The Cybersecurity Assessment

Also governed by§101.650(e)

An assessment, completed

By July 16, 2027, then annually, and again on a change of ownership.

An asset inventory with criticality designations

The same inventory Section 6 depends on, built against the transportation-security-incident test.

Threat, vulnerability, likelihood and impact analysis

The Coast Guard has published assessment guidance describing a staged method. Following a recognized method and saying which one you followed is worth more than an elegant format.

Validation of the plan against the findings

The assessment checks whether the measures actually address the risks identified.

Known-exploited vulnerabilities remediated without delay

Findings of this class are not queued behind the report.

The report, or a summary and reference

The assessment report is kept with the plan and is Sensitive Security Information.

• A stated method, named, so a reviewer knows what standard to judge it against
• Criticality reasoning attached to each determination rather than a bare flag
• Likelihood argued from evidence — what has actually happened in this industry and in analogous ones — rather than asserted
• A findings register that flows into Sections 11 and 12 rather than sitting apart
• Assumptions and constraints written down at the start, including what was not examined and why
• A named assessor and the basis for their competence

This assessment was conducted [dates] using the staged method in
the Coast Guard's published assessment guidance: inventory and
criticality determination, threat and vulnerability analysis, and
validation against the Plan.

Scope: all six vessels, the fleeting yard office, and the systems
listed in Appendix A. The [third-party terminal] systems used
during transfers were not examined; that boundary is stated in
Section 12 as an open item with the reasoning.

Method note: likelihood is argued from documented incidents in the
marine transportation system and in analogous industries, cited
per finding, rather than assigned by scale alone.

Assessor: [name], [basis of competence]. This report is Sensitive
Security Information under 49 CFR part 1520.

• The Cybersecurity Assessment report, marked as Sensitive Security Information
• The asset inventory with criticality determinations
• Interview and observation records supporting the findings
• The findings register
• Evidence that known-exploited vulnerabilities identified were remediated without delay

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Writing the plan first and the assessment afterward

It is the most common shortcut and the most detectable. The measures will not trace to the risks, because they were not derived from them.

A scored spreadsheet with no reasoning

Numbers without arguments cannot be evaluated. A reviewer needs to see why a likelihood is what you say it is.

Skipping the assessment because you believe you are low-tech

The assessment comes first in every path, including the waiver path. Even a pre-existing waiver holder must complete one.

Treating the assessment as a one-time event

It refreshes annually and on a change of ownership. A plan built on a stale assessment ages into non-compliance quietly.

Which comes first, the assessment or the plan?

The assessment. The plan's measures are supposed to be appropriate to the risks the assessment identifies, which is impossible to demonstrate if the plan was written first.

Who is allowed to perform the assessment?

The rule does not license assessors. What matters is competence you can evidence and a method you can name. Note that the annual plan audit has an independence requirement the assessment does not — those are different obligations.

Do we need an assessment if we are seeking a waiver?

Yes, and this surprises people. Relief is available only after a completed Cybersecurity Assessment, and the Coast Guard confirmed that pre-existing waiver holders must complete one too.