How fast is "without delay"?

The rule sets no clock, which means the standard is as soon as you reasonably can once you believe an incident is reportable. It is not "after we finish investigating."

What if we report something that turns out to be nothing?

That is the intended behaviour of a broad definition. The Coast Guard's stated 2026 posture favours entities that actively engage; a report that turns out to be a hardware fault costs you a phone call.

Does this apply to us before July 2027?

Yes. Incident reporting has been in force since July 16, 2025. The 2027 date is for the plan, the officer designation and the assessment.

Wheelhouse card§101.650(g)(1)

Reporting a cyber incident: the decision, the call, and the record

This obligation has been in force since July 16, 2025. Reportable cyber incidents go to the National Response Center without delay, at 1-800-424-8802 — the same number every operator already knows from spill reporting.

The hard part is not the phone call. It is the ninety seconds before it, when someone has to decide whether what they are looking at is reportable, usually without any technical background and often outside business hours.

Everything below is the substance of that decision. It is free, it is not gated, and you are welcome to lift it into your own procedures.

The four questions that decide it

The rule's definition of a reportable cyber incident is deliberately broad — it reaches operational disruption and data compromise as well as anything that could develop into a transportation security incident. For a person at a desk, that translates into four questions.

Is a system we depend on behaving wrongly, in a way that may not be an ordinary fault?
Did someone get into an account, a computer, or the network who should not have?
Might company or personal data have been taken, exposed, or encrypted?
Could any of this affect safe navigation, cargo transfer, or facility operations?

If the answer to any of them is yes — or you are not sure

Report. The standard in the rule is without delay, and the definition is broad by design. Investigating until you are certain inverts the duty, and "we were still looking into it" is not a defence anyone wants to offer afterward.

The decision belongs to a named person — the Cybersecurity Officer or their alternate. What the person who found the problem owes is a fast call upward, not a judgment.

What to do before you call

Do not turn the machine off. Disconnect it from the network instead — unplug the cable or switch off the wireless.
Do not delete anything, including the suspicious message.
Write down the time you noticed and exactly what you saw.
Call the Cybersecurity Officer. If there is no answer within ten minutes, call the alternate.

What the National Response Center will ask

The call is a report, not an interrogation. Have this ready and the whole thing takes a few minutes.

Who you are, your company, and a callback number
The vessel or facility involved, and its identifying details
When you became aware, and what you observed
What systems appear affected, and whether operations are impaired
What you have done so far
Whether there is any pollution, injury, or effect on navigation

After the call

The National Response Center issues a report number. That number goes into the incident log, which is one of the records the rule requires you to keep for at least two years and produce on demand.

One call to the National Response Center also satisfies FBI notification. It does not satisfy a separate notification that certain entities owe to the Cybersecurity and Infrastructure Security Agency — determine which category you are in before you need to know, not during.

The card, as it reads on the wall

REPORTABLE CYBER INCIDENT — WHAT TO DO

Is any of this true?
  · A system we rely on is not working right, and it may not
    be an ordinary fault
  · Someone got into an account, a computer, or the network
  · Company or personal data may have been taken
  · Anything that could affect safe navigation or transfer

If yes or unsure — call the CySO now: ______________
No answer in 10 minutes — call: ______________

Do not power off. Disconnect from the network.
Do not delete anything. Write down the time.

The CySO reports to the National Response Center,
1-800-424-8802, without delay, and logs the report number.

The printable version

What the PDF adds

Everything above is the substance, and it stays free and open — no form, no email, no account. The PDF is the same material turned into something you can print, post and fill in.

Two cards to a sheet, sized to cut and laminate for the wheelhouse and the office wall
Blank fields for your Cybersecurity Officer and alternate numbers
A reverse side with the full National Response Center question list and space for the report number

Get the printable PDF — one short form unlocks every document on the site.

Questions

What operators ask

How fast is "without delay"?: The rule sets no clock, which means the standard is as soon as you reasonably can once you believe an incident is reportable. It is not "after we finish investigating."
What if we report something that turns out to be nothing?: That is the intended behaviour of a broad definition. The Coast Guard's stated 2026 posture favours entities that actively engage; a report that turns out to be a hardware fault costs you a phone call.
Does this apply to us before July 2027?: Yes. Incident reporting has been in force since July 16, 2025. The 2027 date is for the plan, the officer designation and the assessment.