Fourteen sections, opened up
The Cybersecurity Plan is the central deliverable of the rule: fourteen required sections, submitted for Coast Guard approval by July 16, 2027, valid five years once approved. Every section below is opened up — what the rule hard-wires into it, what a reviewer expects to see, the records that belong with it, and the mistakes that get plans returned.
Read it in the order the work happens
The sections are numbered as the rule numbers them, but that is not the order you build them in. Section 14, the Cybersecurity Assessment, is the first real work — the plan's measures are supposed to be appropriate to the risks that assessment identifies, which is impossible to demonstrate if the plan came first. Section 6, the asset inventory, is what the assessment produces and what half the other sections depend on.
Everything here is free and cites the rule it comes from. None of it requires talking to us, and all of it is the same material we work from.
Organization and the CySO
Who is responsible, in writing, by name, reachable at any hour.
Open section 1 —Section 2§101.630(c)(2)Personnel training
Everyone with access gets trained, on a schedule, with records that survive an inspection.
Open section 2 —Section 3§101.630(c)(3)Drills and exercises
Two drills and one exercise a year, documented, with what you fixed afterward.
Open section 3 —Section 4§101.630(c)(4)Records and documentation
The evidence layer — two years of it, produced on demand.
Open section 4 —Section 5§101.630(c)(5)Communications
How word gets out when something changes — and how the Coast Guard reaches you.
Open section 5 —Section 6§101.630(c)(6)Systems, equipment, maintenance
What you own, what is critical, how it connects, and how it gets patched.
Open section 6 —Section 7§101.630(c)(7)Access control
Who can log in to what — and the controls that answer the most common real attack.
Open section 7 —Section 8§101.630(c)(8)Physical security
Who can physically touch the equipment — including the USB port in the wheelhouse.
Open section 8 —Section 9§101.630(c)(9)Monitoring and response
How you would notice, what you would do, and whether you could actually restore.
Open section 9 —Section 10§101.630(c)(10)Audits and amendments
Who checks the plan every year, and what happens when something changes.
Open section 10 —Section 11§101.630(c)(11)Audit and inspection reports
Everything that was found and fixed, with proof it was fixed.
Open section 11 —Section 12§101.630(c)(12)Unresolved vulnerabilities
What is still open, and what you have decided to live with, in writing.
Open section 12 —Section 13§101.630(c)(13)Incident reporting
Who calls the National Response Center, when, and what they say.
Open section 13 —Section 14§101.630(c)(14)The Cybersecurity Assessment
The analysis the whole plan is supposed to be derived from.
Open section 14 —What surrounds the plan
A plan does not stand alone. The assessment feeds it, the audit checks it, the records prove it, and two obligations — incident reporting and personnel training — were already in force before any of this was due.