Audit and inspection reports
Reports of all cybersecurity audits and inspections, including documentation of resolution or mitigation of all identified vulnerabilities
Everything that was found and fixed, with proof it was fixed.
Sections 11 and 12 are a matched pair, and understanding why they are separate is most of the work. Section 11 holds what was found and resolved. Section 12 holds what remains open, including what you have deliberately chosen to live with.
Splitting them is not bureaucratic. It lets a reviewer see the difference between a program that finds and fixes things and one that finds things and stops.
What §101.630(c)(11) hard-wires into this section
- Reports of audits and inspections
- The annual independent audit, any Coast Guard inspection findings, penetration test results at renewal, and internal assessments.
- Resolution or mitigation documented
- For each identified vulnerability: what was done, when, and how you know it worked.
- The certifying report
- The Cybersecurity Officer's report certifying that the plan meets the applicable requirements is attached here.
What a reviewer expects to see
- A findings register with a stable identifier per finding, so it can be tracked across years
- Severity assigned with stated criteria rather than instinct
- Closure evidence attached to each item — a screenshot, a configuration export, a test result
- Dates that let a reviewer verify the 30-day amendment clock was met
- Findings from the annual Cybersecurity Assessment carried through to closure here, which is what makes the assessment meaningful
A closed finding with real closure evidence
Not a template to copy. This is the shape and specificity a section reads with when it has been written from a real operation — bracketed where your facts go.
F-2026-004 · Severity: High · Source: annual audit [date] Finding: three former employees retained active accounts in the dispatch platform, the most recent departure 14 months prior. Root cause: no owner assigned to access revocation on departure. Resolution: accounts disabled [date]. Departure checklist amended to include all seven named systems, owner assigned to the office manager, verification by the CySO at the quarterly access review. Plan Section 7 amended [date], within the 30-day clock. Closure evidence: account status export [date], amended checklist, quarterly review record for [quarter].
What has to be producible
- Audit reports, all years within retention
- Coast Guard inspection findings and responses
- Penetration test report at the five-year renewal
- Per-finding closure evidence
- The CySO certifying report
Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.
How this section gets a plan returned
- Closure asserted without evidence
- "Remediated" with nothing attached is the weakest line in a plan. Attach what proves it.
- Findings that vanish rather than close
- A register that shrinks between years without closure records reads as items being dropped, not fixed.
- Mixing open and closed items
- The rule separates them into Sections 11 and 12 deliberately. Merging them makes the risk-acceptance decisions in Section 12 invisible.
What operators ask about this section
- Is a penetration test required?
- At the five-year renewal, yes. It is not required for the initial submission — worth knowing if a vendor is selling you one as a prerequisite for filing.
- Do Coast Guard inspection findings go here?
- Yes, along with your own audits and assessments. This section is the record of everything found and everything done about it.