Communications
Communications
How word gets out when something changes — and how the Coast Guard reaches you.
Section 5 is short and specific. The rule asks the Cybersecurity Officer to have the means to effectively notify owners and personnel of changes in cybersecurity conditions, and to document those means here. It also requires continuous communication with the Captain of the Port and the relevant authorities.
In a towing company this is not an abstract requirement. Boats are on the river, crews rotate, and the person who needs to know a vendor account was compromised is standing in a wheelhouse.
What §101.630(c)(5) hard-wires into this section
- The notification means
- How the CySO actually reaches people — phone, VHF, dispatch system, text, the portal. Named channels, not "as appropriate."
- Changes in cybersecurity conditions
- Not just incidents. A raised threat level, a vendor advisory, a known-exploited vulnerability requiring immediate action — these all need a route to the people affected.
- Continuous communication with the COTP
- The Coast Guard needs to be able to reach the operation and be reached by it. This connects directly to the 24/7 CySO contact in Section 1.
- Both directions
- A notification tree pushes information out. The plan should also say how a deckhand reports something upward, and how fast.
What a reviewer expects to see
- A notification tree with names, roles, and two contact methods each
- A stated escalation time — how long before an unanswered notification goes to the alternate
- The route for shore-to-vessel and vessel-to-shore separately, because they use different channels
- The COTP contact recorded alongside the National Response Center number
- A statement of how the tree is kept current, and how often it is verified
A notification procedure with a clock in it
Not a template to copy. This is the shape and specificity a section reads with when it has been written from a real operation — bracketed where your facts go.
On a change in cybersecurity conditions, the CySO notifies the operations manager and each vessel master by phone, with a text as backup, within one hour. Vessels without cell coverage are reached through dispatch on the working channel at the next scheduled check-in, and dispatch confirms receipt back to the CySO. If the operations manager is not reached within one hour, the alternate CySO is contacted. The tree is verified quarterly and after any crew change affecting a listed person.
What has to be producible
- The current notification tree with a revision date
- Verification records — a periodic test that the numbers still work
- Records of notifications actually sent, which double as incident-timeline evidence
Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.
How this section gets a plan returned
- A tree that was never tested
- Contact lists rot fast in an industry with crew rotation. A tree with a two-year-old phone number is a plan that fails at the moment it is needed.
- Only covering incidents
- The rule says changes in cybersecurity conditions, which is broader. A patch that has to be applied without delay is a condition change.
- Forgetting the boats
- A notification procedure that assumes everyone reads email misses the half of the workforce that does not, on the days it matters.
What operators ask about this section
- Is this about incident reporting?
- No — incident reporting to the National Response Center lives in Section 13. Section 5 is about the internal and Coast Guard communication channels themselves, used for any change in conditions.
- How specific does the tree need to be?
- Specific enough to execute at 2 a.m. by someone who did not write it. Names, roles, two contact methods, escalation timing.