The fifth edition of the U.S. Coast Guard’s CTIME report on maritime cybersecurity: expected findings, a few new elements, and the gaps with the European regulatory framework. Let’s unpack it together.
The US Coast Guard has issued two guidance documents for its maritime cyber rule: how to scope the required cybersecurity assessment, and how to request waivers and equivalencies.
The U.S. Maritime Administration has issued a refreshed advisory on cyber and physical risks posed by Chinese-linked port equipment and software, superseding advisory 2025-013 and valid through October 21, 2026.
This article is also available in French.
The latest NORMA Cyber annual report has the merit of placing maritime cybersecurity back where it now truly operates: in a space saturated with geopolitical tensions, logistical interdependencies, and blurred boundaries between cyber, physical, and informational domains. Its main outlook for 2026 (for those who still believe in cyber crystal balls) is that the structuring risk is not so much the “big” destructive attack as the accumulation of intelligence operations, opportunistic disruptions, and hybrid effects on already strained logistical and operational chains. In that sense, it is a less alarmist report than it may appear at first glance, and that is probably its main strength.
On March 18, 2026, the US Coast Guard published a cyber bulletin titled MCB 01-26: Awareness for Increased Phishing (available at the end of this article). This short document aims to shed light on the evolution of cyber threats in the maritime sector, and more specifically on the growing role of phishing attacks in incidents affecting the Marine Transportation System (MTS). It is not specified - although it naturally comes to mind - whether the release of this bulletin is directly linked to the current conflict in the Persian Gulf and the risk of phishing attacks originating from Iran.
The collective volume Marine Technology, Ocean Development and the Law of the Sea (2026), available as open access, devotes significant attention to digital issues, with numerous occurrences of the term “cyber” and several chapters more broadly dedicated to the security of maritime systems.
The chapter on maritime cybersecurity provides a detailed description of the threats affecting GNSS systems. It recalls that associated attacks (spoofing, jamming) can lead to a loss of reliable positioning and to navigation errors, directly impacting maritime safety. It also emphasizes that users must “plan” (or at least anticipate!) “potential GPS disruptions, authenticate the reliability of received data and consider alternative positioning sources” (cyber chapter, pp. 278 - 280).