Organization and the CySO

Also governed by§101.620(b)(2)§101.620(b)(3)§101.625

The organizational structure

Who does what, and how cybersecurity duties connect to the people who already run the operation — the port captain, the office manager, the outside IT provider. A reviewer is looking for a chain that survives someone being on the river.

The CySO, designated by name

Not "the operations manager." A person, by name and title, with contact information the Coast Guard can use at any hour. The designation is a written instrument that belongs in the plan.

Every vessel and facility the CySO covers

One CySO may cover multiple vessels and facilities with no cap — but each one must be listed in each applicable plan.

Qualifications

No license or certification is required. Qualification is knowledge acquired through training, education, or equivalent job experience across the knowledge areas the rule enumerates. Write down what that knowledge is and where it came from.

An alternate

Not named as a requirement, but 24/7 reachability with one person and no backup is a promise the first crew change breaks. Reviewers notice.

• A named individual, a named alternate, and a phone number that a person answers at 2 a.m.
• A one-page designation letter signed by the owner or an officer, dated, attached to the plan
• A qualifications paragraph that reads like a résumé summary, not a claim — courses taken, years in the role, systems actually operated
• An explicit statement of what is delegated and to whom, alongside the statement that responsibility is not delegated
• The list of covered vessels and facilities, matched exactly to the plans they appear in

The Cybersecurity Officer for the vessels listed in Appendix A is
[Name], [Title], designated in writing on [date] by [owner/officer].
Direct line: [number], monitored 24 hours a day. Alternate: [Name],
[Title], [number]. The CySO holds other operational duties and may
delegate specific tasks under this Plan; responsibility for the
program is not delegated. Qualifications are documented in
Appendix B and reviewed annually.

• Signed CySO designation letter with date and 24/7 contact
• Alternate designation
• Organization chart showing cybersecurity duties
• Qualification file: training certificates, course completions, role history
• Change records — a CySO or ownership change starts a 96-hour notification clock

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Designating a role instead of a person

"The Safety Manager serves as CySO" does not satisfy a requirement to designate by name and title. When the safety manager leaves, the designation is void and nobody notices.

A contact number that reaches an office

The duty is 24/7 reachability. A desk line with voicemail is a reviewer's easiest finding.

Silence on qualifications

The rule does not require a certification, which operators read as "nothing to write." It requires knowledge across defined areas. Absent any statement, a reviewer has nothing to evaluate.

Forgetting the vessel list

A fleet plan that names the CySO but not the vessels they cover creates an ambiguity that is cheaper to fix now than during review.

Can our port captain be the CySO?

Yes. The rule permits the CySO to hold other duties. The honest question is capacity: 24/7 reachability, an annual assessment and audit, two drills and an exercise, training records and patch clocks, on top of the day job.

Can we outsource the role?

Yes, explicitly. The rule permits a third-party CySO and places no cap on how many vessels or facilities one CySO covers. What stays with you is cooperation — an outside CySO is only as informed as your operation lets them be.

What happens when the CySO changes?

A change of Cybersecurity Officer starts a 96-hour clock to notify and amend. That clock is the strongest argument for a named alternate and for records that do not live in one person's head.