When should your Cybersecurity Plan actually be finished?

If you run towboats or a terminal under the Coast Guard's cyber rule, you know one date. Jul 16, 2027 is the day §101.655 requires three things at once: a Cybersecurity Officer designated in writing, the Cybersecurity Assessment complete, and the Cybersecurity Plan submitted for approval. Ask most operators when the plan needs to be finished and that is the answer you get. July.

Finishing on the deadline is the plan of someone who has never had a document returned. Anyone who has carried a security plan or a TSMS manual through a government review knows what happens to documents: they come back. So the useful question is not when the plan is due. It is when the plan has to be finished for the due date to be safe. We work to an earlier date, and this piece is the arithmetic behind it.

The Ready Date

Friday, Apr 16, 2027 — three months to the day before the deadline. That is the date we build engagements around: the plan finished, quality-checked, signed off by the owner, and staged to file. Not submitted. The Coast Guard has been holding full plan submissions since Jun 4, 2026 while it finishes its review procedures, so nobody is filing anything today. The standard is finished and staged, ready to go the day the window opens.

To be plain about where this date comes from: the rule does not name it. We do. Nothing in §101.655 moves, and Jul 16, 2027 remains the legal wall for everyone. Apr 16 is a working standard, and it exists for four reasons.

One: a returned plan costs months, not weeks

Coast Guard plan review under the MTSA precedent runs completeness first, then compliance, and the historical return triggers are mundane: an assessment missing from the packet, or two or more incomplete sections. When a plan comes back, the resubmission window alone is at least sixty days, with review time on both sides of it. The Coast Guard's own regulatory analysis assumed roughly one plan in ten would need resubmission. Put together, a return-and-revise cycle is measured in months. A plan staged in April can absorb one full cycle and still clear the wall. A plan finished in July absorbs nothing — the first draft has to be perfect, reviewed by an agency working through a stack of first drafts.

Two: the queue is real

The rule reaches thousands of owner-level operators, and every vessel plan goes to the same place: the Marine Safety Center. Facility plans fan out to the Captains of the Port, but the arithmetic is the same. When the submission window opens, a meaningful share of an entire industry files in the same few months, against a review capacity that has never processed anything like that volume of cyber plans. Position in that queue is decided by one thing — whether your plan was finished when the window opened. A staged plan files on day one.

Three: earlier filed, earlier covered

The rule anticipates its own backlog. Under §101.630(d), when the Coast Guard needs more time, it can issue a written acknowledgment that lets you keep operating under the plan as submitted while review continues. That letter is the practical shelter for the period between filing and approval — and you cannot hold it until you have filed. The earlier the plan goes in, the earlier you are operating under an acknowledged submission instead of an open obligation.

Four: the work backs up further than you think

The plan cannot be written first. It has to reflect the risks found in the Cybersecurity Assessment (§101.650(e)), so the assessment comes first, always. For a typical inland fleet the assessment is six to eight weeks of calendar time — document review, shoreside interviews, vessel visits that ride crew changes, the analysis and the report. Plan drafting is another six to eight weeks: fourteen sections, internal quality review, and your own people reading and correcting it, because it describes how your operation actually runs. Work backward from Apr 16 through those two blocks and the start lands at roughly the turn of the year. Which is the point of the whole calendar: you do not have ten months to finish. You have about four to start.

The backward calendar

The ranges are working figures from delivering this, not padding. They assume a cooperative operator and no surprises; holidays sit in the middle of the assessment block, and surprises exist.

What to do this quarter

If your fleet needs the full program — and most operators running dispatch software, Starlink aboard, or remote engine monitoring do — the fall is for scoping. Settle who the Cybersecurity Officer will be, get the assessment on the calendar for the turn of the year, and close the training gap while you are at it, since that obligation is already in force. Nothing about the plan itself needs to happen this quarter; everything that lets the plan start on time does.

If your boats are genuinely low-tech, the waiver path may be real for you — but it runs on the same clock. Waiver requests are due the same Jul 16, 2027 date (§101.665), and every request must carry a completed assessment, so the work starts in the same place. The one difference favors you: the Coast Guard is accepting and processing waiver requests right now, while plans are held. A waiver candidate who starts this fall can be finished — actually finished, filed and answered — with room to run the full program if the answer is no.

Either way, the operator in trouble in the spring of 2027 is not the one who chose the wrong track. It is the one who is still deciding.

If you want to know where your fleet sits on this calendar, book a readiness call at /book.