The Conventional Wisdom
The Coast Guard's creation of the Office of Maritime Cybersecurity Policy seems like progress: a central authority with clear responsibility lines, coordinating policy, enforcement, and industry liaison. The maritime sector is promised unified governance.
Governance, Risk, and Compliance (GRC) professionals see this pattern often. When cyber risk becomes visible, organizations create a center of excellence, appoint a leader, or establish a central policy office. On paper, it addresses the Government Accountability Office's February 2025 findings about the Coast Guard's fragmented approach to securing the Marine Transportation System.
Why Centralization Falls Short
Centralized governance tackles the wrong problem first.
The Coast Guard's issue wasn't the absence of a single office for maritime cybersecurity policy. It was the existing structure's failure to execute basic tasks. The GAO report didn't call for reorganization; it highlighted operational failures: inaccurate incident data, inaccessible deficiency records, misaligned cyber plans with national strategy, undefined competency requirements for personnel, and unaddressed skill gaps.
You don't solve these by redrawing an org chart. You fix them by changing how work gets done at roughly 360 commercial sea and river ports.
Centralization creates a policy production engine without necessarily improving execution. The Office of Maritime Cybersecurity Policy will develop domestic policy, contribute to international standards, and direct compliance strategy. But who ensures inspectors know what to look for? Who verifies that vessel operators understand the requirements? Who closes the competency gaps the GAO identified?
Centralized governance works when you have strong field execution and need coordination. It fails when field execution is weak and you need capability building.
The Evidence
Consider what the GAO documented. The Coast Guard's system of record didn't provide access to complete cybersecurity deficiency information from inspections. That's a data management issue, not a policy one. It requires fixing intake processes, training inspectors on documentation standards, and building usable query tools.
The agency's cyber strategy didn't address risk assessment, performance measures, required resources, or clear roles and responsibilities. These are planning failures needing working groups, expertise, and cross-functional collaboration.
The Coast Guard couldn't ensure personnel had the competencies needed for MTS cybersecurity work. This isn't solved by a central office. It's solved with job task analysis, training curriculum development, and certification programs.
Look at NIST SP 800-37's Risk Management Framework. It doesn't start with governance structure. It starts with categorization, control selection, implementation, assessment, authorization, and continuous monitoring. The work happens in that sequence whether you have one office or ten.
The Federal Information Security Modernization Act requires agencies to implement information security programs but doesn't mandate organizational structure. It mandates outcomes: risk-based policies, security awareness training, incident response capability, and continuous monitoring. The Coast Guard could achieve those outcomes through distributed execution with strong coordination or centralized policy with weak field capability. The structure matters less than the execution.
What to Do Instead
If you're building cyber governance for critical infrastructure, start with capability, not structure.
First, map what needs to happen. For the Coast Guard, inspectors must identify cyber deficiencies during facility reviews, record them accurately, track remediation, and escalate incidents that meet reporting thresholds. Design your governance to support that work.
Second, build competency before policy. Address competency gaps with role-based training tied to specific inspection tasks. Define those competencies, measure them, and close the gaps. Then write policy assuming those competencies exist.
Third, fix your data before centralizing decision-making. If your system of record can't surface cybersecurity deficiencies found during inspections, your central office will make decisions based on incomplete information. Invest in data quality, accessibility, and integration.
Fourth, align strategy before consolidating execution. Use NIST SP 800-39's guidance on managing information security risk: establish risk context, identify threats and vulnerabilities, assess risk, respond to risk, and monitor continuously. Get that foundation right across existing boundaries. Then decide if centralization adds value.
Finally, test execution at a small scale. Pick three ports. Implement improved inspection processes, documentation standards, and competency requirements. Measure whether you're capturing better deficiency data, closing gaps faster, and aligning with national strategy. If it works at three ports, scale it to thirty. If it doesn't work, you've learned something without reorganizing the entire agency.
When Centralization Works
Centralized governance solves real problems, just not the ones the Coast Guard faces today.
It works when you have mature field capability and need coordination across autonomous units. If inspectors were already documenting deficiencies accurately, if systems already surfaced complete data, and if personnel already had required competencies, then a central office could harmonize approaches, eliminate redundant policy development, and streamline industry engagement.
It works when you need a single voice for external stakeholders. The maritime industry benefits from one Coast Guard office handling policy questions, international standards work, and interagency coordination. That's valuable, and the Office of Maritime Cybersecurity Policy should deliver it.
It works when you're scaling proven practices. Once the Coast Guard demonstrates effective cybersecurity inspection and enforcement at scale, a central office can codify what works, train others, and drive continuous improvement.
But you can't centralize your way out of execution problems. You have to build capability first, then decide how to organize it. The Coast Guard's new office will succeed if it focuses on enabling field execution, not just producing policy. If it treats centralization as a coordination tool rather than a solution, it might actually address what the GAO documented.
For GRC professionals watching this unfold: governance structure follows operational capability. Build the capability first.
