Know the Ropes: MTSA's Cybersecurity Training Requirement
Summary: The Maritime Transportation Security Act's cybersecurity training rule requires baseline training for all personnel with IT or OT access, including contractors whether part-time, full-time, temporary, or permanent, plus two additional topics for key personnel with access to IT or remotely accessible OT. Topics (ii) through (v), covering recognition and detection, circumvention techniques, reporting procedures, and OT-specific training, were due by January 12, 2026 and annually thereafter, while the Cybersecurity Plan awareness topic is due within 60 days of the Plan's approval and new hires get 5 days from system access, no later than 30 days from hire date.
Why it matters: In a tabletop exercise cited in the post, a senior operator, a maintenance supervisor, and an IT person each gave a reasonable-sounding response to ransomware on an HMI, and none recognized it as ransomware - every response was the fastest way to destroy forensic evidence and let encryption spread to the next HMI. The January 12, 2026 deadline for the recognition, detection, and OT-specific topics has already passed, and the regulation's scope follows system access rather than the org chart, catching contractors and vendor technicians that most training programs never touch.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026