MTSA ownership changes need an assessment-to-plan record
Current Coast Guard cybersecurity rules require the annual Cybersecurity Assessment sooner when ownership of a covered U.S.-flagged vessel, facility, or OCS facility changes. Transaction teams need one record connecting the legal trigger and covered operating boundary to the assessment, VSA or FSA resolutions, and resulting Cybersecurity Plan amendment.
Editorial figure by OT Defense Review. Source context: 33 CFR 101.650, Cybersecurity measures.
Trace the ownership trigger into the controlled plan
| Governed object | Minimum retained evidence | What it does not establish |
|---|---|---|
| Ownership-change trigger | Named legal entities, transaction instrument, covered vessel or facility, prior and new owner or operator, effective event and date, applicability review, reviewer and unresolved conditions | That every corporate transaction changes ownership for this rule or that the regulation applies to an unnamed asset |
| Covered operating boundary | Vessel, facility or OCS facility identifiers, network and system scope, critical IT and OT designations, responsible CySO, current assessment and plan versions | A complete inventory, correct criticality designation, safe architecture, or compliant state |
| Cybersecurity Assessment | Assessment date, qualified participants, networks analyzed, methods, source records, gaps, vulnerabilities, plan-validation results, recommendations and evidence limitations | That every network or weakness was found, a penetration test was completed, or a control is effective |
| VSA, FSA or OCS FSA resolution | Each recommendation, accountable disposition, compensating control or action, owner, due date, evidence, exception, residual uncertainty and approval | That a recommendation is implemented, a vulnerability is resolved, or risk is accepted by the proper authority |
| Cybersecurity Plan amendment | Affected plan sections, former and proposed text, assessment and resolution links, amendment authority, submission or approval state, effective date, distribution and supersession history | Coast Guard approval, operational implementation, training completion, inspection closure, or cybersecurity outcome |
Source basis: [1]
Treat ownership change as a regulatory trigger, not a portfolio note
Section 101.650(e)(1) requires a Cybersecurity Assessment for each covered U.S.-flagged vessel, facility, and OCS facility by July 16, 2027 and annually thereafter. It also requires that assessment sooner than annually when ownership changes. That is a specific regulatory trigger attached to a covered operating asset, not a general instruction that every merger, stock purchase, internal reorganization, management change, financing, or brand transition automatically has the same consequence. [1]
Create a trigger record as soon as a transaction may affect a covered vessel or facility. Identify the former and proposed legal owner or operator, controlling instrument, asset identifiers, closing or other effective event, current security-plan and assessment owners, qualified applicability reviewer, assumptions, unresolved conditions, and the date by which an assessment decision must be made. Keep corporate announcement, signing, regulatory clearance, closing, operational control, and internal system migration as separate events unless authoritative evidence establishes they coincide.
Freeze the operating boundary before reassessment
A transaction can change people, contracts, identities, support paths, networks, remote connections, vendors, security services, and decision rights before every technical system changes. Preserve the pre-change operating boundary instead of replacing it with a new parent-company label. The assessment package should identify each covered vessel or facility, critical IT and OT populations, network boundaries, connected services, responsible CySO, current plan and assessment versions, open findings, exceptions, known gaps, and evidence owners as of a declared time.
Then record what the ownership event actually changes. Test identity administration, privileged and third-party access, security monitoring, supplier notification routes, incident escalation, vulnerability intake, backups, plan custody, records access, and contractual support without inferring that a legal close proves any technical transition. Missing inventories, disputed boundaries, unavailable evidence, and services still controlled by a predecessor should remain explicit. They are assessment conditions, not values to be filled with a confident default.
Carry every recommendation through resolution and amendment
The regulation connects several records. The assessment must analyze networks, validate the Cybersecurity Plan, document recommendations and resolutions in the applicable VSA, FSA, or OCS FSA, and incorporate those recommendations and resolutions into the Cybersecurity Plan through an amendment. Preserve that chain item by item: assessment observation, affected boundary, source evidence, recommendation, accountable disposition, compensating control or action, due date, verification evidence, unresolved condition, security-assessment entry, affected plan section, amendment state, approver, effective date, and superseded version. [1]
Do not collapse those states into assessment complete. A finding can remain under review; a recommendation can be accepted, rejected, qualified, or deferred; an action can be planned but not implemented; a plan amendment can be drafted but not yet approved or effective. A technical change may require engineering, operations, safety, maintenance, supplier, legal, regulatory, records, labor, privacy, or other qualified review. The cybersecurity assessment does not itself authorize an unsafe operational action or prove a control worked.
Exercise the transaction handoff without inventing applicability
Use authorized records or a representative non-production scenario to test a direct asset sale, a parent-company stock transaction, an internal reorganization with unchanged operating control, a closing delayed after signing, a vessel or facility omitted from the transaction list, predecessor credentials still active, a security provider whose contract does not transfer, an unresolved known exploited vulnerability, a recommendation affecting several plan sections, and an amendment awaiting an external decision. Inspect whether the workflow preserves the applicability question, former state, effective event, assessment scope, resolution, amendment, implementation evidence, and open uncertainty without backdating or overwriting history.
OT Defense Review reviewed the exact registered eCFR section on October 4, 2026. It supports the stated assessment cadence, ownership-change trigger, network analysis, plan validation, security-assessment resolution, the paragraph's KEV patching-or-documented-compensating-control requirement, and plan-amendment linkage. It does not determine whether a particular entity, instrument, transaction, vessel, facility, system, finding, control, resolution, amendment, or timeline satisfies the rule. Qualified Coast Guard, maritime, legal, regulatory, cybersecurity, engineering, safety, operations, transaction, labor, privacy, records, and other responsible authorities control the actual interpretation and response. [1]
Enterprise buyer test
Translate this change into the exact population, record type, workflow stage, decision owner, effective date, and evidence that could be affected. Ask current or prospective providers to demonstrate the named workflow with representative data and an exception—not a polished feature tour. Record what official documentation establishes, what a provider states, what the team observes, and what remains unresolved.
A defensible review also identifies the dependency outside the product. Authority interpretation, policy configuration, data quality, integrations, human judgment, approval rights, release governance, training, and retained evidence may remain customer or service responsibilities. The evaluation should preserve those boundaries instead of treating a technology claim as the complete operating model.
What we will watch next
OT Defense Review will watch the named source and affected market records for later evidence that changes status, scope, availability, implementation timing, workflow consequence, or the limits of the initial report. A later announcement does not silently overwrite this dated account; the change ledger preserves the sequence.