Monitoring and response

Also governed by§101.650(g)

A Cyber Incident Response Plan

Developed, maintained, and exercised. Not a paragraph — a document that tells a person what to do in the first hour.

Reporting without delay

Reportable cyber incidents go to the National Response Center without delay. The procedure belongs here and the detail sits in Section 13.

Periodic validation

The plan is checked against reality on a stated cadence, not left to age.

Backups, protected and frequently tested

Three requirements in one clause. Backups exist, they are protected from the same event that takes the primary, and restores are actually tested.

Monitoring itself

How you would notice. For a small operation this is often a managed service — the plan says what is monitored, by whom, and how an alert reaches a human.

• An incident response plan with a first-hour checklist, written for whoever is at the desk
• Restore tests with dates and outcomes — the test result is the evidence, not the backup configuration
• Backups held where the same ransomware event cannot reach them, and the plan saying how that is achieved
• A named monitoring arrangement, including what happens outside business hours
• The National Response Center number where a person under stress will find it
• A validation cadence tied to the annual assessment so it does not drift

If you believe a system has been compromised:

1. Do not turn the machine off. Disconnect it from the network
   (unplug the cable, or turn off wifi).
2. Call the CySO: [number]. If no answer in 10 minutes, call the
   alternate: [number].
3. Write down what you saw and the time. Do not delete anything.
4. The CySO determines whether this is a reportable cyber incident
   and, if so, calls the National Response Center at 1-800-424-8802
   without delay, and records the report number.
5. Do not discuss the incident outside the response team.

• The Cyber Incident Response Plan, versioned
• Backup configuration and, more importantly, restore-test records with dates and results
• Monitoring service description and alert routing
• Incident log with National Response Center report numbers
• Exercise records showing the incident response plan was tested

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Backups that have never been restored

An untested backup is a hypothesis. This is the failure that turns a bad week into a closed business, and it is the cheapest one to eliminate.

Backups reachable from the network they protect

Ransomware encrypts what it can reach. If the backup share is mounted, it is inside the blast radius.

An incident response plan written for an IT department

The person who finds the problem is the office manager on a Friday afternoon. Write the first page for them.

No answer for after hours

Incidents do not respect business hours, and the CySO's 24/7 duty is meaningless if the monitoring stops at five.

How often should we test a restore?

The rule says frequently and does not set a number, which means you set one and defend it. Quarterly is a common and defensible cadence for a small operation; annually is hard to call frequent.

We use a managed IT provider for monitoring. Is that enough?

It can be. The plan must say what they monitor, how an alert reaches a person, and what happens after hours — and Section 6's supply-chain requirements apply to that provider's access.

What is a reportable cyber incident?

The rule defines it broadly, reaching operational disruption and data breach as well as anything that could become a transportation security incident. Section 13 covers the reporting mechanics.