The fifteen duties of a Cybersecurity Officer, in plain English

Every company covered by the Coast Guard's cyber rule must designate a Cybersecurity Officer by Jul 16, 2027, and the rule does not leave the job description to the imagination. Paragraph (d) of §101.625 enumerates fifteen duties, one through fifteen, and they are the most useful thing in the whole section — because reading them tells you, more honestly than any sales pitch, what kind of person can actually hold this job.

Here is the list, condensed faithfully and translated for a towing company. The rule's language is "ensure"; the right-hand side is what ensuring looks like on a working fleet.

The fifteen, translated

1. The Cybersecurity Assessment is conducted as required. The annual assessment happens, on time, covering every boat class and the yard — not skipped in a busy year (§101.650(e)).
2. The plan's measures are developed, implemented, and operating as intended. The phrase to underline. Not written down — working. MFA actually turned on, logs actually reviewed, backups actually restorable.
3. An annual audit of the plan is conducted, and the plan updated if it needs to be. The CySO books the independent auditor every year — and may not be the auditor, which we cover below.
4. The Cyber Incident Response Plan is executed and exercised. The 2 a.m. procedure exists, works, and gets practiced before the night it is needed.
5. The plan is exercised as the rule requires. The annual exercise, on the calendar, with the CySO substantially and actively participating (§101.635).
6. Cybersecurity inspections are arranged. Standalone, or alongside a scheduled Coast Guard inspection.
7. Problems found by exercises, audits and inspections are promptly corrected. The findings register drains. Corrective actions close instead of aging.
8. Personnel awareness and vigilance improve. The phishing story gets told at the safety meeting, not just filed in a binder.
9. Personnel are adequately trained. The all-hands annual program, the deeper track for key personnel, and the five-day clock for new hires with system access (§101.650(d)).
10. Reportable incidents are recorded and reported to the owner or operator. The internal escalation works before the external one does.
11. Required records are maintained. Training, drills, exercises, threats, incidents, audits — kept at least two years and producible at an inspection in minutes (§101.640).
12. Required reports are prepared and submitted. Nothing due sits unfiled.
13. The plan and its amendments go to the right reviewer before amending. Vessels to the Marine Safety Center; facilities to the Captain of the Port.
14. Security and management personnel are briefed when cyber conditions change. When a vendor breach or a new threat touches your operation, the wheelhouse hears about it.
15. Known exploited vulnerabilities in critical IT or OT are identified and mitigated without delay. The one patching obligation the rule names explicitly — which means someone watches the list every week.

The word that repeats

Read the list once and the shape jumps out: almost every duty is the word ensure. The CySO does not have to personally configure a firewall, write the training deck, or restore the backup. The CySO has to make certain those things happen, verify they happened, and answer for them — to the owner and, when the Coast Guard calls, to the Coast Guard. That is why the rule lets the CySO delegate tasks to anyone while the responsibility stays with the named person, and it is why a port captain with the right support genuinely can hold the role. It is an accountability job with a calendar attached, and port captains already run their working lives on exactly that structure under Subchapter M.

It is also why a name alone fails. Duty 2 is the trap for the designation that exists only on paper: the standard is measures operating as intended, and an inspector or an auditor can test that in an afternoon. A company that names its port captain and changes nothing else has satisfied the letter of the designation and set the person up to fail the substance.

The three that cannot wait for business hours

Most of the fifteen are calendar work — annual, scheduled, forgiving of a busy week. Three are not:

• Duty 4, executing the incident response plan, arrives without an appointment, and it arrives at night. Behind it sits the reporting obligation: reportable incidents go to the National Response Center without delay (§101.650(g)(1)).
• Duty 14, briefing your people when conditions change, is only worth anything if it happens while the change matters.
• Duty 15, mitigating known exploited vulnerabilities without delay, is a standing watch, not a quarterly task.

These three are the honest argument for pairing whoever you designate with an on-call partner — or for placing the designation itself with a fractional CySO whose business is being reachable. The other twelve duties are a system and a calendar; these three are a phone that has to be answered.

One more duty the list creates by implication

Duty 3 says the CySO ensures the annual audit. §101.630(f) says the audit must be independent of the program it examines — so the person who runs the program cannot be the person who grades it. Put the two together and every designation, internal or outsourced, carries an annual outside audit with it, forever. A company weighing "free" internal designation against a fractional arrangement should price that in; the audit obligation is explained at /the-rule/records-and-audits.

What the list tells you about who to name

Name someone who can run a calendar for years, answer a phone at any hour or be backed by someone who will, and say "show me" instead of "I'm sure it's fine." Technical depth can be taught and hired; the rule's own qualification standard asks only for general knowledge through training, education or equivalent job experience — twelve listed areas, explained with the rest of the role at /the-rule/cybersecurity-officer. The duties are the better filter. Most companies, reading the fifteen honestly, land on one of four paths — port captain with support, office manager with a wheelhouse deputy, the owner, or an outside CySO of record — and we compare them plainly in the downloads and at /the-rule/cybersecurity-officer.

If you want to read the fifteen against your own org chart and see who can actually carry them, book a readiness call at /book.