Maritime Cybersecurity Act
- Sponsor
- Sen. Scott, Rick [R-FL]
- Committees
- Commerce, Science, and Transportation Committee (primary)
- Last action
- May 19, 2026
Bottom line
The bill establishes a robust framework for identifying and mitigating cybersecurity risks from foreign-made technology in critical U.S. maritime infrastructure, imposing new assessment, reporting, and compliance burdens on both government agencies and private facility operators.
What it actually does
This bill amends title 46, United States Code, to significantly enhance cybersecurity oversight in maritime facilities. It mandates that the Secretary of the department in which the Coast Guard operates (currently DHS) conduct annual cybersecurity risk assessments of specific software and hardware used in covered maritime facilities. It also requires facility owners to report on foreign-made technology, certify compliance with NIST standards, and prohibits the use of non-compliant systems without a waiver.
Proponents argue
Proponents argue that the bill is a critical step to safeguard national security and protect vital supply chains from increasing cyber threats, particularly those originating from foreign adversaries. They contend that securing maritime facilities, including port cranes and operational software, is essential to prevent disruptions to commerce and military logistics, and that the current regulatory framework is insufficient to address these evolving risks. The bill's provisions for bypassing contractual barriers to assessment are seen as necessary to ensure comprehensive security.
Opponents contend
Opponents might argue that the bill imposes significant and potentially costly compliance burdens on maritime facility owners and operators, which could lead to increased operational expenses and supply chain disruptions. Concerns could also be raised about the broad authority granted to the Secretary to conduct assessments without consent or regard for existing contracts, potentially infringing on private sector autonomy and intellectual property rights. The complexity of identifying 'foreign entities of concern' and achieving NIST certification for all covered software and hardware could also be cited as impractical challenges.
The bill is concise and can be read quickly, allowing for a timely evaluation of its core provisions.
Section 2(1)(A) and (B), amending 46 U.S.C. 70102(b)(1)(C) and (b)(3)
Enhanced Cybersecurity Risk Assessment Mandate
This provision expands the existing requirement for the Secretary (Coast Guard) to conduct vulnerability assessments of maritime facilities. It specifically mandates the inclusion of cybersecurity risks related to 'covered software or hardware' in 'covered facilities' within these assessments. Furthermore, it requires these specific cybersecurity vulnerability assessments to be updated annually, rather than allowing for less frequent updates that might apply to other security aspects.
Supporters argue
Supporters argue that this provision ensures a proactive and up-to-date approach to identifying and mitigating cyber threats to critical maritime infrastructure, which is essential given the rapidly evolving nature of cyber risks. Annual updates are crucial for maintaining an effective security posture.
Critics contend
Critics may contend that annual, specific cybersecurity assessments could be resource-intensive for the Coast Guard and potentially disruptive for facility operations, especially if not carefully coordinated. They might also argue that existing assessment cycles are sufficient or that a more risk-based approach to frequency would be more efficient.
Tradeoffs
This provision balances the need for continuous vigilance against cyber threats with the administrative and operational burdens associated with frequent, detailed assessments.
Section 2(2), adding 46 U.S.C. 70102(d)(1)
Secretary's Annual Cybersecurity Assessment Authority with Reduced Barriers
This section establishes a new requirement for the Secretary, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), to conduct annual assessments of cybersecurity risks associated with 'covered software or hardware.' Crucially, it explicitly states that these assessments can be conducted regardless of any end-user licensing agreements (EULAs) or other contracts that might otherwise hinder them, and without needing the consent of the facility owner/operator or any other person, overriding other provisions of law.
Section 2(2), adding 46 U.S.C. 70102(d)(2)
Maritime Facility Reporting and NIST Compliance Mandate
This provision requires owners/operators of covered facilities to submit annual reports to the Secretary. These reports must identify any 'covered software or hardware' used (or planned for use) that was manufactured by or in a 'foreign entity of concern' or 'foreign country of concern.' The reports must also detail any cybersecurity risks or incidents. Crucially, facility owners must certify that all covered software/hardware has been assessed for consistency with NIST or equivalent standards within the past year and that any inconsistencies have been mitigated. Facilities are prohibited from using non-compliant software/hardware without a waiver from the Secretary, which can only be granted if there's low national security risk outweighed by commercial benefit.
Section 2(2), adding 46 U.S.C. 70102(d)(3)
Annual Congressional Reporting on Maritime Cybersecurity
This provision mandates that the Secretary, in coordination with CISA, submit an annual report to specific Congressional committees. This report must detail the findings from the government's cybersecurity assessments, summarize the findings from the facility owners' reports, outline actions taken to mitigate risks, and provide recommendations to Congress for further strengthening maritime transportation and port security against cybersecurity threats.
Section 2(2), adding 46 U.S.C. 70102(e)
Key Definitions for Maritime Cybersecurity Scope
This section defines critical terms that determine the scope and application of the entire bill. 'Covered facility' refers to facilities regulated under specific parts of 33 CFR (parts 105 or 106). 'Covered software or hardware' is broadly defined as any internet-connected software/hardware used at a covered facility, specifically including cranes from foreign entities of concern, business systems whose compromise could cause a security incident, systems with delegated ownership/control, or other high-risk maritime infrastructure. It also defines 'cybersecurity vulnerability' and incorporates definitions for 'foreign country of concern' and 'foreign entity of concern' by reference to 42 U.S.C. 19221(a).
This provision explicitly grants the Secretary the authority to conduct cybersecurity assessments of covered software or hardware 'notwithstanding any provision of an end user licensing agreement or other contract that would otherwise hinder such assessment' and 'without obtaining the consent of any owner or operator of a covered facility, or any other person, notwithstanding any other provision of law.'
Section 2(2), adding 46 U.S.C. 70102(d)(1)(B)
Why it matters:While legally precise, this phrasing might be considered standard legislative practice for granting broad executive authority in specific contexts. However, its placement could also make it less immediately apparent to a casual reader how far-reaching this power is.
Case for: Supporters argue that this clause is absolutely essential for effective cybersecurity. Without it, proprietary software agreements or a lack of cooperation from facility owners could create insurmountable barriers to identifying critical vulnerabilities, leaving national security at risk. It ensures the government can act decisively to protect critical infrastructure.
Case against: Critics might argue that this provision represents a significant governmental overreach into private property and contractual rights. They could contend that it undermines the principles of consent and intellectual property, potentially creating a chilling effect on innovation or raising concerns about how such assessments would be conducted and what data might be accessed or retained.
Estimated impact: This provision grants the U.S. government unprecedented access to private sector systems within covered maritime facilities for cybersecurity assessment purposes, potentially impacting all software and hardware vendors and facility operators.
The definition of 'covered software or hardware' explicitly includes software or hardware used in 'the marine transportation system, including in a crane manufactured by a foreign entity of concern or a foreign country of concern; by a company controlled or operated by a foreign entity of concern or a foreign country of concern; or in a foreign country of concern.'
Section 2(2), adding 46 U.S.C. 70102(e)(2)(C)(i)
Why it matters:While definitions are a standard place for scope, the explicit mention of cranes and foreign entities of concern within this definition might be intended to provide specific legal clarity without drawing immediate, prominent attention to a potentially controversial aspect of the bill.
Case for: Proponents would argue that this explicit inclusion directly addresses a known and significant national security vulnerability. Many port cranes are manufactured by companies linked to foreign adversaries, and their operational software and hardware could pose substantial cyber espionage or sabotage risks to U.S. ports, making this specificity crucial.
Case against: Critics might argue that singling out specific equipment types or origins within a definition could be seen as discriminatory or protectionist. They might also contend that the broad definition of 'foreign entity of concern' could lead to unintended consequences for global supply chains and trade relations, particularly if it impacts widely used equipment.
Estimated impact: This provision directly targets a specific class of critical infrastructure equipment (port cranes) and their origin, potentially leading to significant scrutiny, replacement, or restricted use of such equipment if linked to foreign entities of concern.
This provision defines 'foreign country of concern' and 'foreign entity of concern' by referencing their meanings in section 10612(a) of the Research and Development, Competition, and Innovation Act (42 U.S.C. 19221(a)).
Section 2(2), adding 46 U.S.C. 70102(e)(4)
Why it matters:Referencing existing statutory definitions is standard legislative practice to ensure consistency across federal law and avoid redundancy. However, it effectively 'buries' the specific criteria for these designations from a casual reader of this bill.
Case for: Proponents argue that using established definitions ensures legal consistency and leverages existing frameworks for identifying national security risks. It avoids creating new, potentially conflicting definitions and streamlines the legislative process.
Case against: Critics might argue that relying on an external definition makes the bill less transparent and harder for the public and regulated entities to understand without extensive legal research. Changes to the referenced statute could also alter the scope of this bill without direct amendment, creating uncertainty.
Estimated impact: The specific entities and countries designated as 'foreign entities/countries of concern' under 42 U.S.C. 19221(a) will directly determine which software, hardware, and manufacturers are subject to the most stringent requirements of this bill, having a broad impact on maritime supply chains.