What do cyber drills and exercises actually look like on a towboat?

Every towing company already drills. Man overboard, fire, the security drills under your Vessel Security Plan — the habit is there and the paperwork is familiar. The Coast Guard's cyber rule adds a cyber element to that habit, and it is less foreign than the word suggests. A cyber drill on a towboat is mostly about people and phones: does the deckhand know what to do with the strange email, does the wheelman know what not to plug into the nav PC, does the night dispatcher know the number to call.

The cadence

§101.635 sets two requirements.

Drills, at least twice each calendar year. A drill tests one element of the program. Drills may be combined with the MTSA security drills you already run — which is usually the cheapest way to meet the cadence — and phishing simulations can count as drills, though not to the exclusion of everything else.

An exercise, at least once each calendar year, with no more than 18 months between exercises. An exercise tests the whole program. It may be a tabletop, a live exercise, or participation in a port-wide exercise, and it must include "the substantial and active participation" of the Cybersecurity Officer. It has to test communication, notification, coordination, the resources you would need, and the response itself.

For both, corrective actions must be documented as soon as possible, and the records kept (§101.640). The resilience measure in §101.650(g) adds a specific target: the Cyber Incident Response Plan must be not just written and maintained but exercised.

The Coast Guard's own estimate in the final rule's analysis was about 8 hours to develop each drill and about 20 hours a year for the exercise. That is the scale of the obligation — an afternoon here and there, not a project.

Drills that fit a river operation

A drill should be small, specific, and built on something that could actually happen to your boats. These are the ones we run, and the element of the plan each one tests.

Two of these a year, rotated so that every element of the plan gets tested over a cycle, is the obligation. The phishing test and the call-through are the two we would never skip.

An exercise that fits

An exercise is the whole plan, run as a story, with the people who would actually be in the room. For a towing company a tabletop of two to three hours is the right scale. A scenario we use:

It is a Tuesday in a high-water week. At 0600 the dispatcher cannot open the fleet-management platform; the office file server shows a ransom note; the accounting system is locked. The boats are fine — they are on VHF and paper — but nobody can see where the barges are, customers are calling about deliveries, and a towboat is due at the lock with a crew change scheduled ashore.

Around the table: the owner, the CySO, the port captain, the dispatcher, the office manager, and the MSP on the phone. The exercise walks the hours. Who decides it is reportable, and calls the NRC. Who tells the boats, and by what means, now that email is gone — the communications section of the plan is being tested here (§101.645). Who talks to customers. How long the company can run dispatch on a whiteboard. Where the backups are, and who has tested restoring them. What the MSP can and cannot do. Whether the Part 6 notification to CISA applies. What gets written down, and by whom.

A second scenario that earns its place at a fleeting yard: the tank gauging on a loaded barge is reading a number the tankerman does not believe. Is it the sensor, the gateway, or someone in the gateway? What is the conservative action, and who calls it.

The test of a good exercise is how many times someone says "I assumed that was handled." Each of those is a corrective action.

Who participates

The rule's hard requirement is the CySO, actively, in the exercise. Beyond that, the useful rule is that the people who would carry the real event are the people in the drill. That means crew, not just office staff, for the wheelhouse scenarios; it means the night dispatcher for the call-through; and it means the MSP, because in most ransomware cases they are the ones with their hands on the keyboard. Training on what to do in an incident is also part of the training requirement in §101.650(d), so a drill doubles as a training record when it is documented properly.

The record

For every drill and exercise, one sheet:

• Date, time, location, and the boat or site
• The scenario and which element of the plan it tested
• Who participated, by name — and, for the exercise, how the CySO participated
• What happened, what worked, what did not
• Corrective actions, each with an owner and a date
• Sign-off by the CySO

Records are kept at least two years and produced on request (§101.640); an inspector counting drills will want to see two per calendar year, not two in total, and exercises no more than 18 months apart. Where a corrective action amounts to a change in the plan, the amendment goes to the Coast Guard on the clocks in §101.630(e).

Why the calendar is the hard part

No single drill is difficult. What catches operators is the cadence: two drills and an exercise, every year, across crew changes and high water, with the paperwork done. Missed years are visible at inspection long afterward, because the records are not there. The rest of the rule's text is at /the-rule/drills-and-exercises.

If you would like the first drill run for your fleet, and the calendar kept after that, book a readiness call at /book.