MTSA cyber reports need an event-to-notice chronology
U.S. Coast Guard NVIC 02-24 Change 1 distinguishes reporting paths for transportation security incidents, cyber incidents, and reportable cyber incidents. Maritime operators need one event chronology that preserves classification, awareness time, overlapping recipients, updates and the separate response actions that follow.
Editorial figure by OT Defense Review. Source context: U.S. Coast Guard NVIC 02-24 Change 1 cyber-incident reporting guidance.
Build the reporting decision from the event chronology
| Control record | Evidence to retain | What it does not establish |
|---|---|---|
| Event observation | Asset, zone, observed behavior, operational effect, reporter, first-seen time and evidence preservation | That the event meets a reporting definition |
| Classification review | MTSA applicability, TSI, cyber-incident and RCI criteria considered, facts, owner and decision time | That one label resolves every obligation |
| Notice path | Required recipient, channel, required facts, notice time, confirmation or case reference and failed attempts | That delivery proves substantive compliance |
| Updates and correction | New facts, changed classification, supplemental recipients, update time, superseded statements and approver | That the first report remains complete |
| Response and closure | Operational containment, plan activation, law-enforcement coordination, recovery and closure authority | That reporting substitutes for incident response |
Create one event record before choosing a channel
The direct answer is to start with a maritime event chronology: affected facility or vessel, regulatory part, operational zone, asset and system, observed facts, first-seen and awareness times, operational or security effect, evidence location, and accountable reviewer. NVIC 02-24 Change 1 distinguishes BOS, suspicious activity, TSI, cyber-incident and RCI paths. It says Part 6 cyber reporting excludes OCS facilities, while regulated entities outside Part 6 can have RCI reporting under 33 CFR 101.620, and it describes when duplicate 101.620 reporting is not needed after Coast Guard reporting under 33 CFR 6.16-1. [1]
Record each classification considered, the exact fact that supports or defeats it, the applicable regulation and guidance version, decision owner, timestamp and unresolved uncertainty. The NVIC directs TSI reports under Parts 104 and 105 to the local COTP and under Part 106 to the cognizant District Commander. A security alert, service disruption, malware indicator, unauthorized access, safety effect and loss of operational-technology visibility may produce different analyses. The guidance does not classify a reader’s entity or event or resolve every cross-referenced duty. [1]
Map classification to the correct recipients
For Part 6 cyber incidents, the NVIC says COTP, FBI and CISA notice is required. It strongly recommends direct National Response Center notice without delay: that notice fulfills the COTP path, and NRC forwarding to FBI CyWatch fulfills the FBI path. A separate CISA report remains required. Preserve the classification, chosen route, required facts, sent time, person sending, receipt or case reference, unsuccessful attempts and the version of facts communicated. [1]
Do not collapse the paths into one generic reported flag or imply that three separate transmissions are invariably required. A direct COTP report does not replace the NRC path for BOS or suspicious activity described in the NVIC, and NRC does not cover the separate CISA report. Maintain a recipient matrix tied to the event and applicable regulatory part, with qualified review for uncertainty, while operations continue the actions required by the facility or vessel plan. [1]
Separate notice, update and operational response
Initial reporting is one state in the incident lifecycle. Later evidence can change scope, severity, affected zones, classification or recipient. Link each supplemental report to the prior version, state what changed, identify the reviewer, and preserve any correction of an earlier statement. Never overwrite the original notice with the final narrative.
Keep containment, safety measures, plan activation, evidence preservation, third-party coordination, restoration, law-enforcement requests and regulatory notices as separate work records. Reporting does not authorize unsafe isolation or service restoration, and receipt does not prove the incident is contained. Human incident command and applicable operating authority remain responsible.
Test the chronology before an incident
Exercise cases should include uncertain MTSA scope, a cyber event without immediate operational effect, an event that may be both TSI and RCI, incomplete awareness time, communications failure, a changed classification, and a correction after initial notice. Reviewers should be able to reconstruct what was known, who decided, which route was used and what remained open at every point.
OT Defense Review reviewed the exact current NVIC on October 7, 2026. The November 12, 2025 document says it clarifies existing reporting requirements and does not create new law, so this is durable operational analysis rather than a post-cutoff development claim. Unknowns include a reader’s regulatory part, entity and event scope, classification, awareness time, recipient duties, notice sufficiency, plan actions, receipt and compliance outcome. [1]
Enterprise buyer test
Translate this change into the exact population, record type, workflow stage, decision owner, effective date, and evidence that could be affected. Ask current or prospective providers to demonstrate the named workflow with representative data and an exception—not a polished feature tour. Record what official documentation establishes, what a provider states, what the team observes, and what remains unresolved.
A defensible review also identifies the dependency outside the product. Authority interpretation, policy configuration, data quality, integrations, human judgment, approval rights, release governance, training, and retained evidence may remain customer or service responsibilities. The evaluation should preserve those boundaries instead of treating a technology claim as the complete operating model.
What we will watch next
OT Defense Review will watch the named source and affected market records for later evidence that changes status, scope, availability, implementation timing, workflow consequence, or the limits of the initial report. A later announcement does not silently overwrite this dated account; the change ledger preserves the sequence.