The twelve things a Cybersecurity Officer must know — and why your port captain is closer than you think
The rule requires the CySO to have general knowledge in twelve areas, gained through training, education or equivalent job experience. No certificate, no degree, no IT background. Here is the study grid — and the honest arithmetic on how much of it a working port captain already has.
The most common reason a towing company hesitates to name a Cybersecurity Officer from its own ranks is a picture: some imagined federal standard that only a security professional could meet. The rule contains no such standard. What paragraph (e) of §101.625 actually requires is general knowledge, through training, education, or equivalent job experience, in twelve listed areas.
Read that sentence again, because every word of it was chosen. General knowledge, not expertise. Through training, education, or equivalent job experience — three doors, any one of which is enough. The rule requires no certification, no degree, and no IT background, and it creates no credential of its own. The Coast Guard approves plans; it does not issue certificates to people, and anyone selling a Coast Guard credential for this role is selling the word. The qualification bar was written so that a capable operations person could clear it with real training. Here is the list, and the honest accounting of where a working port captain starts.
The twelve areas, as a study grid
For each area: what the rule's words mean at a towing company, and where a port captain typically stands on day one.
| # | Knowledge area | On a towing company, that means | A port captain typically |
|---|---|---|---|
| 1 | General vessel and facility operations and conditions | How the boats, the fleet and the office actually run | Has it — this is the job |
| 2 | General cybersecurity guidance and best practices | Passwords, MFA, phishing, patching, backups — the hygiene canon | Gap to close with a structured course |
| 3 | The company's Cyber Incident Response Plan | Who calls whom at 2 a.m., in what order | Learnable in an afternoon once the plan exists |
| 4 | The company's Cybersecurity Plan | The fourteen sections and where everything lives | Learnable — they will help write it |
| 5 | Cybersecurity equipment and systems | What the firewall, the endpoint agent and the satellite router actually do | Gap to close — vocabulary more than depth |
| 6 | Audit, inspection, control and monitoring methods | How to check that a control is real, not asserted | Familiar shape — Subchapter M audits taught this |
| 7 | Relevant cybersecurity laws and regulations | This subpart, the reporting duty, SSI handling | The part that gets taught line by line |
| 8 | Instruction techniques for training and education | Running the all-hands session so it sticks | Most port captains already run safety training |
| 9 | Handling SSI and security communications | Sensitive Security Information: marked, access-controlled, never emailed | A rules module — learnable |
| 10 | Current threat patterns and known exploited vulnerabilities | What is actually hitting companies like yours, this year | A standing feed, not a course — needs a partner watching |
| 11 | Recognizing threatening persons and behavior | Social engineering, pretexting, the "vendor" on the phone | Teachable as a skill — the fraud reframe |
| 12 | Conducting and assessing drills and exercises | Running the two drills and the annual exercise, and grading them honestly | Familiar shape — they run man-overboard drills already |
The honest arithmetic
Count the right-hand column. A working port captain starts with roughly a third of this list in hand — the operations knowledge in area 1 that no outside hire will ever match, the training-delivery craft of area 8, the drill discipline of area 12. Another third is familiar in shape: areas 3, 4, 6 and 9 are the same muscle Subchapter M already built, applied to a new subject. What remains are four true gaps — areas 2, 5, 7 and 10 — and they share a character: they are knowledge about the cyber world itself, not about your operation.
That is the argument in the title. The port captain is closer than most owners think, because the half of the job nobody can teach — knowing the boats, the crews, the river and the way the operation actually runs — is the half they already have. The half they lack is the half that is straightforwardly teachable, and one of the four gaps (area 10, the current threat picture) is not really a course at all but a subscription: someone has to watch the feed continuously, which is a strong reason to pair an internal designation with an on-call partner rather than to abandon it.
What the grid is for
Use the table above as a self-assessment. For each of the twelve, the person you are considering marks one of three boxes: have it, close, or gap. No wishful marking — area 2 marked "have it" should survive the question "show me the last time you checked whether MFA was on everywhere." The pattern of marks then makes the designation decision almost by itself:
- Mostly have it and close, with gaps in 2, 5, 7 and 10 — the classic port-captain profile. Designate internally, close the gaps with a real course, and put a standing partner behind area 10 and the after-hours duties.
- Gaps across the operational areas too — the candidate knows the office but not the boats, or vice versa. Pair them with a deputy from the other side of the company, or reconsider.
- Nobody scores well and nobody has room to improve — that is not a failure; it is the honest case for an outside fractional CySO of record, which the rule explicitly permits.
We have put the grid on paper. Our two-page document, Choosing your Cybersecurity Officer, carries the twelve areas as a tick-box self-assessment alongside the four designation paths compared honestly — free, in the downloads.
What qualification is not
Two cautions, both from the rule's own text. First, qualification is a floor, not the job: the fifteen duties in §101.625 are what the CySO actually does, and we have translated them in a companion piece. A person can clear the knowledge bar and still fail the calendar. Second, knowledge is assessed against your operation, not in the abstract — areas 3 and 4 are knowledge of your plans, which do not exist yet at most companies. The qualification and the program get built together, which is why the CySO decision belongs at the front of the compliance sequence, not the end. The designation itself is due, along with the assessment and the plan, by Jul 16, 2027 (§101.655), and the role is explained in full at /the-rule/cybersecurity-officer.
If you want to run the twelve-area grid against a real candidate, book a readiness call at /book.
The NRC call-script card, the training-records template and the CySO chooser
Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.
Get them —