Does our IT provider need this training?

If they have access to your systems, yes. The requirement follows access, not employment status.

Can we use an off-the-shelf course?

Yes. Evaluate it against the required topics, document that evaluation, and fill any gaps. The evaluation is the step people skip and the one a reviewer asks for.

How long do we keep the records?

At least two years, produced on demand, and protected from deletion or unauthorised amendment.

Records template§101.650(d)

Cybersecurity training records that survive an inspection

The training deadline passed on January 12, 2026. It reached everyone with access to your IT or operational technology systems, contractors included — and most operators cannot produce the records.

Inspectors verify cybersecurity training during the vessel and facility inspections you already receive, using a job aid. What they are checking is not whether you believe training happened. It is whether the record shows what was covered, who was there, and when.

Everything below — the required topics, the clocks, and the fields a record needs — is free and ungated.

Who has to be trained

Everyone with access to your information technology or operational technology systems. That reaches further than most operators first assume: the managed service provider who administers the network, the surveyor with a laptop, the contractor who plugs into a vessel system.

On top of that base layer, the rule asks for deeper training for designated key personnel — whoever holds elevated access or specific cybersecurity duties — and operational-technology training for the people who use those systems.

The four clocks

Within five days of being given system access — the clock most often missed, and the easiest to check against a crew list
Within thirty days of hire
Annually thereafter
Within sixty days of plan approval, for training on the plan's own provisions

The topics the rule enumerates

Training has to cover the threats people actually face and what they are expected to do — recognising an attempt, the reporting route, and the provisions of the plan that apply to their role. Where you buy the content rather than write it, you must evaluate it against these topics and document that evaluation. Buying a course is not the same as meeting the requirement.

The record fields inspectors check

Date and duration of the session
Topic outline, mapped element by element to what the rule requires — this is the field most records omit
Attendee names and roles, including contractors
Who delivered it, and whether the content was third-party
For new personnel: the date access was granted, beside the date training was completed, so the five-day clock is visible on one line
Key-personnel designations and the additional training they received
The third-party content evaluation, where content was purchased

The shape of a record that holds up

SESSION
  Date ____________  Duration ________  Delivered by __________
  Content: [ ] in-house  [ ] third party — evaluation attached

TOPICS COVERED            mapped to §101.650(d)
  [ ] Threat recognition        [ ] Reporting procedure
  [ ] Plan provisions           [ ] Practices for this role
  [ ] OT-specific content       [ ] Key-personnel content

ATTENDEES        role        employee/contractor    access date
  1. ____________________________________________________
  2. ____________________________________________________

NEW PERSONNEL — five-day check
  Name ____________  Access granted ______  Trained ______
  Gap within 5 days?  [ ] yes   [ ] no — logged as a finding

If you are behind

The obligation is continuing, not a single event you missed. Exposure grows with every inspection that finds no records and shrinks the day you can produce them. Train everyone now, record it in the shape above, and keep the record for at least two years.

The printable version

What the PDF adds

Everything above is the substance, and it stays free and open — no form, no email, no account. The PDF is the same material turned into something you can print, post and fill in.

A printable session sheet and a running roster, formatted for a binder
A separate new-hire tracking sheet with the five-day clock built into the columns
A third-party content evaluation form mapped to the required topics

Get the printable PDF — one short form unlocks every document on the site.

Questions

What operators ask

Does our IT provider need this training?: If they have access to your systems, yes. The requirement follows access, not employment status.
Can we use an off-the-shelf course?: Yes. Evaluate it against the required topics, document that evaluation, and fill any gaps. The evaluation is the step people skip and the one a reviewer asks for.
How long do we keep the records?: At least two years, produced on demand, and protected from deletion or unauthorised amendment.