Which deadlines have already passed, and which is left?

Most operators know one date from the Coast Guard's cyber rule: July 16, 2027. Fewer know that the rule has already been in force for more than a year, that one deadline inside it passed last January, and that inspectors have been checking against it since. This piece puts every date in one place, in order, with what each one asked of you.

All of it comes from the final rule, 90 FR 6298, and the Coast Guard's guidance since. Nothing below is a projection.

The dates so far

The two obligations you already carry

Incident reporting, since July 16, 2025. If something happens on a covered system — a ransomware note on the dispatch server, an engine-monitoring gateway you can no longer trust, a compromised email account — the rule requires a call to the NRC at 1-800-424-8802 "without delay." The owner's duty is in §101.620(b)(7); the measure is §101.650(g)(1); the definition of what is reportable is in §101.615, and it is broad. We cover what the call looks like at /the-rule/incident-reporting. The thing to notice is that this has applied to you for over a year, whether or not a plan exists.

Training, since January 12, 2026. Every person with IT or OT access was to be trained by that date, and the records have to show it: dates, duration, topics, attendees. Coast Guard inspectors now carry a job aid, MCP-WI-001, for verifying exactly that during routine vessel and facility inspections. In our experience most small operators cannot produce the records. If that is you, the fix is days of work, not months, and it is described at /the-rule/training and in our training program guide.

Neither of these waits for 2027. They are the items an inspector can write up today.

What July 16, 2027 actually contains

The date in §101.655 is usually described as "the plan deadline." It is three things arriving together:

1. A Cybersecurity Officer designated in writing, by name, reachable by the Coast Guard at any hour (§101.625)
2. A completed Cybersecurity Assessment — the inventory, the criticality calls, the risk analysis (§101.650(e))
3. The Cybersecurity Plan submitted for approval — fourteen sections, grounded in that assessment (§101.630). Vessel plans go to the Marine Safety Center; facility plans go to the cognizant Captain of the Port

If your route is a waiver rather than a full plan, the request is due the same day, and it must carry the completed assessment with it (§101.665).

Two practical notes. First, the Coast Guard is not accepting full plan submissions at the moment, so the realistic target for this year is a plan that is finished and staged, ready to file the day the window opens. Second, the rule provides for a written acknowledgment under §101.630(d) that lets you keep operating under a submitted plan while the Coast Guard's review continues — which matters if several thousand submissions land in the same month.

The delay that never came

You will hear that the vessel side is going to be pushed back. Here is the record. The final rule asked for comment on a two-to-five-year vessel delay; the comments closed in March 2025; no delaying rule, notice or policy has been published since. The Federal Register was checked on August 17, 2026, and the Coast Guard's June and July 2026 guidance still cites July 16, 2027 for everyone. Facilities were never part of the delay discussion at all.

A late delay is possible. Planning around one is not a plan. The work does not shrink if the date moves, and the two obligations already in force do not move with it.

After approval, the calendar never stops

Approval is not the end of the dates. It is the start of a permanent calendar:

• Training on the plan's provisions for all personnel within 60 days of approval, then annual refresher training (§101.650(d))
• Two cyber drills each calendar year and one exercise, no more than 18 months apart (§101.635)
• An annual audit of the plan by someone independent of the measures being audited, with amendments within 30 days of any gaps found (§101.630(f), §101.630(e))
• An annual refresh of the assessment, and a new one on any change of ownership (§101.650(e))
• A 96-hour clock to notify and amend when the Cybersecurity Officer or the owner changes (§101.630(e))
• Renewal at five years, with a penetration test at that point — not before (§101.650(e)(2))

Records for all of it kept at least two years and producible on request (§101.640).

What non-compliance costs, per day

Civil penalties under 46 U.S.C. 70119 run to $43,527 per violation, and each day of a continuing violation is a separate violation. The Coast Guard's 2026 posture is assistance-first — it favors entities that engage — but the lever it reaches for is ordinary MTSA machinery: a deficiency at a routine inspection, and a Captain of the Port order if that is ignored.

Where that leaves you this week

If you are in scope, the order of work is the same for everyone: close the two live obligations first, do the assessment, then decide between the plan and a waiver on the evidence. We laid that sequence out in the 2027 deadline playbook.

If you would like to know which of these dates already apply to your boats, and what is already overdue, book a readiness call at /book.