Maritime USB Compliance Checklist

Implement Maritime USB Cybersecurity Compliance Across Ship and Shore Operations

Connecting unscanned removable media to maritime IT or OT systems can introduce malware that disrupts operations and puts crew and cargo at risk. The maritime industry and regulatory bodies recognize the risk and have created cybersecurity guidance and regulatory frameworks that cargo, cruise, and port operators are expected to follow.

Removable Media in Maritime Workflows

The maritime industry increasingly uses networked connectivity for data transfers. However, many workflows still depend on portable USB devices to transfer data from shoreside to shipside facilities and between ship systems. Each use of removable media introduces the risk of malware infection.

Chart Updates

Bridge personnel use removable media to load electronic navigational chart updates into ECDIS systems.

Vendor Maintenance

Visiting technicians install software or firmware on onboard computers and control systems via removable devices.

OT File Transfers

Engineers use removable media to transfer configurations and retrieve logs or diagnostic data from PLCs, HMIs, and alarm and monitoring systems.

Cargo and Administrative Workflows

Port staff and crew take advantage of portable drives to exchange cargo documents and operational records.

Requirements and Guidance for Maritime USB Controls

Shipping companies and port operators do not have a single set of USB compliance rules to follow. Instead, broader cyber risk management requirements call for operators to protect computer-based systems and document how they control removable media.

For US operators, Coast Guard rules form only part of the compliance picture when vessels trade internationally. Regulations and class requirements define mandatory controls and evidence, while cybersecurity guidance helps operators implement them.

Beyond compliance, USB‑borne malware can disrupt and delay maritime operations. Malware that compromises navigation or propulsion prevents vessels from sailing. Incidents affecting cargo‑handling systems stop loading or discharge. Compromised passenger-ship systems put crew and passengers at risk.

Maritime operators face substantial reputational and financial costs from USB malware risks.

USB Cybersecurity Requirements and Guidance

IMO Resolution MSC.428(98)
Maritime Cyber Risk Management in Safety Management Systems

IMO MSC-FAL.1/Circ.3/Rev.3
Guidelines on Maritime Cyber Risk Management

IACS Unified Requirement E26
Cyber Resilience of Ships

IACS Unified Requirement E27
Cyber Resilience of On-Board Systems and Equipment

BIMCO Guidelines
The Guidelines on Cyber Security Onboard Ships

EMSA Inspection Guidance
Guidance on How to Address Cybersecurity Onboard Ships During Audits, Controls, Verifications and Inspections

USCG Final Rule
Cybersecurity in the Marine Transportation System

Maritime Compliance Checklist

Use this checklist to assess your removable media controls across protection, detection, response, and governance. It supports an internal review of current safeguards to help operators assess their maritime compliance and USB cybersecurity readiness.

Protect: Control Removable Media Before Connection

Protection begins before personnel connect removable media to a computer‑based system. These controls establish where checks are placed and which devices must pass through them.

Control	Why It Matters
Establish a defined checkpoint where personnel inspect removable media before connecting it to a computer-based system.	Connecting unchecked media exposes the destination system to any malware it contains.
Keep the inspection checkpoints separate from the protected IT and OT networks.	Personnel can examine untrusted media without first connecting it to the systems the process is intended to protect.
Apply the same malware-scanning process to company-issued and third-party media.	External technicians and chart service providers can supply media that the operator does not directly manage.
Make the checkpoint available where personnel perform removable media transfers.	A process based on inconveniently located hardware cannot reliably govern media used at the point of work.
Make the checking process clear and quick to complete.	A process that delays operational work or requires specialist support is more likely to be bypassed.

Detect: Identify Threats on Removable Media

When personnel submit removable media at a USB scanning kiosk, the analysis must be broad, accurate, and current enough to support a reliable decision. Detection needs to account for threats in the files and on the device itself.

Control	Why It Matters
Be able to analyze the complete content of the media, not just the files intended for immediate transfer.	Malicious content left unchecked on the device could be copied during a later task and could be activated upon insertion.
Keep malware detection engines and threat definitions current.	Outdated detection provides less protection against recently identified zero‑day or modified threats.
Use static and dynamic analysis that can identify known malware and suspicious code that does not match an existing signature.	Signature matching alone is limited to threat patterns the detection engine already recognizes.
Inspect the device for hardware‑level attacks such as BadUSB, in addition to file‑borne malware.	Firmware-based malware can evade detection that only examines the device’s filesystem.
Clearly indicate to personnel whether they are safe to proceed and the risks presented by the scanned device.	Personnel may not be technically aware and should not have to interpret technical logs and jargon before deciding whether to use the media.

How Secure Are Your Removable Media Controls?

Take the two-minute TYREX assessment to identify gaps in pre-connection scanning, endpoint enforcement, audit records, and protection for isolated systems.

Respond: Prevent Further Use of Unsafe USB Devices

A failed malware scan should trigger a clear risk mitigation response. USB cybersecurity systems should provide a way to eliminate the detected threat or prevent further use of the device.

Control	Why It Matters
Treat failed media as rejected and prevent personnel from trying it on sensitive IT or OT infrastructure.	Detection is of limited efficacy if technical controls cannot prevent further use.
Quarantine or delete detected malware with an easy-to-use workflow.	Personnel should be able to contain the threat without exposing additional systems during remediation.
Provide a controlled way to transfer clean files onto known clean media or an approved file share.	A controlled media break or protocol break allows for secure file transfers, reducing the risk of using known safe devices in sensitive infrastructure.

Govern: Manage and Document USB Cybersecurity

Technical controls require centralized management and visibility to be effective for large organizations with multiple locations, including mobile locations such as ships.

Control	Why It Matters
Record each inspection, including when it occurred, which device was checked, and the result.	The record demonstrates that personnel followed the required process for USB device use.
Retain and export records in a format that supports the SMS inspections and existing security monitoring.	Compliance and security teams need to retrieve evidence without reconstructing it from separate systems.
Establish centralized control for comprehensive visibility across locations.	Security and compliance personnel should be able to manage, control, and gain visibility into USB cybersecurity systems.
Regularly review USB security policies and technical controls for suitability.	Oversight ensures controls are comprehensive, potential weaknesses are addressed, and implemented systems don’t drift from expected compliance standards.

How TYREX Decontaminates Removable Media Onboard and Ashore

TYREX Decontamination Stations give maritime operators a controlled process for inspecting removable media. Deployment options support onboard and port environments, including network-isolated systems, while centralized management helps compliance and IT teams implement and demonstrate effective cybersecurity controls.

USB Decontamination at the Point of Use

TYREX provides multiple USB scanning kiosk options suitable for a range of maritime environments, including TYREX Satellite and TYREX Console for space‑constrained environments , and TYREX Mobile for portable USB scanning.

Multi-Layered USB Malware Detection

TYREX Decontamination Stations analyze files with up to five antivirus engines, plus AI static and optional dynamic analysis. Our stations also detect BadUSB and zero‑day threats for comprehensive USB threat detection and remediation.

Secure USB Workflows for Offline Environments

Local analysis and offline operation allow crews to inspect media when network connectivity is unavailable or critical OT networks are air‑gapped.

Transfer Files to Controlled Storage

TYREX Decontamination Stations provide a media break, so crew and vendors can transfer files to secure network storage or media controlled by your organization.

Endpoint Enforcement for Scanned USB Devices

The optional Workstation Protect Agent and Hardware Agent block uncertified devices from connecting to sensitive endpoints, preventing personnel from bypassing the decontamination process.

Centralized Management and Updates

TYREX Management Server centralizes management, monitoring, and updates across deployed stations, with PDF and CSV reporting and a Syslog API for integration with your SIEM systems.

Deploy Compliant Maritime USB Controls with TYREX

Discuss your vessels, removable-media workflows, and compliance priorities with a TYREX expert. We’ll help you identify suitable inspection points and a deployment approach that works across your operations.