One question about the rule, answered, at a time
Written for owners, port captains and compliance managers. Every piece cites the section it comes from, and none of it asks you to talk to us first.
- Applicability§101.620
Does the rule apply to barges we own but do not operate?
Split ownership is normal in barging — a company holds title while another company crews and moves the equipment. Here is how the cyber rule's owner-or-operator language works in that arrangement, the one question that sorts your situation, and why the final allocation belongs with your maritime counsel.
Read it — 5 min - Threats§101.650(g)
What really happened when ransomware hit maritime companies
Three verified cases — a locked-up MTSA facility, a 158-year-old haulage group that did not survive, and a carrier that did — with years, causes and outcomes. No dramatization; the documented facts, and the one variable that separated the company that died from the company that recovered.
Read it — 5 min - Threats§101.650(d)
The cyber attack that actually kills towing companies is an invoice
Nobody is going to steer your towboat from a laptop. The documented, monetized attack on companies your size is a fake vendor invoice and a wire that leaves before anyone calls back. Here are the verified numbers, why a towing office fits the victim profile exactly, and what the rule's training duty has to do with it.
Read it — 5 min - Plan review§101.630(d)
What happens after we file? The four outcomes of Coast Guard plan review
Your Cybersecurity Plan comes back one of four ways: approved, returned for revision, disapproved, or held under a written acknowledgment that lets you keep operating while review continues. Here is each outcome in plain language, and why the queue makes your filing date matter as much as your filing.
Read it — 5 min - Waivers§101.665
Is my company actually a waiver candidate?
Some fleets genuinely qualify for relief under the rule, and more owners believe they do than actually do. Here is the honest screen: what a strong candidate looks like, the phone-and-email trap that catches most of the rest, and what survives even a granted waiver.
Read it — 5 min - Audits§101.630(f)
Who is allowed to audit our cybersecurity program?
Not the person who runs it. The rule requires an annual audit of the Cybersecurity Plan by someone independent of the measures being audited — which rules out your CySO, usually your IT vendor, and any firm offering to be both. Here is the independence chain, and what it means for the cost of designating internally.
Read it — 5 min - The CySO§101.625
Can our port captain be the Cybersecurity Officer? The four paths, compared honestly
Yes — the rule was written to allow it. Whether it is the right call depends on which of four designation paths fits your company. Here is the decision table we use, what each path costs that its advocates leave out, and the checklist for the designation letter itself.
Read it — 5 min - The CySO§101.625
The twelve things a Cybersecurity Officer must know — and why your port captain is closer than you think
The rule requires the CySO to have general knowledge in twelve areas, gained through training, education or equivalent job experience. No certificate, no degree, no IT background. Here is the study grid — and the honest arithmetic on how much of it a working port captain already has.
Read it — 5 min - The CySO§101.625
The fifteen duties of a Cybersecurity Officer, in plain English
The rule hands the CySO fifteen enumerated duties, and almost every one begins with the word ensure. Here is the whole list translated for a towing company — what each duty looks like on a working fleet, which three cannot wait for business hours, and what the list tells you about who to name.
Read it — 5 min - Fractional CySO§101.625
What does a fractional Cybersecurity Officer actually do?
The Coast Guard wrote the outsourced CySO into the rule on purpose. Here is the job in plain language — the fifteen duties, the calendar they generate, what stays with you no matter who holds the title, and the questions to put to any firm that offers to be your CySO of record.
Read it — 5 min - Planning§101.655
When should your Cybersecurity Plan actually be finished?
Not July 2027. The rule's deadline is Jul 16, 2027, but a plan finished on the deadline has no room for a returned document, a review queue, or a slipped week. We work to Friday, Apr 16, 2027 — and this is the arithmetic behind that date.
Read it — 5 min - Cost§101.655
What will compliance actually cost a 10-boat operator?
The Coast Guard published its own estimate of what the cyber rule costs an operator to do in-house, in hours and in dollars. Here are those figures, what recurs every year, what you can skip for now, and what we charge beside them.
Read it — 5 min - Operational technology§101.650(h)
What does "OT" mean on a towboat, and what does the rule want us to do about it?
Operational technology is the computers that steer, monitor and measure. On a towboat that is the chart PCs, the engine gateway, the tank gauging at the fleet — and the router they all share. Here is what counts, and what §101.650 asks you to do about each piece.
Read it — 6 min - Assessment§101.650(e)
What is a Cybersecurity Assessment, and who is allowed to perform it?
The assessment is the document everything else in the rule stands on — the plan, the criticality calls, any waiver. Here is what §101.650(e) requires, the Coast Guard's three-stage method in plain language, and who the rule does and does not let perform it.
Read it — 6 min - Drills and exercises§101.635
What do cyber drills and exercises actually look like on a towboat?
Two drills and one exercise every year, forever, with corrective actions written down. Here is the cadence §101.635 sets, the scenarios that actually fit a river operation, who has to be in the room, and the record that has to exist afterward.
Read it — 6 min - The CySO§101.625
Who can be our Cybersecurity Officer, and can the port captain do it?
The rule lets almost anyone qualified hold the role, lets one person cover a whole fleet, and lets you hire it out. Here is what §101.625 actually asks of the CySO, the 24/7 duty that decides who can realistically do it, and why the same person cannot audit the program.
Read it — 6 min - Waivers§101.665
Can we get a waiver or an equivalence instead of the full program?
The rule contains real relief for operators whose boats genuinely have little to protect, with real rules attached. Here is what a waiver and an equivalency each are, what a request that stands a chance contains, and what the Coast Guard is and is not accepting right now.
Read it — 5 min - Records§101.640
What records will an inspector ask to see?
Cyber compliance is checked by your regular Coast Guard inspectors at your regular inspections, and what they check is paper. Here is the records section of the rule, the two-year retention, what the training-verification job aid looks for, and the cross-checks a careful inspector runs.
Read it — 5 min - Field note§101.650(e)
The real threats in maritime cyber, ranked by what has actually happened
Not the hijacked towboat. The receipts — Coast Guard assessment findings, named maritime incidents, and the one company that died — sorted by how often each vector actually lands on an operator like you.
Read it — 7 min - Guide§101.605
From NVIC 01-20 to the final rule: what changed when guidance became law
Many terminals built their cyber posture on the Coast Guard's 2020 guidance circular. The 2025 final rule replaced that era with binding requirements, new deadlines and a standalone plan — here is what carries over and what does not.
Read it — 3 min - Incident reporting§101.650(g)(1)
What counts as a reportable cyber incident, and who do we call?
The reporting duty has been in force since July 2025, the definition is broader than most operators expect, and the call goes to one number. Here is the definition, the four questions that apply it, what the National Response Center will ask, and the record you keep afterward.
Read it — 5 min - Deadlines§101.655
Which deadlines have already passed, and which is left?
Two of the cyber rule's obligations are already in force and one of its deadlines has already passed. Here is every date the rule has created so far, what each one required, and the single date that remains.
Read it — 5 min - Applicability§101.605
Does the Coast Guard cyber rule apply to my towboats?
The rule reaches you through the security plans you already hold, not through how many computers you own. Here is the applicability gate in §101.605, the tank-barge line that decides most towing companies, and the three questions to answer honestly before you spend a dollar.
Read it — 6 min - Deep dive§101.630
What goes in a Coast Guard Cybersecurity Plan: the fourteen sections, explained
The rule names fourteen sections, in order, and tells you which measures must be documented in each. Here is the whole document, section by section, with the clocks that run after approval — written for the operator who has to sign it.
Read it — 13 min - Reference§101.615
A glossary for the Coast Guard cyber rule: the rule's words, the cyber words, and the documents behind them
Every term an owner, port captain or compliance manager will meet on the way to July 16, 2027 — defined plainly, with the section of 33 CFR Part 101 Subpart F it comes from where the rule defines it itself.
Read it — 10 min - Guide§101.625
The associations, credentials and committees that matter for the Coast Guard cyber rule — and the ones that don't
A towing company or terminal facing 33 CFR Part 101 Subpart F is surrounded by acronyms. Here is what each organization actually does for you under the rule, which credentials mean something when you hire help, and which rooms are worth your time.
Read it — 8 min