The Coast Guard is not currently approving plans for these regulations.”
The Coast Guard is processing waiver and equivalency requests first and is still developing its plan review procedures. The July 16, 2027 date in the rule hasn’t moved. For U.S.-flagged vessels, a 2–5 year delay was floated in January 2025, but any delay needs a separate rulemaking and none has been published. The safe position: be ready the day the window opens.
| Date | Release | What it covers |
|---|---|---|
| Jul 22, 2025 | FAQ update | Plan, reporting and other rule questions |
| Oct 2025 | Policy Letter 01-25 | Training for staff with IT or OT access |
| Nov 12, 2025 | NVIC 02-24, Change 1 | Reporting breaches and cyber incidents |
| Jan 9, 2026 | FAQ update | The Coast Guard isn’t approving plans yet |
| Jan 9, 2026 | Work Instruction 001 | Verifying cyber training |
| Jun 2, 2026 | Policy Letter 01-26 | Assessment scoping and process |
| Jun 3, 2026 | Work Instruction 002 | Waivers and equivalency |
| Jun 3, 2026 | Work Instruction 003 | Submitting through DoD SAFE |
// incident reporting
Five reporting clocks. Three regimes.
A terminal that also runs pipeline can face all three agencies. In October 2025 the TSA directives’ reporting window went “from 24 to 72 hours”; TSA’s proposed rule would make it 24 again.
| Rule | Report to | Clock | Status |
|---|---|---|---|
| USCG · 33 CFR 6.16-1 | FBI, CISA and the Captain of the Port | “Immediately” | In force |
| USCG · 33 CFR 101 Subpart F | National Response Center | “Without delay” | In force |
| TSA security directives | CISA | 72 hours (was 24) | In force |
| TSA proposed rule | CISA | 24 hours | Proposed 2024 |
| CISA · CIRCIA | CISA | 72 hours; ransom payments 24 hours | Proposed 2024 |
“a source of genuine confusion about what is required, when, and of whom.”
“The USCG cybersecurity rule for maritime facilities is now 2 rules, not 1.”
“This new reporting requirement creates a bureaucratic maze for regulated entities.”
“generally heading toward more fragmentation, not more harmonization.”
// the fix
What Signal and Harbor take off your desk.
Guided workbooks built from the published rule and directives: every requirement in plain language, your evidence organized, your documents drafted from your answers.
Securidigm Signal · TSA cybersecurity directives · 19 documents and 7 forms
- 01
What applies
Tick the directives TSA notified you about. Only those requirements appear, each cited: 56 requirements across 565 paragraphs.
- 02
The yearly cycle
Assessment Plan update and report, three-year schedule, architecture review, incident response exercise, with holiday-adjusted deadlines.
- 03
The revisions
Each release names the revision it follows and TSA’s summary of what changed. Updates are designed to open your existing workspace.
- 04
The paperwork
Implementation Plan, amendment requests, Coordinator notices, records package for inspection.
- 05
The gaps
A plan of action where every gap gets an owner, milestones and a due date.
- 06
The incident
The 72-hour CISA worksheet and call sheet, pre-filled, with the 24-hour supplement clock.
Securidigm Harbor · 33 CFR 101, Subpart F · 24 documents and 26 forms
- 01
The rule
172 paragraphs, each mapped or listed with a reason. Each requirement labeled “required by regulation” or “Coast Guard guidance.”
- 02
The assessment
Follows Policy Letter 01-26: functions, assets, threats, priority assets, critical IT and OT.
- 03
The plan
All 14 sections of the Cybersecurity Plan drafted from your answers. Anything unaddressed is listed, not hidden.
- 04
The registers
Hardware, software, network map, remote OT access, compensating controls, third parties.
- 05
The calendar
Every deadline with its citation: training, drills, audits, triggers. Exports a calendar file for Outlook, Google and Apple.
- 06
The submission
Waiver or equivalency letter drafted. Each plan ends with its certification letter, with a “How to send it” checklist for DoD SAFE.
Every line traces back to the rule.
Missing or changed evidence is flagged. Mapped isn’t met: you, your officer and the regulator decide.
- 1 · The rule The exact paragraph, quoted and cited
- 2 · Your answer How you meet it, in your own words
- 3 · Your evidence Files attached and cited by name
- 4 · The document The plan section a reviewer reads
- Status at a glance: met with evidence, claimed without evidence, gap, not started
- Both apps show a traceability matrix on screen: paragraph, answer, evidence, plan section
// local by design
Nothing to install. Nothing to leak.
Your plan is Sensitive Security Information. It never sits on anyone’s server, including ours. Printed or exported documents aren’t encrypted; they carry the SSI marking.
One HTML file
No install, no account. Chrome, Edge, Firefox or Safari on a Mac (Windows testing comes before release).
No outside connections
A security policy inside the file blocks them all.
AES-256 encryption
Your browser’s built-in cryptography, with your password.
Your folder
Work and evidence saved, encrypted, where you choose.
A SHA-256 with each release
A published fingerprint proves your copy hasn’t been altered.
Only you hold the key
We can’t recover it. We can’t read your data.
// verify it yourself
Don’t take our word for it. Check.
The 14-day evaluation opens from this website, so run these checks on the licensed file. Please don’t enter real SSI while you evaluate.
- 1
Read the file
The policy that blocks outside connections is in the file. Your IT team can read it.
- 2
Watch the network
Open the browser’s developer tools and use the app. Nothing goes out.
- 3
Pull the plug
Go offline or into airplane mode. Everything still works.
- 4
Match the hash
Run shasum -a 256 (Mac) or Get-FileHash (Windows) and compare it to the SHA-256 published with each release.
// plainly
What it is not.
- Not approval. The Coast Guard and TSA decide. Mapped isn’t met.
- Not your officer. Your Cybersecurity Officer or Coordinator decides how each requirement is met.
- Not legal advice, and we don’t represent you before the Coast Guard or TSA.
- Not a security tool. It doesn’t scan, test or change your systems.
- Not a cloud service. No account; nothing you enter is stored on our servers.
- Not affiliated with or endorsed by the Coast Guard, TSA, DHS or any agency.
// who built it
Built from the inspector’s side of the table.
Independent. Built only from published regulations and public guidance: no non-public information, no SSI.
- Former DHS/TSA cyber inspectorReviewed cybersecurity programs against the NIST Cybersecurity Framework and federal regulation. Retired June 2026.
- Former OGA operations officerIntelligence, counterterrorism and counterintelligence operations.
- Former U.S. Secret Service Special AgentProtective details, electronic crimes, international financial-crime investigations.
- Director of IT & SecurityA single-family-office portfolio of operating companies. More about Michael D. →
// the briefing
Take the whole story with you.
24 pages for Cybersecurity Officers, Facility and Vessel Security Officers, Cybersecurity Coordinators, compliance managers, partners and investors: the rules, the deadlines, the guidance, the reporting clocks, what Signal and Harbor do, and where every number and quote comes from.
Sources
- USCG, Cybersecurity in the Marine Transportation System, 90 FR 6298 (Jan 17, 2025); 33 CFR 101 Subpart F; USCG fact sheet (Jan 2025)
- USCG Maritime Commons, policy and guidance release (June 4, 2026); USCG Final Rule FAQ (Jul 22, 2025; Jan 9, 2026); Work Instruction 001 (Jan 9, 2026)
- Congressional Research Service, R49009, Cybersecurity: Considerations on Regulatory Harmonization (June 26, 2026)
- GAO-25-107244 (Feb 11, 2025); DHS OIG, OIG-23-57 (Sept 27, 2023)
- E. Dullea, J. Maurer & B. Nashed, Husch Blackwell, Byte Back (July 31, 2025); Trident Group America, “The Law Has Landed” (July 26, 2026); K. Ramos, Uprite Services (uprite.com), “The USCG Maritime Cyber Rules Texas Operators Keep Missing” (Sept 4, 2026)
- K. Denbow, American Gas Association, testimony to the House Homeland Security transportation and maritime subcommittee (Nov 19, 2024)
- TSA SD 1580-21-01D memo (Oct 22, 2025); SDs Pipeline-2021-01G and -02G; tsa.gov/sd-and-ea; TSA, Enhancing Surface Cyber Risk Management, 89 FR 88488 (Nov 7, 2024), RIN 1652-AA74
- CISA, CIRCIA proposed rule, 89 FR 23644 (Apr 4, 2024)