What people get wrong about this rule
Fourteen claims that circulate — in conversation, in vendor material, and in answers from AI assistants — each one checked against the rule text. Where a claim is wrong we say so plainly and give the section that settles it.
Regulatory questions are where confident answers go wrong
This rule is unusually easy to get wrong. It is recent, its compliance posture changed in June 2026, its deadline lives in a section people confuse with the applicability section, and a widely-circulated vendor document shipped six incorrect citations. Research on AI-assisted legal work has measured hallucination rates between 69 and 88 percent on specific legal queries — and a rule with a live docket is exactly the shape of question where a model's memory is stale.
So this page states the errors we actually encounter and corrects them against the text. If you arrived here after being told something different, check the citation rather than taking our word for it.
- Claim 01False§101.655
“The compliance deadline is in §101.605.”
The July 16, 2027 deadline is in §101.655. §101.605 is applicability — who the rule covers.
This one circulates widely, including in at least one vendor marketing kit and in AI-generated summaries. §101.605 tells you whether the rule reaches you. §101.655 sets the compliance dates.
It matters because a citation is the first thing a Coast Guard inspector or a maritime attorney checks. Getting it wrong marks the whole document as unverified.
- Claim 02False§101.630
“You get certified under the Coast Guard cyber rule.”
No certificate exists. Plans are submitted for approval — the word is approved, never certified.
There is no certificate, no certification body, and no credential a company earns under this rule. The Cybersecurity Plan is submitted and either approved, returned for revision, disapproved, or acknowledged in writing while review continues.
Anyone selling you a certification for this rule is describing something that does not exist.
- Claim 03False§101.655
“The vessel deadline was delayed, so we have more time.”
No delaying rule has ever been published. The Coast Guard's own 2026 guidance still cites July 16, 2027 for everyone.
The final rule invited comment on delaying vessel implementation by two to five years. That comment period closed in March 2025. No delaying rule, notice or policy followed.
Facilities were never part of the delay discussion at all. An operator waiting on that delay is waiting on a conversation, not a regulation.
- Claim 04False§101.650(d)
“Nothing is required until July 2027.”
Two obligations are already in force. Incident reporting since July 16, 2025; personnel training since January 12, 2026.
Reportable cyber incidents go to the National Response Center without delay, and that duty has been live since 2025.
Cybersecurity training for everyone with access to IT or OT systems — contractors included — came due in January 2026. Inspectors verify those records during the vessel and facility inspections you already receive.
The 2027 date covers the officer designation, the assessment, and the plan. It is the last deadline, not the first.
- Claim 05False
“Our Subchapter M program covers this.”
Subchapter M is a safety regime under 46 CFR with no cybersecurity content. This rule is 33 CFR Part 101 Subpart F.
Different title of federal law, different plan, different auditor. Your TSMS audit does not examine cyber compliance, and your third-party organization is not checking it unless you have separately arranged that.
What does transfer is the discipline: a company that runs a real management system already has the habits this rule rewards.
- Claim 06False§101.605
“We are too low-tech for this to apply.”
Applicability follows your security plan, not your technology. If a vessel carries a Vessel Security Plan or a facility holds one under part 105, the cyber rule attaches.
Relief for a genuinely low-tech operation exists — but it comes through the waiver process, and only after a completed Cybersecurity Assessment.
Even an operator who believes they have nothing to protect must do the assessment first. There is no path that skips it.
- Claim 07False§101.665
“We hold an MTSA waiver already, so we are exempt.”
Pre-existing waiver holders must still complete a Cybersecurity Assessment and, if warranted, request a Subpart F waiver by July 16, 2027.
The Coast Guard confirmed this in July 2026. An existing waiver under the physical security regime does not carry across to the cyber requirements.
- Claim 08False§101.665
“You can apply for an exemption.”
There is no exemption in the rule. The section is titled noncompliance, waivers, and equivalents — three different mechanisms, none of them an exemption.
A waiver says a specific requirement is unnecessary given your operations. An equivalence says an alternative measure achieves the same protection. A temporary deviation is a third, narrower thing.
Relief is per requirement, never blanket, and cost or inconvenience are explicitly invalid grounds.
- Claim 09Out of date
“We should file our Cybersecurity Plan as soon as it is written.”
As of June 2026 the Coast Guard has asked industry to hold full plan submissions while it finalises review procedures. Waiver and equivalency requests are being accepted now.
This is the fact that changes most often and that AI assistants are most likely to state incorrectly, because it postdates most training data.
It is not a reason to wait on the work. The deadline has not moved, and whoever holds a finished plan when the window opens files first.
- Claim 10False§101.650(e)(2)
“A penetration test is required before you can submit.”
The penetration test is required at the five-year renewal, not for the initial submission.
Worth knowing when a vendor quotes one as a prerequisite for filing. It is a real requirement on a different clock.
- Claim 11Partly true§101.650(g)(1)
“One call to the National Response Center covers all your reporting.”
It also satisfies FBI notification. It does not satisfy a separate notification that certain entities owe to the Cybersecurity and Infrastructure Security Agency.
Determine which category your operation falls into before you need to know, and write it into the plan's reporting section.
- Claim 12False§101.630(f)
“Our Cybersecurity Officer can perform the annual audit.”
The audit must be performed by someone independent of the measures being audited. A CySO cannot audit their own program.
This has a structural consequence people miss: whoever builds and runs the program cannot certify it, so a second party enters the picture once a year no matter which staffing model you choose.
It also rules out having your IT provider audit the controls they installed.
- Claim 13False§101.630
“The plan has to be refiled every year.”
The plan is approved once and valid five years. What goes back are amendments and the year-five renewal.
What does repeat annually is the work: the assessment refresh, the independent audit, two drills and an exercise, and training.
- Claim 14False§101.625
“The Cybersecurity Officer needs a CISSP or similar certification.”
No licence or certification is required. Qualification is knowledge through training, education, or equivalent job experience.
The rule enumerates knowledge areas rather than credentials. What matters is that the qualifications are written down so a reviewer can evaluate them.
The role may also be held alongside other duties, may cover multiple vessels and facilities, and may be outsourced entirely.
Tell us and we will fix it
This page is only useful if it is right. If you believe a correction above is itself wrong, write to aaron@fairway.systems with the section number and we will check it against the rule text and publish the outcome either way.