Who is allowed to audit our cybersecurity program?

Somewhere in the second half of every readiness call, the same plan surfaces: we will name our port captain as Cybersecurity Officer, he will run the program, and once a year he will audit it and file the report. It is a reasonable guess at how the rule works, and the rule prohibits it. The annual audit required by §101.630(f) must be performed by someone independent of the measures being audited. The person who runs the program cannot be the person who grades it.

This piece walks the whole chain, because the independence requirement decides more than who signs an audit report — it decides part of the cost of every designation path, and it exposes a sales pitch you will eventually hear from someone.

The chain, in four links

One: the CySO must make the audit happen. Among the fifteen duties §101.625 assigns the Cybersecurity Officer is ensuring that an annual audit of the Cybersecurity Plan is conducted, and that the plan is updated if the audit says so. Booking the auditor is the CySO's job.

Two: the CySO may not perform it. §101.630(f) requires the audit to be independent of the program it examines. A CySO auditing their own program is grading their own homework, and the rule closes the door on it. The same logic reaches anyone with regularly assigned cybersecurity duties in the program — the office manager who administers the accounts, the IT vendor that built and runs the controls. Independence means no stake in the answer.

Three: the auditor reports; the CySO fixes. The audit produces findings. Prompt correction of problems found by audits is itself one of the CySO's enumerated duties, so the findings register is not a filing exercise — it drains, and the audit report attaches to the plan as evidence the cycle ran.

Four: amendments follow. When an audit shows the plan no longer matches reality, the amendment machinery in §101.630(e) engages — an audit finding gaps starts a 30-day clock to amend, and amendments go to the same reviewer the plan went to: the Marine Safety Center for vessels, the Captain of the Port for facilities.

Run those four links yearly, forever, and you have the rule's quality loop: one set of hands runs the program, a different set checks it, and the plan on file with the Coast Guard stays true.

You already live under this structure

If this shape feels familiar, it should. Subchapter M runs on exactly the same two-pairs-of-hands principle: your company operates under a Towing Safety Management System, and a third-party organization independent of your operation audits it. The cyber rule imports the discipline, not just the paperwork. Your TPO auditor cannot write your TSMS; your cyber auditor cannot run your cyber program. Operators who have internalized the first sentence rarely struggle with the second — they just have not been told it applies here too.

What internal designation still costs, every year

Here is the budget consequence, stated without varnish. A company that designates its port captain as CySO to avoid outside spend has avoided some of it — and none of the audit. §101.630(f) guarantees that every covered company, however it designates, buys at least one piece of independent outside work annually: the audit. There is no fully in-house version of this program. The realistic comparison between designation paths is therefore never "internal is free, outsourced costs money." It is: internal designation plus training plus an alternate plus the annual independent audit, against a fractional arrangement that carries the program and still leaves the audit with a separate, independent party. We compare the four designation paths honestly in a companion piece, and the printable version lives in the downloads.

The other recurring costs ride alongside the audit either way: the annual Cybersecurity Assessment refresh (§101.650(e)), annual training with records (§101.650(d)), and the two drills and one exercise each year (§101.635). The audit is simply the one item that can never move in-house.

The pitch to hang up on

At some point a vendor will offer to simplify your life: one firm, one contract, we will be your Cybersecurity Officer and perform your annual audit. That is a structure the rule prohibits — the CySO cannot audit the program the CySO runs, and a firm proposing it is telling you, in its own words, that it has not read §101.630(f) or is hoping you have not. Treat the pitch as a gift: it identifies the vendor before any money changes hands.

The same test applies to us. Fairway serves as CySO of record and runs compliance programs; the annual audit of a program we run goes to a separate, independent party, and we say so in the engagement letter. Any provider in this market should be able to draw you their version of the independence chain on one page. Ask for it.

What the auditor actually checks

Worth knowing before your first one. The audit examines the Cybersecurity Plan against reality: whether the fourteen sections describe what the company actually does, whether the measures in §101.650 are operating — MFA on, logs kept and reviewed, backups tested, training current, records producible per §101.640 — and whether the drills and exercises happened as the plan says. The plan itself, once approved, is valid for five years; the annual audit is what keeps those five years honest, and audit reports are among the records an inspector can ask to see. A good audit is uncomfortable in small ways every year so that no audit is catastrophic in a large way in year four.

The calendar consequence

One quiet implication for 2027 planning: the audit cycle begins after the plan exists, so none of this is due before your plan is approved — but the structure is due at designation time, because the CySO you name must be someone whose independence problem you have already solved. Name the program-runner and contract the auditor separately, from the start, and the chain runs itself. The rule's records and audit obligations are laid out at /the-rule/records-and-audits, and the deadline that starts the whole clock — CySO designated, assessment complete, plan submitted — remains Jul 16, 2027 (§101.655).

If you want help structuring the two-pairs-of-hands arrangement for your fleet, book a readiness call at /book.