to manage cybersecurity threat risks to maritime critical infrastructure and promote the lawful exchange of goods and services in the global marketplace. 2 as authorized in the statutes. 4 This method of regula- tion has been used to accommodate the rapid change of technological advancement in vessel communication systems, engineering, and fire protection for many years. To use this authority with respect to cybersecurity, the Coast Guard and MTS stakeholders would have to identify, and agree upon, recognized standards for mea- suring compliance to the statutes. The process would be very similar to the development of the CISA performance goals described above and following the intent of the National Security Memorandum. Given the broad range of operations that fall under MTSA, consideration will also have to be given to how these regulatory updates can be scaled up or down to match the cybersecurity maturity of the regulated entities. The continued collab- orative involvement of maritime stakeholders in shaping these policies and regulations through active partici- pation will be critical to meeting the needs of all MTS stakeholders. Conclusion Those who know their naval history know that the ships received by John Paul Jones to fulfill his request were not exactly what he had in mind when he asked his allies for help, but he obviously succeeded in adapting to what he was given. In cyberspace, the Coast Guard and its MTS stakeholders are still determining what is needed to succeed against the many active adversaries and, in that process, they are recognizing that models for success may not fit previously held ideals. In Jones’ case, the determination to use innovative ideas to defend his homeland against, and take the fight to, adversaries with overwhelming capabilities was crucial to success. It is with that same spirit that the Coast Guard, partner agencies, and MTS stakeholders have entered into the cyberspace battle and will continue to fight to protect one of our the MTS. nation’s most critical infrastructure sectors, About the author: Mr. Nick Parham is the Marine Transportation System (MTS) Cybersecurity Coordinator for the Atlantic Area command. In this role, he is responsible for development and execution of Coast Guard cybersecurity regulations and policies impacting MTS stakeholders operating in an area of responsibility that encompasses all inland and coastal commercial maritime operations east of the Rocky Mountains including Puerto Rico. He would like to acknowledge the faculty and staff of the Cyber & Innovation Policy Institute, U.S. Naval War Col- lege and his cohorts at the 2022 CIPI Summer Workshop on Maritime Cybersecurity, in particular U.S Navy LCDR Tyson Meadors for their contributions to this article. Endnotes: 1. United States Coast Guard Cyber Strategic Outlook, August 2021 2. United States Coast Guard Cyber Strategic Outlook, August 2021. Pg 28 3. Cybersecurity and Infrastructure Security Agency—www.cisa.gov/cpgs 4. www.nist.gov/system/files/revised_circular_a-119_as_of_01-22-2016.pdf In order to meet this goal, the United States must continue to evolve cybersecurity laws and regulations. The speed of evolution in the cybersecurity world fur- ther complicates questions regarding legislative efforts as solutions can quickly become outdated even with the most efficient government action. Recognizing this, the administration signed a National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems on July 28, 2021. The memorandum established a voluntary initiative intended to drive collaboration between the federal government and the critical infra- structure community to improve cybersecurity of con- trol systems. The Department of Homeland Security was instructed to lead this effort. In support, the Cybersecurity and Infrastructure Security Agency (CISA) published its updated Cross- Sector Cybersecurity Performance Goals and Objectives on March 21, 2023, resulting in Version 2.0. The perfor- mance goals were developed in conjunction with part- ners across the interagency and private sector through the Critical Infrastructure Partnership Advisory Council. The voluntary cross-sector common baseline cybersecurity performance goals address information technology and control systems cybersecurity activities. They consist of foundational activities for effective risk management and high-level cybersecurity recommended practices. The goals and objectives are not an exhaustive guide to all facets of an effective cybersecurity program. However, they provide “… clear guidance to owners and operators about cybersecurity practices and postures that the American people can trust and should expect for such essential services …” to protect systems supporting National Critical Functions.3 Regarding regulations, the Coast Guard continues to work with its partners within the Department of Homeland Security and other agencies to identify how best to address cybersecurity requirements, with a focus on MTSA-regulated facilities and vessels. CISA’s cross- sector performance goals will help serve as a framework for these efforts. For those who may be curious as to how the Coast Guard will maintain pace with the rapidly changing dynamics of cybersecurity, it has previously overcome this challenge. The greatest example of this comes through its vessel inspections program, where personnel have been inspecting commercial ships for decades. While some components of ship design and safety never change, there are many aspects that do and are subject to the pace of technological advancements, which are often much faster than regulatory procedures. How has the Coast Guard addressed this in the past? By using the ability to request incorporation by reference 14 Proceedings Summer 2023