The clock§101.655
Every deadline this rule creates
Three fixed dates, two of which have already passed, and fifteen recurring clocks that run for as long as you are covered. This is the whole calendar in one place.
Three fixed dates, two of which have already passed, and fifteen recurring clocks that run for as long as you are covered. This is the whole calendar in one place.
CySO designated, assessment complete, plan submitted for approval — all due July 16, 2027. §101.655
| July 16, 2025Passed | Cyber incident reporting began§101.650(g)(1) Reportable cyber incidents go to the National Response Center without delay, at 1-800-424-8802. This obligation is live now and is the one most operators do not realise they already carry. |
| January 12, 2026Passed | Personnel training was due§101.650(d) Everyone with access to your IT or OT systems, contractors included. Annual thereafter. Inspectors verify the records during the vessel and facility inspections you already receive, using a job aid. |
| July 16, 2027Ahead | The wall — officer, assessment, plan§101.655 Designate the Cybersecurity Officer in writing, complete the Cybersecurity Assessment, and submit the fourteen-section Cybersecurity Plan for approval. Facilities submit to their cognizant Captain of the Port; vessels to the Marine Safety Center. Waiver and equivalency requests are due the same day. |
No delaying rule has ever been published. The final rule invited comment on pushing vessel implementation back two to five years, that comment period closed in March 2025, and nothing followed — the Coast Guard’s own 2026 guidance still cites July 16, 2027 for everyone. Facilities were never part of that discussion. More on that.
These are the ones that turn compliance from a project into a program. Most of them are invisible until an inspection or an audit surfaces the gap, and several run in days rather than months.
| Without delay | Report a cyber incident§101.650(g)(1) To the National Response Center, once you believe an incident is reportable. No fixed number of hours — the standard is as soon as you reasonably can. |
| Without delay | Patch a known-exploited vulnerability§101.650(e) Or document a compensating control and the accepted risk. Silence is the thing that is not permitted. |
| 96 hours | Notify on a change of Cybersecurity Officer or ownership§101.630(e) The fastest clock in the rule, and the one most likely to be missed — it fires exactly when everyone is busy with the transition itself. |
| 5 days | Train new personnel after granting system access§101.650(d) The clock most often violated and the easiest for an inspector to check against a crew list. |
| 30 days | Amend the plan after an audit finding§101.630(f) A gap found in the annual audit is not advisory. It starts a clock. |
| 30 days ahead | File an owner-initiated amendment§101.630(e) Changes you choose to make go in with at least thirty days' notice. |
| 60 days | Comply with a Coast Guard-directed amendment§101.630(e) Where the Coast Guard requires a change to your plan. |
| 60 days | Train on plan provisions after approval§101.650(d) Once the plan is approved, personnel are trained on what it says. |
| Annually | Refresh the Cybersecurity Assessment§101.650(e) And again on a change of ownership. The plan's measures are supposed to reflect what the current assessment found. |
| Annually | Independent audit of the plan§101.630(f) By someone independent of the measures being audited — which means whoever builds and runs the program cannot audit it. |
| Annually | Training for everyone with system access§101.650(d) Including contractors, with deeper content for key personnel and OT users. |
| 2 per year | Drills§101.635 Per calendar year. May be combined with existing security drills where the cyber measures are genuinely exercised. |
| 1 per year | Exercise§101.635 No more than eighteen months apart, with substantial and active participation by the Cybersecurity Officer. |
| 2 years | Records retention floor§101.640 Training, drills, exercises, threats, incidents and audits — kept at least two years and produced on demand. |
| 5 years | Plan renewal, with a penetration test§101.650(e)(2) The plan is approved once and valid five years. The penetration test is required at renewal, not for the initial submission. |
A plan submitted on the deadline has no room to be returned for revision, and a returned plan buys at least sixty days of rework against a date that does not move. Roughly 3,400 owners face that date at once, served by a delivery market that cannot absorb them all in the final quarter.
We tell operators to aim at April 16, 2027 — our date, not the Coast Guard's. Taxes are due the fifteenth. Finish the plan the next day and the deadline becomes a filing date instead of a problem.
The plan, section by section —The order of work —The waiver fork —
The readiness call is thirty minutes and free: which obligations already apply to you, whether the waiver fork is real, and a fixed quote for the rest.
Or call 303-848-9352 or email aaron@fairway.systems — a person answers within one business day.