33 CFR Part 101 Subpart F · U.S. Coast Guard

Don’t get sunk by cyber security compliance costs

You run boats. We run the Coast Guard cyber rule, start to finish — the assessment, the 14-section Cybersecurity Plan, your Cybersecurity Officer of record, crew training, drills and the annual audit. One fixed price, quoted in writing for your fleet. One portal that remembers every date the rule creates, so your office does not have to.

Book a readiness call See what the rule requires

Thirty minutes, no charge. We tell you which obligations already apply to your fleet today.

app.fairway.systems/readiness

Cumberland Marine Transport

Readiness

Plan in review

Readiness78%

9 of 14 sections approved

Days to Jul 16, 2027318

staged to file Apr 16

Crew trained41 / 47

6 inside the 5-day clock

Section 7 — Incident response plan

Awaiting your signature

Due Fri

Q3 tabletop exercise

Scheduled · M/V Cumberland

Sep 18

Annual all-hands training

6 crew outstanding

Overdue 2d

Plan sections

Every one written, reviewed and carried through review for you

Program areas

Most of them repeat every year you operate

$43,527

Per violation, per day

46 U.S.C. 70119 — the reason the dates matter

Eleven program areas

Everything the rule puts on you

Not a checklist you run once — most of this repeats every year, for as long as you operate. None of it is exotic, every piece of it is doable, and none of it is yours to carry alone.

Cybersecurity Plan

14 sections, approved by the Coast Guard

§101.630

Cybersecurity Officer

Designated, reachable 24/7 — outsourcing allowed

§101.625

Annual assessment

Documented, with a findings register

§101.650(e)

Incident response plan

Written, maintained and exercised

§101.650(g)

Incident reporting

To the National Response Center, without delay

§101.650(g)(1)

All-hands training

Annually, and within 5 days of system access

§101.650(d)

Drills and exercises

Two drills and one exercise every year

§101.635

Independent audit

Annual — and the CySO may not audit himself

§101.630(f)

Account and device security

MFA, inventories, approved hardware and software

§101.650(a)

Network segmentation

IT separated from OT, every connection logged

§101.650(h)

Supply chain governance

Vendor controls and remote-access monitoring

§101.650(f)

The wall

CySO designated, assessment complete, plan submitted for approval — all due July 16, 2027. §101.655

There is still room in that calendar. Started now, this is an ordinary year of work for a fleet — not a scramble, and not something you have to drop everything for.

The date we work to

The rule does not name a finish line before the deadline. We do: plan finished and staged to file by Friday, Apr 16, 2027 — three months early, one full return-and-revise cycle in hand.

The rule reaches the wheelhouse, the office and the dock. So does the work.33 CFR Part 101 Subpart F

Why we exist

Founded in 2026 to do one thing

When the Coast Guard published this rule, working fleets got two kinds of mail: vague warnings from people who had not read it, and quotes with no numbers on them. We read all of it, and turned it into one fixed path you can actually walk.

We are not a security giant with a maritime brochure. We are a small team that does exactly one thing — get towing and terminal operators through 33 CFR Part 101 Subpart F, on time and in writing, with the least disruption to the work you actually do.

How we are built

Founders

Who you will be working with

Founder, Fairway Systems

Aaron Henderson

Fairway Systems, what we do

Aaron founded Fairway in 2026 after a career building software platforms, most recently as a lead platform engineer for G2, a billion dollar software company, and running the design studio HelloSavvy. He read the rule end to end, built the fixed path through it, and put a plan behind every line on this site.

He is the person who answers the readiness call, and the reason every claim here carries its citation: he had to learn this rule from zero, so it is written the way he needed it explained.

Founder and CEO, Virtus Cybersecurity

Bogdan Salamakha

Virtus Cybersecurity, www.virtuscyber.com

Bogdan leads Virtus Cybersecurity, an independent security firm in North Royalton, Ohio, with over two decades in incident response, penetration testing and security architecture for Fortune 500 corporations, government agencies and startups.

He believes the best way to protect an organization is to teach it about the threats it faces, which is why he sits on every technical call and signs off every plan before it carries either firm's name.

Why two firms, and who leads what

What you get

One membership, the whole obligation

Fractional Cybersecurity Officer

A named CySO of record for your fleet, with an alternate and after-hours coverage behind him. You are not hiring a full-time security officer to satisfy one regulation.

Included in membership

Assessment and plan build

We run the assessment, write all fourteen sections, and carry the plan through Coast Guard review to approved.

Build phase, months 1–6

Training, drills and audit

Annual all-hands training, two drills and an exercise, and the independent audit — scheduled, run and filed.

Every year, on the calendar

Delivered with Virtus Cybersecurity, an independent security firm. The annual audit is independent by construction, because the rule requires it.

Compliance membership

Fixed, itemized, in writing

Every fleet prices differently — boat count, barge service, docks, what your people already cover. We quote after a thirty-minute scoping call, line by line, before you sign anything.

Get a fixed quote for your fleet