Audits and amendments

Also governed by§101.630(e)§101.630(f)

An annual audit

Of the plan and the measures it describes, on an annual cadence.

Auditor independence

The audit must be performed by someone independent of the measures being audited. An internal designation is possible where the auditor genuinely did not build or run the controls; for most small operations it means an outside party.

A certifying report attached to the plan

The Cybersecurity Officer attaches a report certifying that the plan meets the applicable requirements.

Amendments within 30 days of an audit gap

A finding is not advisory. It starts a clock.

Owner-initiated amendments at least 30 days ahead

Changes you choose to make go in with notice.

Coast Guard-directed amendments on 60 days

Where the Coast Guard requires a change, the clock is 60 days.

96 hours on a CySO or ownership change

The fastest clock in the rule, and the one most likely to be missed during a transition.

• The audit scheduled on the compliance calendar rather than arranged reactively
• An independence statement naming who audited and why they qualify
• An audit scope that names the sections and the evidence sampled
• A findings register with owners and due dates, tied to the 30-day clock
• Prior-year findings shown as closed, which is the fastest way to demonstrate the program is real
• The amendment procedure written as a procedure — who drafts, who approves, who files

The annual audit for [year] was conducted by [firm/person] on
[dates]. [Firm] does not design, implement, operate, or maintain
any cybersecurity measure described in this Plan, and has no
financial interest in the systems audited.

Scope: all fourteen sections; evidence sampled for training
(Section 2), drills (Section 3), access reviews (Section 7), and
restore tests (Section 9). Four findings issued, all closed within
30 days; amendments filed [date]. The CySO's certifying report is
attached as Appendix [x].

• Audit reports with dates, scope, and findings
• Auditor independence evidence
• The CySO's certifying report attached to the plan
• Amendment correspondence with the Coast Guard and the dates that prove the clocks were met
• 96-hour change notices

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

The CySO auditing their own program

This is prohibited by the independence requirement and it is the most common structural error in small-operation plans.

Your IT provider auditing the controls they installed

Same problem. If the same firm built and runs the measures, they are auditing their own work.

Treating findings as suggestions

A gap found in the audit starts a thirty-day amendment clock. A findings list carried forward untouched is evidence against you.

Missing the 96-hour clock

It fires on a CySO or ownership change — exactly the moments when everyone is busy with something else. Put it in the succession checklist, not just the plan.

Can our Subchapter M auditor do this?

Not as part of a Sub M audit — that is a different regime under a different title of federal law with no cybersecurity content. Some Sub M audit firms are adding cyber capability, but the cyber audit remains a separate event with its own independence test.

Can someone inside the company audit it?

Only if they are genuinely independent of the measures being audited, which is difficult in an operation small enough that one person built everything. Where it is possible, document precisely why the independence holds.

What triggers an amendment?

An audit gap (30 days), a change you initiate (at least 30 days ahead), a Coast Guard direction (60 days), or a change of Cybersecurity Officer or ownership (96 hours).