Maritime Cybersecurity Act

Increased Security Oversight: The Secretary, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, will conduct assessments to identify weaknesses in security and cybersecurity risks of covered software or hardware (Section 2, subsection (d)(1)(A)).

Reduced Barriers to Information: The Secretary is permitted to conduct assessments regardless of end user licensing agreements or contracts, and without needing consent from owners or operators, which may facilitate more thorough security checks (Section s2, subsection (d)(1)(B)).

Enhanced Transparency to Congress: The Secretary must provide annual reports to specific Congressional committees regarding assessment findings, actions taken to mitigate risks, and recommendations for strengthening security (Section 2, subsection (d)(3)).

Information Sharing for Security: The Secretary can coordinate with Federal entities to share compiled information for the purposes of maritime transportation security and risk mitigation (Section 2, subsection (d)(5)).

Increased Reporting Burdens for Operators: Owners or operators of covered facilities are required to submit annual reports that identify specific software or hardware used, including items manufactured by foreign entities or countries of concern, and any cybersecurity risks (Section 2, subsection (d)(2)(A)).

Restrictions on Equipment Usage: An owner or operator of a covered facility may be prohibited from using certain covered software or hardware if they cannot certify that it meets National Institute of Standards and Technology standards or equivalent standards (Section 2, subsection (d)(2)(B)(i)).

Loss of Privacy/Control over Assessments: The Secretary is authorized to conduct assessments of a facility's security and cybersecurity risks without obtaining the consent of the owner or operator (Section 2, subsection (d)(1)(B)(ii)).