Who can be our Cybersecurity Officer, and can the port captain do it?

Every owner or operator inside the Coast Guard's cyber rule must designate a Cybersecurity Officer by July 16, 2027 — in writing, by name. For a towing company the question that follows is immediate and practical: who? The answer most operators reach for first is the port captain, or the compliance manager who already carries the TSMS. The rule permits that. Whether it works is a different question, and it deserves an honest answer.

What the rule actually requires

§101.625 sets the standard, and it is lighter than people expect on credentials and heavier on availability.

Designated in writing. The owner or operator names the CySO — by name and title, with contact information — and that designation lives in Section 1 of the Cybersecurity Plan, alongside the rest of the cybersecurity organization (§101.620). Every vessel or facility the CySO covers is listed.

Qualified. The rule requires no license and no certificate. The qualification is knowledge of the relevant subjects gained through training or equivalent job experience. The rule creates no credential of its own, and anyone selling one is selling the word.

Reachable by the Coast Guard 24 hours a day. This is the requirement that decides everything else. The CySO is the person the Coast Guard calls, at any hour, about your cyber program.

Allowed to hold other duties. The CySO may have other responsibilities, may cover multiple vessels and facilities, and may be an outside party. The rule was written knowing that small operators would rely on third parties for their cybersecurity, and it says so.

What the CySO owns

The rule lists the CySO's duties at length — fifteen of them in §101.625 — and they amount to owning the whole program:

• Making sure the Cybersecurity Assessment is done, first and annually (§101.650(e))
• Developing, implementing and verifying the Cybersecurity Plan (§101.630)
• Arranging the annual audit and carrying its findings into amendments (§101.630(f), §101.630(e))
• The training program and its records (§101.650(d))
• Two drills and an exercise each year, with the CySO's own "substantial and active participation" in the exercise (§101.635)
• Incident response, including the report to the National Response Center without delay (§101.650(g)(1))
• Patching known exploited vulnerabilities on critical systems without delay, and the rest of the maintenance cadence
• Every amendment clock, including the 96-hour notice when the CySO or the owner changes (§101.630(e))

That is a job description, not a title.

One person for a fleet

Yes. The rule places no cap on how many vessels or facilities one CySO may cover. A ten-boat company with a fleeting yard names one CySO, lists every boat and the yard in the plan, and runs one program. For a fleet under one Cybersecurity Plan, that is the natural shape.

What the rule does expect is that the CySO actually knows each of them — the plan has to address any risk differences between boats, and the CySO is the person verifying that it does.

The alternate

The rule does not require a named alternate. We always designate one, for two reasons. The 24-hour reachability duty does not pause when the CySO is on vacation or in a hospital. And a change of CySO starts a 96-hour clock to notify the Coast Guard and amend the plan (§101.630(e)); an alternate already named and already trained makes that a paperwork event rather than a scramble.

Can the port captain do it?

Here is the honest version, as a table, because the answer depends on what you are asking of the person.

The rule allows the port captain. What it asks, on top of an already full job, is a permanent on-call duty, a calendar that never closes, and a technical watch that nobody in the wheelhouse was hired for. Many port captains can do the first part well and none of the rest.

The model the rule was written to permit is the split: an outside CySO of record who carries the designation, the 24/7 reachability, the calendar and the technical watch, and your own people — port captain, office manager, dispatcher — running day-to-day operations under that program and feeding it what it needs. The CySO can only be as informed as your operation lets them be; that cooperation is the duty that stays with you.

Independence from the audit

One constraint the port-captain plan often misses. §101.630(f) requires an annual audit of the Cybersecurity Plan by someone who has no regularly assigned cybersecurity duties for the operation and who is independent of the measures being audited. A CySO cannot audit their own program. Neither can the MSP that built and runs the controls.

That means a one-person program cannot be a complete program. Someone else has to look at it every year. The Sub M world already runs on exactly this structure — your TPO auditor is independent of your TSMS — and the cyber rule expects the same two pairs of hands.

Changing the CySO

Whoever you name, plan for the day they leave. A CySO change requires notifying the Coast Guard within 96 hours and amending the affected portion of the plan within the same window (§101.630(e)). If the CySO is a contractor and the contract ends, that clock starts on the last day. If the CySO is an employee who resigns, it starts then. A named alternate, and records that do not live in one person's head, are what make those four days survivable.

What we recommend

Name the person who can genuinely be reached at any hour and who can run the calendar for years — whether that is someone on staff who is given the time and the system to do it, or a fractional CySO. Name an alternate either way. Keep the audit with someone independent. And write the designation so that the Coast Guard, reading Section 1 of the plan, knows exactly who to call and at what number. The role is explained further at /the-rule/cybersecurity-officer, and our version of the outsourced arrangement at /fractional-cyso.

If you would like to talk through who should hold the role for your fleet, book a readiness call at /book.