Is my company actually a waiver candidate?

The waiver question usually arrives on a call in one sentence: "We're a small outfit, we don't really have technology — can't we just get waived out of this?" It deserves a straight answer, because the relief in §101.665 is real, some companies honestly qualify, and a wrong guess in either direction is expensive. Filing a request that cannot survive scrutiny burns credibility with a reviewer who will read your filings for years; running a full program you genuinely did not need burns money.

We have written elsewhere about how the waiver mechanics work and the ground rules at /the-rule/waivers-and-equivalencies. This piece is the screen itself — the questions we ask to sort real candidates from hopeful ones, published so you can run it on your own fleet before you spend a dollar. One caution first: nothing here is legal advice, and a waiver filing should pass under a maritime attorney's eye before it goes to the Coast Guard.

What relief is, in one paragraph

§101.665 offers a waiver — the Coast Guard agrees a specific requirement is unnecessary given the nature of your operation — and an equivalency — the Coast Guard accepts a different measure that achieves the same protection. Relief is granted per requirement, on technical facts, never as a blanket pass, and only after a completed Cybersecurity Assessment (§101.650(e)) proves those facts. Cost and inconvenience are explicitly invalid grounds. Requests are due by the same Jul 16, 2027 deadline as everyone's plans (§101.655) — and they are the one submission lane the Coast Guard is accepting and processing right now.

The strong candidate

Picture the fleet the relief was written for. The wheelhouses are genuinely analog: paper charts, or standalone electronics that connect to nothing. No satellite or cellular data service to the boats. No remote engine monitoring — the dealer reads the engines with a laptop at the dock, if at all. No dispatch software; the boats move on a phone call. The office runs on a telephone, a checkbook and a filing cabinet. No vendor has a standing remote path into anything, because there is nothing to reach.

These operations exist — older harbor and fleeting outfits especially — and for them, whole clusters of the rule's technical measures have nothing to attach to. Multifactor authentication on remotely accessible operational technology is meaningless where no OT is remotely accessible; network segmentation is meaningless where there is no network. An assessment that documents those absences, requirement by requirement, is the backbone of a request that gets granted.

The mirage — and the phone-and-email trap

Now the harder profile, which is most companies who ask. The owner says "we have no technology," and means it — no fancy bridge electronics, no fleet-management platform. But the office runs email. Payroll runs on software. Banking happens online. There is a cellular hotspot in every wheelhouse because the crews insisted, and the chart tablet updates over it. A dispatcher texts orders from a personal phone.

That operation has less marine-specific technology than a Kirby boat, and that is not the test. The systems it does have — the email account, the banking login, the office computer — are precisely the ones the documented threats against companies this size actually target: the fake fuel invoice, the compromised mailbox, the locked-up office machine. A waiver request built on "no corruptible technology" that an assessor can falsify in an hour is worse than no request at all. It tells the reviewer this company either did not look or hoped nobody would.

The honest screen question is not "do you have technology" but: what would an assessor find in one afternoon? If the answer includes email, online banking, a hotspot and a dispatch group text, you may still win relief from some measures — but on a per-requirement argument from evidence, not on a claim of having nothing.

The screen, as questions

Run these honestly against your own operation:

Mostly no, verified rather than remembered — you may be the strong candidate, and the waiver track is worth pricing. Mostly yes — the honest answer is a right-sized full program, and a candid advisor says so at the screen stage, before the filing money is spent. That memo is the screen's whole deliverable, and it sometimes reads: you are not a candidate, here is why, here is what the alternative costs.

What survives even a granted waiver

The most dangerous word in this subject is "cleared," so here is what remains true for every waiver client:

• Filing is not relief. The obligations run until the Coast Guard grants the request. A company that files and stops working has bet its posture on a reviewer's calendar.
• The reporting duty survives. A company with a bank account and an email address can still have a reportable cyber incident, and it still goes to the National Response Center without delay (§101.650(g)(1)).
• Training survives for anyone who touches IT on your behalf (§101.650(d)) — smaller in scope, but the office manager who pays the invoices is exactly who it exists for.
• Records survive (§101.640), and the assessment behind the request must be done first — the rule permits no other order.
• The facts must stay true. A waiver premised on no networked systems dies quietly the day someone installs dispatch software or a Starlink terminal. The factual basis needs re-checking every year, and a change should trigger a call before the install, not after.

The honest bottom line

Genuine candidates exist, and for them the waiver track is the cheapest lawful path through the rule — an honest screen, a real assessment, a specific argument, and a small standing program. For everyone else, the screen is still the cheapest first step, because it converts a guess into a decision while there is still calendar to act on either answer. Our version of the track, screen first, is at /waiver-track.

If you want the screen run against your fleet, book a readiness call at /book.