What records will an inspector ask to see?
Cyber compliance is checked by your regular Coast Guard inspectors at your regular inspections, and what they check is paper. Here is the records section of the rule, the two-year retention, what the training-verification job aid looks for, and the cross-checks a careful inspector runs.
There is no separate cyber inspection. The Coast Guard checks this rule the way it checks everything else: during the vessel and facility inspections you already receive, by the inspectors you already know, with a job aid in hand. What they are looking at is evidence. A control that exists but cannot be shown is, for inspection purposes, a control that does not exist.
This piece is the list — what the rule says must be kept, for how long, and what an inspector does with it.
What the rule requires you to keep
§101.640 is short. It requires records to be created and maintained the same way your existing MTSA security records are, and it names the minimum set: training, drills, exercises, cybersecurity threats, reportable cyber incidents, and audits of the Cybersecurity Plan.
The existing MTSA records rules in Parts 104 and 105 that the section points to set the handling standard: records kept for at least two years, produced to the Coast Guard on request, and electronic records protected against unauthorized deletion, destruction or amendment. The data-security measure in §101.650(c) repeats the two-year floor for the logs and records it governs.
Two years is the minimum. Several records — the plan itself, the assessment, the CySO designation — have to stay current for as long as the obligation runs, and an audit trail that shows a program operating continuously is worth more than the minimum.
The record set, by what an inspector asks for
| Record | Cite | What is checked |
|---|---|---|
| Training records | §101.650(d) | Date, duration, a topic outline mapped to the required elements, the attendee list including contractors, the five-day new-hire clock, and the evaluation of any third-party content |
| Drill records | §101.635 | Two per calendar year, each with scenario, participants, what was tested, and corrective actions |
| Exercise records | §101.635 | One per year, no more than 18 months between, with the CySO's active participation documented and corrective actions recorded |
| Incident log | §101.640 | Every reportable incident with its NRC report number and any CISA notification; threats logged; non-reportable determinations with rationale |
| Audit reports | §101.630(f) | The annual audit, who performed it, evidence of their independence, and the amendments that followed within 30 days |
| The CySO designation | §101.625 | Written, by name and title, with a contact that works at any hour, and an alternate |
| The plan and assessment | §101.630, §101.650(e) | The approved or submission-ready plan within its five-year cycle; an assessment report less than a year old |
Behind the plan sit the technical artifacts the Coast Guard may ask for: the asset inventory with critical systems flagged, the network map and OT configuration documentation (§101.650(b)); account lifecycle and MFA documentation (§101.650(a)); backup configuration and restore-test records (§101.650(g)); vendor remote-access logs and notification terms (§101.650(f)); physical access logs for OT and records of blocked ports (§101.650(i)); and amendment correspondence including 96-hour change notices (§101.630(e)). Plan portions and penetration-test results must be available on request (§101.660).
Training records: the ones being checked now
Training was due January 12, 2026, and it is the item inspectors are verifying today, against job aid MCP-WI-001. Four fields decide whether a record passes:
- Date and duration. Not "completed" — when, and how long.
- Topics. An outline that maps to what §101.650(d) requires: recognizing threats, the techniques used to get around controls, how to report to the CySO, OT-specific content for OT users, and, once a plan is approved, its provisions.
- Attendees. A full list, including contractors with system access — the MSP technician and the electronics shop that remotes into the nav PCs count.
- The clocks. Annual for everyone; within five days of system access for new hires; plan-provision training within 60 days of approval.
Purchased training is fine, but the rule requires that you evaluate it against those requirements and document the evaluation. A certificate from a vendor, alone, is half a record. Our training-records template is built to these fields.
The cross-checks
A records review is not a glance at a binder. A careful inspector, or a good auditor, reads records against each other, and the gaps appear in the seams. These are the cross-checks we run before anyone else does:
- Crew roster against attendee lists. Every person with a login appears on a training record dated within the last year. Anyone on the roster and missing from the records is a finding.
- Hire date against training date. A deckhand who started in March and trained in June missed the five-day clock, and the record shows it.
- Contractor list against training records. The vendors in your supply-chain documentation (§101.650(f)) who hold remote access are in scope for training, or escorted.
- The calendar against the drill records. Two drills in each calendar year since the program began, not two drills total. Exercises no more than 18 months apart.
- The incident log against the NRC. Every reportable incident carries a report number. An incident the log describes but the NRC never heard about is the worst finding on this list.
- The audit against the plan. The auditor named in the report has no regular cybersecurity duties for the operation — the independence test in §101.630(f). Gaps the audit found show up as amendments within 30 days.
- Section 1 of the plan against reality. The CySO named in the plan is the CySO who answers the phone, and a change was notified within 96 hours.
None of these is exotic. All of them are visible in an afternoon to someone who knows where to look.
What a finding looks like
A training gap at a vessel inspection draws a deficiency on a CG-835, the same form as any other. The Coast Guard's stated posture for 2026 is assistance-first; it favors operators who are visibly engaging. But a deficiency is a record too, one your insurer and your customers' vetting teams will eventually ask about, and the civil-penalty exposure under the statute is per violation, per day.
Design for the request, not the binder
The test of a compliance program is a records request answered in minutes: everything for drills, the last two years, with corrective actions, produced in one export rather than reconstructed from inboxes and a shared drive. That standard is hard to meet with a file share. It is nearly automatic when each compliance activity writes its own record as it happens, which is most of the argument for running the program on purpose-built software rather than a binder. We explain the rest at /the-rule/records-and-audits.
If you would like to know which of these records you could produce today, and which you could not, book a readiness call at /book.
The NRC call-script card, the training-records template and the CySO chooser
Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.
Get them —