No Devices Adrift: MTSA’s Device Security Requirement
Summary: This sixth post in Dragos's MTSA cybersecurity series covers the device security requirements under 33 CFR 101.650(b), which oblige each vessel owner or operator, or designated CySO, to document four things in Section 6 of the Cybersecurity Plan: an approved hardware, firmware, and software list, executable code disabled by default on critical IT and OT systems, an accurate inventory of network-connected systems with critical IT and OT called out, and a network map with OT device configuration documentation. Dragos cites Marsh McLennan and Dragos putting annual global OT cyber risk at $31.1 billion in 2025, and reports finding unlisted assets on the OT boundary in roughly 40% of engagements at regulated organizations and about 80% at organizations with no regulatory requirement to look.
Why it matters: Dragos found unlisted assets on the OT boundary in roughly 40% of engagements at regulated organizations and about 80% where no rule requires looking, and the Coast Guard is about to start checking against a requirement most networks would fail today.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026