What will compliance actually cost a 10-boat operator?

Operators ask this one plainly, and it deserves a plain answer with real numbers. The useful thing is that the Coast Guard has already published its own: the final rule's regulatory analysis estimated, entity by entity, what compliance would cost in staff hours, technology and outside help. Those figures are the honest baseline for anyone deciding whether to do this in-house or hire it. Here they are, with what they leave out, and what we charge beside them.

The Coast Guard's own estimate

The regulatory analysis behind 90 FR 6298 modeled total compliance cost per owner — internal labor, technology and services combined — at year two of the rule:

The eight-vessel figure is the closest published analogue to a ten-boat towing company, and a ten-boat operator with a fleeting yard lands above it, because the facility side carries its own cost. The same analysis found that 81 percent of small vessel owners face compliance costs of at least one percent of annual revenue — the Coast Guard's own acknowledgment that this is a significant expense for the segment. Across the industry it estimated roughly $138.7 million a year of compliance activity.

These are total cost-of-compliance numbers, not consulting fees. They are what the government thinks it costs you to do it yourself.

Where the hours go

The same analysis broke the work into hours, and they are a fair planning guide:

Notice what that table implies. The first year is the heavy one — the assessment, the plan, the CySO designation, the control fixes. But a large share of it recurs forever: the audit, the drills and exercise, the training, the assessment refresh, and the amendment clocks. The rule is a permanent operating condition, not a project, and any honest cost has to be stated per year.

What the hours do not include

The estimate is labor. Three costs sit outside it.

Control remediation. The hours assume you are documenting controls, not installing them. In practice most ten-boat operators need the vessel networks segmented, multifactor authentication turned on for email, the dispatch platform and any vendor remote access, backups that can actually be restored, and default passwords cleared from routers and cameras. Most of this is configuration, not hardware, but it is real work and somebody has to do it.

The 24-hour Cybersecurity Officer. The rule requires a CySO the Coast Guard can reach at any hour, every day. If that is an employee, the cost is the share of their time and the cost of the role never being unstaffed. If it is a contractor, it is a retainer.

The independent audit. §101.630(f) requires the annual audit to be done by someone with no regular cybersecurity duties for your operation. Forty hours of someone else's time, every year, whoever else you use.

What you can skip, for now

Two things vendors sell that the rule does not currently require. A penetration test is required only in conjunction with the five-year plan renewal (§101.650(e)(2)), not for the initial submission. And a separate plan per boat is not required; one plan may cover a fleet of similar vessels, with the differences between boats addressed inside it. Either one, bought now, is money spent on a requirement that is years away or does not exist.

The cost of not doing it

Civil penalties under the statute run to $43,527 per violation, and each day of a continuing violation is a separate violation. The practical exposure is less dramatic and more certain: a deficiency at a routine inspection for training records that should have existed since January 12, 2026, a customer's vetting team asking for your plan, or an insurer asking for proof of compliance at renewal.

What we charge

We do not publish a rate card, and the reason is the same one that runs through this whole article: no two fleets cost the same. Boat count, what the boats push, whether a dock comes with them, how much of the work your own port captain and office can carry, and whether the honest answer for your operation is the full program or a waiver request (§101.665) all move the number — in both directions.

What we publish instead is how the quote works. It is fixed, it is produced after a thirty-minute scoping call, and it is itemized line by line — the assessment, each of the fourteen plan sections, training, drills, the annual independent audit — so you can see exactly what the number is made of, challenge any line on it, and cut scope your own people can genuinely cover. Included scope is written down with the quote, so neither of us plays the change-order game later.

Put a written, itemized quote beside the Coast Guard's $299,214 estimate for an eight-vessel owner doing it in-house and make the comparison yourself — with the liability for the criticality calls, the on-call duty, the audit independence and the records moved onto us. We are not the cheapest way to satisfy the rule. Doing it yourself, well, with your own port captain's hours, might be. What we are is a known number, in writing, for a program that passes inspection.

The honest caveat

No vendor can quote you an approved plan, because the Coast Guard is not yet accepting them. What can be delivered this year is a plan that is finished, grounded in an assessment of your own boats, and staged to file the day the window opens before July 16, 2027 (§101.655) — and a program already running its calendar when an inspector asks.

If you would like a fixed quote for your fleet, book a readiness call at /book.