Ship-to-shore cranes, gate systems, terminal operating systems, and the Layer-1 question Executive Order 14116 made central.

What's regulated and who's asking

• USCG cybersecurity rulemaking (2024 NPRM, FSP-related). Cybersecurity assessment, plan, response, and reporting requirements for MTSA-regulated facilities. Device inventory is the foundation of the assessment.
• 33 CFR 105 / 106 (Facility Security Plan, OCS Facility Security Plan). The existing MTSA framework now includes cyber posture as a recurring element.
• EO 14116. Directed cybersecurity action across the maritime sector; the USCG rulemaking follows.
• FY2024 NDAA Section 7510 (and related provisions). Ship-to-shore cranes manufactured by China-headquartered companies — particularly ZPMC — are flagged for assessment and risk action. The provision drives an inventory question: which cranes, and what's on the crane control network.
• USCG NVIC 01-20 (Guidelines for Addressing Cyber Risks at MTSA Regulated Facilities). Industry-facing guidance that anticipates the formal rule.
• Port Security Grant Program (PSGP, FEMA). Cyber investments increasingly eligible; reporting requires documented baseline and post-investment delta.
• USCG Captain of the Port (COTP). Local-jurisdiction authority that increasingly includes cyber posture as part of facility inspection scope.
• Cyber-insurance carriers covering port operations. Application questions on OT segmentation, vendor-supplied equipment, and unauthorized-device monitoring.

Why the inventory question is hard for a port

• Ship-to-shore cranes are network-attached, vendor-supplied operational systems. The crane control network was historically considered the OEM's domain; the port may not have full inventory of what's inside.
• Gate and terminal operating systems span multiple vendors. Gate cameras (OCR for container IDs), gate kiosks, RFID readers, weigh-in-motion sensors, and the terminal operating system that ties them together — each from different vendors, often with overlapping network presence.
• Tenant operators run their own networks. A port authority's network and a marine terminal operator's network often interconnect at points the port authority does not directly control.
• Vessel interfaces. Vessels physically docking at the facility may connect to port networks for various purposes; the inventory of those touchpoints is rarely maintained.
• BAS on terminal estate. Warehouses, refrigerated container yards, administration buildings, and customs facilities each have building systems on networks the port IT team owns.

How CybrIQ identifies devices on a port network

• Switch-side, read-only signals. Identification from managed switches via SNMP with read-only credentials. No active scanning of crane control systems. No agents on terminal operating system servers. No traffic capture.
• Maritime-OT reference library. The Device DNA library identifies common crane control PLC families, gate camera and OCR system vendors, RFID reader classes, weigh-in-motion sensors, and TOS server families.
• Relabel-resistant identification for covered hardware. The Section 889 detection approach applies directly here. A camera shipped with one label but matching the Layer-1 fingerprint of a covered-entity vendor is identified by what it is, not by what its sticker says. See the Section 889 page for the methodology.
• Vendor-equipment-segment visibility. The networks the OEM may have considered its own are now inventoried by the port — every device on them, named.
• Tenant-boundary visibility. Where the port authority's managed-switch infrastructure reaches into tenant-operator interconnects, CybrIQ identifies what's at the boundary.

Reporting alignment

• FSP cybersecurity assessment (under USCG rulemaking). Per-segment inventory aligned with the facility's assessed scope.
• NDAA §7510-aligned crane-equipment evidence. The crane control network device inventory, with relabel-resistant identification against the covered-entity reference library.
• PSGP investment reporting. Baseline and post-investment device-visibility numbers for grant audit.
• USCG Area Maritime Security Committee (AMSC) reporting. Posture evidence for the regional coordination cycle.
• Cyber-insurance renewal evidence. Carrier questions answered with signed, current inventory exports.

Volt Typhoon and the port context

CISA AA24-038A explicitly named US port infrastructure as targeted for pre-position. The defensive question is concrete: which edge devices are on the port's networks today, and would a new one be visible inside the polling interval. CybrIQ's 30-second default cadence and unauthorized-device identification produce an answer to both. The deployment posture — customer-installed, no vendor cloud, no traffic capture — is the shape that fits a port authority's security plan and the USCG's emerging rulemaking simultaneously.