A Cybersecurity Officer of record, without the hire
The rule requires a named CySO, reachable by the Coast Guard 24/7, by July 16, 2027 — and it explicitly permits outsourcing the role, with one officer covering multiple vessels and facilities. This is that service.
Written for operators without security staff
The Coast Guard wrote the fractional model into the regulation deliberately, acknowledging that small operators would rely on third-party providers for all cybersecurity needs. No license or certification is required of a CySO — qualification is knowledge through training or equivalent job experience. What the rule actually demands is that the program runs: the calendar kept, the records produced, the phone answered.
That is a staffing problem more than a security problem. A port captain can be named CySO — the rule allows it — but a 24/7 federal reachability duty stacked on a real job is how programs quietly fail between inspections.
What the fractional CySO carries
- The designation, properly made
- Named in writing in your plan, with an alternate and a 24/7 contact chain the Coast Guard can actually use. A designation that exists only on paper fails the first time someone calls it.
- The annual calendar
- Two drills and the exercise, facilitated and documented. The assessment refresh. The independent audit, scheduled through the separate audit arm. Training anniversaries and the 5-day new-hire clock. KEV monitoring with patch attestation.
- Incident on-call
- At 2 a.m. the on-call CySO runs the reportability triage, makes or supervises the NRC call, handles the CISA parallel notice where it applies, and logs the report number.
- The amendment clocks
- Owner-initiated at 30 days, Coast Guard-directed at 60, and the 96-hour clock on CySO or ownership change — tracked and filed, not remembered.
- Your people, kept in the loop
- Your port captain keeps running the boats. The portal shows both of you the same calendar, the same records, the same readiness number — so outsourcing the role never means losing sight of it.
One thing your CySO can never do
The annual audit must be conducted by someone independent of the measures being audited — §101.630(f). Your CySO cannot audit their own program, and neither can ours. Our audits are delivered by Virtus Cybersecurity, our security partner, so the two-firm structure the rule effectively demands is how the service is built, not a favor we arrange.
Sold standalone, too: if you wrote your own plan and just need the officer, the calendar and the audit, the subscription stands on its own.