What goes in a Coast Guard Cybersecurity Plan: the fourteen sections, explained

If your towboats push tank barges, or your dock handles dangerous cargo, you owe the Coast Guard a Cybersecurity Plan by July 16, 2027 (§101.655). Most of what has been written about that plan describes it in the abstract — "account security, training, incident response." This piece does the opposite. It walks the document the way a reviewer at the Marine Safety Center will walk it: section by section, in the order the regulation requires, with the line of the rule that puts each thing where it goes.

Two facts up front, because they change how you think about the work.

There is no Coast Guard template. As of this writing the Coast Guard has published guidance for the assessment (Policy Letter 01-26), for waivers, and for how to transmit documents — but nothing that says what each plan section should contain. The regulation itself is the template, and it is more specific than people expect.

The Coast Guard is not accepting plans yet. On June 4, 2026 it asked industry to refrain from submitting full plans while it finishes its review procedures. Nothing since has reopened the window. So the job this year is a plan that is submission-ready — finished, grounded, and staged — not one that is filed.

What the plan is, in one paragraph

The Cybersecurity Officer must "develop, implement, and verify" it (§101.630(a)). It must "reflect all cybersecurity measures required in this subpart, as appropriate, to mitigate risks identified during the Cybersecurity Assessment," and "describe in detail how the requirements of subpart F will be met." It is Sensitive Security Information and must be protected under 49 CFR part 1520 (§101.630(b)) — which means it is never emailed, and every copy is controlled. Once approved, it is valid for five years (§101.630(d)(3)).

The phrase that matters most is risks identified during the Cybersecurity Assessment. The plan is not a policy document you write from a standard. It is the answer to what your own assessment found. A reviewer looks for that thread first.

Four lawful shapes

§101.630(a) lets you put the plan in any of four places: inside your existing Vessel or Facility Security Plan, as an annex to it, as part of an approved Alternative Security Program, or as a separate submission. The preamble to the final rule adds that a separate submission "is still considered a part of the VSP, FSP, or OCS FSP."

For a towing company our recommendation is the separate submission, built like an annex. It leaves the physical security plan untouched, and it is the only document that goes back for review when the cyber content changes.

The fourteen sections

§101.630(c) requires that the plan "consists of the individual sections listed in this paragraph." You may reorder them — but if you do, the plan must carry an index showing where each one lives. The titles below are the rule's own words. Where the rule says a measure must be "documented in Section N," that is quoted too; it is the single most useful drafting instruction in the whole subpart, and the thing a reviewer checks first.

1. Cybersecurity organization and identity of the CySO

The owner or operator must "define in Section 1 of the Cybersecurity Plan the cybersecurity organizational structure and identify each person exercising cybersecurity duties and responsibilities within that structure, with the support needed to fulfill those obligations" (§101.620(b)(2)). In practice this section carries the written designation of the Cybersecurity Officer by name and title, the means of reaching them around the clock, the alternate, and every vessel or facility that CySO covers — a CySO serving several must be listed in the plan of each (§101.625(b)).

What it looks like for an eight-boat company: an org chart that fits on one page. The owner, the CySO (who may be an outside provider — the rule allows that explicitly), the alternate, the port captain's role, the office manager's role, and the MSP's role. Named people, not job descriptions.

2. Personnel training

"The training program to address requirements under this paragraph must be documented in Sections 2 and 4 of the Cybersecurity Plan" (§101.650(d)). The program covers everyone with access to IT or OT systems, including contractors: recognition of threats, the techniques used to get around controls, how to report an incident to the CySO, OT-specific training for anyone who uses OT, and — once the plan is approved — its relevant provisions. Key personnel get more.

The clocks are unforgiving. Annual training was due January 12, 2026 and repeats every year; new hires are trained within five days of system access; everyone is trained on the plan's provisions within 60 days of approval (§101.650(d)(4)). This section describes the program. The records that prove it ran live in Section 4.

3. Drills and exercises

The resilience measures — including the Cyber Incident Response Plan, which must be developed, maintained, and exercised — are "documented in Sections 3 and 9" (§101.650(g)). The cadence comes from §101.635: cybersecurity drills "at least twice each calendar year," which may ride along with the drills you already run under Subchapter M; and an exercise "at least once each calendar year, with no more than 18 months between exercises," with "the substantial and active participation of the CySO." Exercises can be tabletop. Corrective actions must be documented "as soon as possible."

What it looks like: a one-page annual calendar, a short scenario library that fits your boats (a phishing test on dispatch; a lost wheelhouse laptop; a vendor link that goes quiet), and the form you fill out afterward.

4. Records and documentation

Three different measures point here. Data security — logs, who may touch them, encryption where feasible — is "documented in Section 4" (§101.650(c)). So is the training program's record side (§101.650(d)), and so is supply-chain governance (§101.650(f)). The standard for the records themselves is §101.640: they are created and kept the way your existing security records are, and "at a minimum" cover "training, drills, exercises, cybersecurity threats, reportable cyber incidents, and audits of the Cybersecurity Plan." The existing rules those cross-references point to require two years of retention, production to the Coast Guard on request, and electronic records "protected against unauthorized deletion, destruction, or amendment."

What it looks like: a table of record types, where each lives, who keeps it, and for how long. Inspectors are already checking training records during routine inspections; this section is where you tell them where to look.

5. Communications

"The CySO must have a means to effectively notify owners or operators and personnel … of changes in cybersecurity conditions … and document these means in Section 5 of the Cybersecurity Plan" (§101.645(a)). Communications must also allow "effective and continuous" contact with the Captain of the Port and other authorities (§101.645(b)).

What it looks like: the notification tree. Who calls whom, by what means, when a boat's connectivity is compromised or the office network is down — with the phone numbers in it.

6. Cybersecurity systems and equipment, with associated maintenance

This is the section with the most hard-wired content. Device security measures "must be addressed in Section 6" (§101.650(b)): an approved list of hardware, firmware and software; executable code disabled by default on critical systems; an inventory of network-connected systems with the critical ones denoted; a network map; and OT device configuration documentation. Routine system maintenance is "documented in Section 6" as well (§101.650(e)(3)): patching of Known Exploited Vulnerabilities or documented compensating controls, a way to receive vulnerability reports, no exploitable channels exposed on internet-facing systems, and no OT on the publicly accessible internet unless explicitly required, with the justification documented for any OT that is remotely accessible. Vulnerability scans run "as specified in the Cybersecurity Plan."

What it looks like: the inventory from your assessment, summarized here and held in full behind the plan; the patch cadence; the list of every vendor that reaches into the boats — the engine dealer's telematics, the chart-update service, the MSP — and what each is allowed to touch.

7. Cybersecurity measures for access control, including the computer, IT, and OT access areas

Account security measures "must be documented in Section 7" (§101.650(a)): lockout after failed logins, default passwords changed, minimum password strength, multifactor authentication on password-protected IT and on remotely accessible OT, least privilege, separate credentials for critical systems versus business email, and removal of credentials when people leave. Network segmentation (§101.650(h)) and physical security (§101.650(i)) are both documented "in Sections 7 and 8."

What it looks like: the account lifecycle — how someone gets access, what they get, and what happens the day they leave mid-hitch. This is the section where most small operators discover the wheelhouse nav PC has had the same shared login since it was installed.

8. Physical security controls for IT and OT systems

§101.650(i), documented in Sections 7 and 8: physical access to OT and the IT that supports it is limited to authorized personnel; HMIs and hardware are secured, monitored, and access to them logged; unused physical ports are blocked, disabled or removed; and access by exception follows a written procedure. Segmentation belongs here too — IT separated from OT, with connections between them "logged and monitored" (§101.650(h)).

What it looks like: who may enter the engine room and the wheelhouse, what is locked, which USB ports are disabled, and whether crew wifi and the navigation computers share a network. On most boats today they do. Saying so honestly, with a plan to fix it, is what this section is for.

9. Cybersecurity measures for monitoring

The other half of the resilience measures (§101.650(g), Sections 3 and 9): reportable cyber incidents go to the National Response Center "without delay"; the Cyber Incident Response Plan exists and is exercised; the plan's effectiveness is validated periodically through exercises or post-incident reviews; and critical IT and OT systems are backed up, with the backups "sufficiently protected and tested frequently."

What it looks like: what is watched and by whom, where the logs go, the backup schedule — and the restore-test record, because a backup that has never been restored is a hope, not a control.

10. Audits and amendments to the Cybersecurity Plan

The rule does not name a measure for this section; its content is the procedure in §101.630(e) and (f). An audit of the plan and its implementation is performed annually, beginning no later than one year from approval, and the CySO "must attach a report to the Plan certifying that the Plan meets the applicable requirements" (§101.630(f)(1)). Additional audits follow a change of owner or operator, or modifications to the cybersecurity measures (§101.630(f)(2)).

The auditor's independence is spelled out in three parts (§101.630(f)(4)): knowledge of audit methods and of access control and monitoring; no regularly assigned cybersecurity duties for the vessel or facility being audited; and independence "of any cybersecurity measures being audited." A Cybersecurity Officer cannot audit their own program. The rule is asking for two pairs of hands.

What it looks like: the annual audit date, who performs it and why they qualify, and the amendment procedure with its clocks (below).

11. Reports of all cybersecurity audits and inspections, to include documentation of resolution or mitigation of all identified vulnerabilities

Risk-management measures are "documented in Sections 11 and 12" (§101.650(e)). Section 11 is the resolved side: every audit and inspection report, and for each finding, what was done about it. The title asks for both halves. A section that lists audits without resolutions has answered half the question.

12. Documentation of all identified, unresolved vulnerabilities, to include those that are intentionally unresolved due to owner or operator risk acceptance

The open side. Everything found and not yet fixed — including, in the rule's own words, vulnerabilities "intentionally unresolved due to owner or operator risk acceptance." Risk acceptance is explicitly lawful. Undocumented risk acceptance is not. Known Exploited Vulnerabilities on critical systems must be patched or compensated "without delay" (§101.650(e)(1)(iv)); anything else may be accepted, with the owner's reasoning written down.

What it looks like: a findings register with a column for the decision. A plan with an empty Section 12 is not believed — least of all by the reviewer.

13. Cyber incident reporting procedures in accordance with part 101 of this subchapter

The duty is to report reportable cyber incidents to the National Response Center — 1-800-424-8802 — without delay (§101.650(g)(1); the owner's corresponding duty is §101.620(b)(7)). What counts as reportable is defined in §101.615, and the definition is broad: it reaches operational disruption, data breaches, and anything that could become a Transportation Security Incident. Entities under 33 CFR part 6 also notify CISA separately. This obligation has been in force since July 16, 2025. The records of incidents live in Section 4 (§101.640).

What it looks like: a one-page script. The four questions that decide whether something is reportable, the number, the elements the NRC will ask for, who gets paged, and where the report number is logged. Written for the person who answers the phone at two in the morning, not for the person who wrote the plan.

14. Cybersecurity Assessment

The assessment itself — or a summary with a reference to where the full report is kept. The rule's own sequence is assessment first, then plan; the CySO's first listed duty is to "ensure that the Cybersecurity Assessment is conducted as required" (§101.625(d)(1)). The assessment is redone annually and sooner on a change of ownership (§101.650(e)(1)). A plan whose Section 14 references an assessment more than a year old has a problem in every other section.

One plan for a fleet

"Owners or operators submitting one Cybersecurity Plan to cover two or more U.S.-flagged vessels … of similar operations must ensure the Plan addresses the specific cybersecurity risks for each" (§101.630(d)(2)). The Coast Guard's published FAQ says the same thing in plain words: similar vessels may share a plan, but any risk differences between boats must be addressed — and if one boat's IT or OT footprint deviates from the others, it needs its own assessment.

For most towing companies that means a master plan with a short variance block per boat, hanging off Sections 6 through 9.

After approval: the clocks

Approval is the beginning of a calendar, not the end of one. Every entry below is from §101.630 unless noted.

The 96-hour clock for a change of Cybersecurity Officer is the one that catches people. If your CySO is a contractor and the contract ends, you have four days.

How much work this is

The Coast Guard estimated it in the final rule's own regulatory analysis: 80 hours to develop a plan for a vessel owner or operator, including the assessment; 100 hours for a facility; and afterward, about 8 hours a year to maintain the plan and 40 hours a year for the annual audit. No page count exists anywhere. The plan is a policy-and-procedure document at the altitude of your safety management manual — not an engineering dossier. The inventory, the network map, and the penetration test results sit behind it, to be produced when the Coast Guard asks (§101.660).

What to do now

1. Do the assessment first. The plan cannot be written honestly without it, and you cannot request a waiver without it either (§101.665).
2. Fix the two obligations that are already live — training records and the incident-reporting script. They are inspected today.
3. Draft the fourteen sections in the rule's order, putting each measure where §101.650 says it goes. Reviewers check placement before they check substance.
4. Write Section 12 truthfully. It is the section that proves the rest.
5. Stage it. The window is closed for now; when it opens, the operators with finished plans are the ones who get approved first.

If you would rather have it written properly, once, that is what we do — fixed price, grounded in an assessment of your own boats, and staged submission-ready for the day the window opens.