Can we get a waiver or an equivalence instead of the full program?
The rule contains real relief for operators whose boats genuinely have little to protect, with real rules attached. Here is what a waiver and an equivalency each are, what a request that stands a chance contains, and what the Coast Guard is and is not accepting right now.
Yes, sometimes. The Coast Guard's cyber rule was written with an escape valve, and for a real slice of the inland fleet that valve is legitimate compliance rather than a dodge. But it is relief from specific requirements, granted on technical facts, after an assessment proves them. It is not an exemption from the rule. This piece explains the difference, what a request that stands a chance actually contains, and where the Coast Guard's door currently is.
One note before anything else: nothing here is legal advice. The language of a waiver filing is the kind of thing that should pass under a maritime attorney's eye before it goes to the Coast Guard.
Two kinds of relief
§101.665 provides for both:
- A waiver is a finding that a specific requirement is unnecessary given the nature of your operation. The plain example is a technical measure aimed at operational technology, requested by an operator with no OT and no remotely accessible systems.
- An equivalency is permission to meet a requirement with a different measure that achieves the same protection. You are not asking to skip the obligation; you are asking to satisfy it another way.
Most inland requests will be waivers of technical measures, sometimes with an equivalency where a control exists in a form the rule did not anticipate.
The five ground rules
The Coast Guard's work instruction on the subject, MCP-WI-002, and its public statements since set out how requests are judged. Five rules govern everything:
1. The assessment comes first, always. A request without a completed Cybersecurity Assessment attached is returned. The Coast Guard has said this applies even where the assessment finds there is no IT or OT to assess. The assessment is how you prove the claim the waiver rests on; §101.650(e) does not bend for a small operator.
2. Relief is per requirement, never blanket. "Exempt us from Subpart F" is sent back. A request names the specific measures it seeks relief from and makes a separate case for each. The realistic win for a genuinely low-tech operator is relief from most of the technical measures in §101.650 — while incident reporting (§101.650(g)(1)), basic training (§101.650(d)) and record-keeping (§101.640) survive almost any grant.
3. Cost and convenience are not grounds. The case has to be technical, architectural or operational: this system does not exist, this connection is not there, this measure would accomplish nothing here. "It is expensive" is explicitly rejected.
4. The deadline is the same. Requests are due by July 16, 2027, like the plan (§101.655).
5. Filing suspends nothing. Until relief is granted, the underlying requirements stand. Every operator who files needs a contingency posture for the measures they have asked to shed — what they will do if the answer is no.
What a strong request contains
A request the Coast Guard can act on is a package, not a letter. Based on what MCP-WI-002 asks for, ours carries:
| Component | What it is for |
|---|---|
| The completed Cybersecurity Assessment | The prerequisite; it is the evidence everything else cites |
| Documented evidence of the operating environment | An asset census, proof of what connectivity exists and does not, and documentation of the absence of networks where that is the claim |
| The request itself | The specific requirements, each with its citation, and a technical, architectural or operational justification for each |
| An impact analysis | What the requested relief means for the operation and for anything downstream of it — the cascading effects a reviewer will ask about |
| Exhibits | Certificate of Inspection copies, route and cargo descriptions, and connectivity diagrams that let a reviewer see the boats rather than take your word |
| A contingency plan | Slim, and kept ready, because filing does not suspend the obligation |
It is transmitted to Commandant (CG-5P) through the DoD SAFE portal, per work instruction MCP-WI-003, and the Coast Guard may come back with questions. Roughly half of this package is the same work that goes into a full plan, which is why an honest waiver engagement should credit forward if the answer turns out to be no.
The Coast Guard's door, as of this month
This is the part that changes, so here is the posture as we write:
- Full Cybersecurity Plan submissions are being held. On June 4, 2026 the Coast Guard asked industry to refrain from submitting plans until further notice while it finishes its review procedures. Nothing since has reopened that window.
- Waiver and equivalency requests are open. They are being accepted and processed now. It is the only submission lane that is.
- No grant-rate data exists. The Coast Guard has published no statistics on what it has approved or denied. Anyone quoting you a likelihood is offering professional judgment, and should say so with a confidence level rather than a promise.
- The Coast Guard itself has pointed inland operators here. At the Inland Marine Expo in June 2026, its cyber policy staff directed small inland operators to the waiver path as the honest route for operations with little to protect.
- Existing MTSA waivers do not carry over. The Coast Guard confirmed on July 22, 2026 that holders of pre-existing MTSA waivers must still complete the assessment and request Subpart F relief separately if they want it.
Who this is actually for
A waiver is real for an operator whose boats carry paper charts or a standalone chart plotter, no engine telematics, no vessel router, and whose office is a phone and an accounting package — and who can prove that with an assessment. It is also real for a single-boat or two-boat company whose footprint is that small.
It is not real for most companies running five or more boats with Starlink aboard, a dispatch platform in the cloud, an engine dealer reading the ECMs remotely, and a fleeting yard with a TWIC reader at the gate. Those are covered systems, and the honest answer for that operator is the full program, with a plan written once and properly. We will say which you are before any money goes into a filing; our waiver track starts with an eligibility screen for exactly that reason, and the ground rules are laid out at /the-rule/waivers-and-equivalencies.
What never goes away
Whatever the Coast Guard grants, three things remain. You report reportable cyber incidents to the NRC without delay. Whoever touches a computer on your behalf is trained, with records. And the records are kept. A waiver client needs a small program, not no program — and needs the waiver's factual basis checked every year, because a new dispatch subscription or a new remote link on the engines changes the answer, and a change of ownership requires a fresh assessment under §101.650(e).
If you would like an honest read on whether a waiver is real for your fleet, book a readiness call at /book.
The NRC call-script card, the training-records template and the CySO chooser
Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.
Get them —