The Port of Vancouver USA has issued Tariff No. 6 effective July 1, 2026, which now includes a formal requirement for business partners to disclose cybersecurity incidents or data breaches that may impact port systems, facilities, or operations. Partners such as terminal operators, tenants, vessel owners/operators, vendors, consultants, contractors, and their subcontractors must notify the Port’s Director of Information Technology within 10 days of determining an incident or breach, with non-compliance subject to penalties of 1000 per day up to 50000 and potential reimbursement of damage costs. This move signals that the Port is tightening its cybersecurity risk management expectations across its vendor and tenant ecosystem.For technology, security, and compliance vendors, this creates a clear commercial angle: port stakeholders now face financial and contractual exposure if they lack timely incident detection, response, and reporting capabilities. A useful discussion would focus on helping these partners meet the new disclosure timelines, strengthen monitoring and incident response processes, and integrate reporting workflows that align with the Port’s requirements and communication channels.

Penalties for non-disclosure can reach up to 50000 plus recovery of any damages; incidents include denial of service, ransomware, compromised accounts, and unauthorized access affecting Port risk.