Can our cyber drill ride along with a security drill we already run?

Yes, where the cybersecurity measures are genuinely exercised. The record must show the cyber content — a line item in an existing drill report is fine if it describes what was tested and what was found.

What is the difference between a drill and an exercise?

A drill tests a piece — one control, one procedure, one team. An exercise tests coordination across the plan, and may be tabletop, live, or run with a port. Two drills and one exercise a year.

Does a phishing simulation count?

Yes, as a drill, but not as the entire program. The rule is explicit that phishing tests alone are not sufficient.

Section 3 of 14§101.630(c)(3)

Drills and exercises

Two drills and one exercise a year, documented, with what you fixed afterward.

The rule asks for two drills per calendar year and one exercise per year, no more than eighteen months apart, with the Cybersecurity Officer taking substantial and active part. Section 3 describes the program; Section 9 carries the incident response plan the exercises test.

Drills may be combined with the security drills you already run, which is the single most useful thing to know here — but only where the cybersecurity measures are genuinely exercised, and the record shows it.

Also governed by§101.635§101.650(g)

What the rule requires

What §101.630(c)(3) hard-wires into this section

Two drills per calendar year: A drill tests one part of the plan. Phishing simulations count, but not exclusively — a program built entirely from phishing tests does not exercise the plan.
One exercise per year: Broader than a drill: tabletop, live, or port-wide, testing coordination rather than a single control. No more than eighteen months between exercises.
Active CySO participation: The rule asks for substantial and active participation, not sign-off. A CySO who receives a report afterward has not participated.
Documented corrective actions: The output of a drill is a list of things that did not work and what you did about them. A drill record with no findings reads as a drill that was not real.
Combination with existing drills: Permitted where the cyber measures are actually exercised. The record has to show the cyber content, not just the date of the security drill it rode along with.

The standard

What a reviewer expects to see

A twelve-month calendar naming each drill and the exercise, with the plan section each one tests
Scenarios written for a working boat and a working office — a fake fuel invoice, a locked office computer on a Friday, a vendor asking for remote access
A record format that captures who took part, what failed, what changed, and by when
At least one scenario that ends in an NRC reporting decision, since that is the live obligation
Evidence that a corrective action from last year's drill actually closed

An illustration

A drill record that survives review

Not a template to copy. This is the shape and specificity a section reads with when it has been written from a real operation — bracketed where your facts go.

Drill 2 of 2, [date]. Scenario: the fuel vendor emails new banking
details ahead of a $38,000 invoice. Participants: office manager,
controller, CySO, port captain.

Observations: the controller identified the change and paused the
payment. No written callback procedure existed; verification was
done from a number in the email body.

Corrective action: vendor bank-change procedure written, requiring
callback to the number on file. Owner: CySO. Due: [date +30].
Closed [date] — procedure issued and added to Section 7.

Evidence

What has to be producible

Drill records: date, scenario, participants, observations, corrective actions with owners and dates
Exercise record and after-action report — treat after-action reports as Sensitive Security Information
The scenario library itself
Closure evidence for prior corrective actions
Where drills were combined with MTSA security drills, the record showing the cyber content

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Failure modes

How this section gets a plan returned

Phishing tests as the whole program: They are permitted and useful, and they exercise one control. A year of nothing but click-rate reports does not test the incident response plan, the backups, or the reporting chain.
No corrective actions: A drill that produced no findings is either a drill nobody took seriously or a record nobody completed. Both read the same to a reviewer.
The CySO as observer: Substantial and active participation is the standard. Attendance in a distribution list is not participation.
Losing the eighteen-month rule: An exercise in January one year and December the next is twenty-three months apart, which is a violation even though both years show one exercise.

Questions

What operators ask about this section

Can our cyber drill ride along with a security drill we already run?: Yes, where the cybersecurity measures are genuinely exercised. The record must show the cyber content — a line item in an existing drill report is fine if it describes what was tested and what was found.
What is the difference between a drill and an exercise?: A drill tests a piece — one control, one procedure, one team. An exercise tests coordination across the plan, and may be tabletop, live, or run with a port. Two drills and one exercise a year.
Does a phishing simulation count?: Yes, as a drill, but not as the entire program. The rule is explicit that phishing tests alone are not sufficient.

Previous · Section 2

Personnel training

Next · Section 4

Records and documentation