What does a fractional Cybersecurity Officer actually do?

A fractional Cybersecurity Officer is an outside professional your company designates, in writing and by name, as its Cybersecurity Officer under the Coast Guard's cyber rule. Not a consultant who advises the person holding the job — the person holding the job, carrying the duties the rule assigns and reachable by the Coast Guard around the clock, while your own people keep running the boats.

If that sounds like a workaround, it is worth saying plainly: it is not. §101.625 permits the CySO to hold other duties, to cover multiple vessels and facilities, and to be an outside party. The Coast Guard wrote the rule knowing that a twelve-boat company with no IT department was never going to mint a cybersecurity executive from scratch, and it built the role so the job could be shared, delegated and hired. What cannot be shared is the accountability: the rule lets a CySO assign tasks to anyone, but the responsibility stays with the named person. That is the service being sold. You are not buying advice; you are buying a name that goes on the hook.

The shape of the job

The rule lists fifteen duties for the CySO in §101.625, and nearly every one begins, in effect, with the word ensure. Ensure the Cybersecurity Assessment happens. Ensure the plan's measures are not just written but operating as intended. Ensure the annual audit is conducted, the training is delivered, the drills are run, the records are kept, the reports are filed, the known exploited vulnerabilities are patched without delay. We have written the full list up separately at /the-rule/cybersecurity-officer; the point here is what the list amounts to. The CySO is an accountability role with a calendar attached, not a hands-on-keyboard role. That is exactly why it can be held by an outside professional — and exactly why holding it casually fails.

The job, month by month

Here is what the duties turn into on a working fleet, which is the honest answer to the question in the title:

• The annual cadence. The Cybersecurity Assessment refreshed every year (§101.650(e)), the independent audit arranged every year (§101.630(f)), all-hands training delivered annually with records that survive inspection (§101.650(d)), two drills and one exercise per calendar year with the CySO actively participating in the exercise (§101.635).
• The clocks that never stop. New hires trained within five days of system access. A change of CySO or ownership starts a 96-hour notice-and-amend clock (§101.630(e)). Amendments follow audit findings. Known exploited vulnerabilities on critical systems get mitigated without delay — which means someone is actually watching the list, every week, on your behalf.
• The 2 a.m. duty. When something goes wrong, the reportable-incident determination gets made and the call to the National Response Center goes out without delay (§101.650(g)(1)). A fractional CySO makes or supervises that call, so the decision does not land on a dispatcher alone at night.
• The paperwork that faces the Coast Guard. Plan submissions and amendments go to the Marine Safety Center for vessels or the Captain of the Port for facilities, in the right form, on the right clock. Records are kept at least two years and producible at an inspection in minutes (§101.640).
• The briefings. When a vendor breach or a new threat pattern touches your operation, the wheelhouse and the office hear about it in plain language, from someone whose job is to notice.

None of that is exotic. All of it is relentless. The failure mode of internal designation is rarely ignorance — it is a good port captain with a full job and a calendar that never closes.

What stays with you

An honest provider says this part out loud. The owner or operator's own duties under §101.620 do not transfer: the company still designates the CySO in writing, still owns the plan, still signs what goes to the Coast Guard. The program describes how your operation actually runs, so it can only be as good as the access and candor your people give it — the fractional CySO who is kept in the dark is a name on a letter, and the rule's standard is measures operating as intended, not measures on paper. And the annual audit must be independent of the program it examines (§101.630(f)), which means your CySO — internal or fractional — can never be your auditor. Anyone offering to be both is offering a structure the rule prohibits.

What to demand from any provider

Whether you talk to us or to anyone else, put these on the table:

Who this is for, honestly

Some companies should designate internally. A steady port captain or safety manager, given real training, a named alternate and a working system, can hold this job — the rule was written to allow that too, and we say so on calls where it is true. The fractional model fits when there is no internal candidate with room to carry it, when the owner wants the 24/7 duty and the technical watch held professionally, or when the same program needs to survive people leaving. Our version of the arrangement is described at /fractional-cyso, the role itself at /the-rule/cybersecurity-officer, and the printable documents that support either path are in the downloads.

The deadline for designating a CySO — along with completing the assessment and submitting the Cybersecurity Plan — is Jul 16, 2027 (§101.655). The designation is the least expensive of the three and the one that unlocks the other two, because someone has to own the calendar before the calendar can be kept.

If you want to talk through whether the role should live inside your company or with us, book a readiness call at /book.