Cybersecurity in the Marine Transportation System

(3) Routine system maintenance. Each owner or operator or a designated CySO of a vessel, facility, or OCS facility must ensure the following measures for routine system maintenance are in place and documented in Section 6 of the Cybersecurity Plan: 

(i) Ensure patching or implementation of documented compensating controls for all KEVs in critical IT or OT systems, without delay; 

(ii) Maintain a method to receive and act on publicly submitted vulnerabilities; 

(iii) Maintain a method to share threat and vulnerability information with external stakeholders; 

(iv) Ensure there are no exploitable channels directly exposed to internet-accessible systems; 

(v) Ensure no OT is connected to the publicly accessible internet unless explicitly required for operation, and verify that, for any remotely accessible OT system, there is a documented justification; and 

(vi) Conduct vulnerability scans as specified in the Cybersecurity Plan.