Personnel training

Also governed by§101.650(d)

All personnel with system access

Threat recognition, how to report, the relevant provisions of the plan, and the practices that prevent the common attacks. Contractors are inside the boundary, not outside it.

A deeper tier for key personnel

Whoever holds elevated access or specific cybersecurity duties gets training matched to that role. The plan should say who those people are and how you decided.

OT users get OT training

The people who operate the systems that steer, gauge, and move cargo need training aimed at those systems, not a generic office-phishing module.

Four clocks

New personnel within five days of system access. Within 30 days of hire. Annually thereafter. And plan-provision training within 60 days of plan approval.

Escort for the untrained

Someone who has not completed training and needs access is escorted. The plan says how that works in practice.

Third-party content is allowed

You may buy the training. You must evaluate it against the required topics and document that evaluation. Buying a course is not the same as satisfying the requirement.

• A topic outline mapped element by element to what the rule enumerates, so a reviewer can trace coverage without interpretation
• A named definition of "key personnel" for your operation, with the reasoning
• A separate OT module, however short, aimed at the wheelhouse and the gauging system
• A roster showing every person with system access and their current training status
• The five-day new-hire process written as an actual process — who triggers it, who verifies, what happens if the boat sails first
• A documented evaluation of any purchased course against the required topics

Access is not granted until training is scheduled. The office manager
records the access date and the scheduled training date on the same
line of the roster. Where operational need requires access before
training, the person is escorted by a trained employee and the
training is completed within five days of that access. The roster
is reviewed monthly by the CySO; any line where the gap exceeds
five days is a finding and is logged as such.

• Attendance records with date, duration, topics covered, and attendee names
• The training materials themselves, versioned
• Key-personnel designations
• Third-party content evaluation memo
• New-hire completions with the access date beside the training date, so the five-day clock is visible
• Contractor training confirmations

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Excluding contractors

The rule reaches everyone with access to IT or OT systems. The MSP that administers your network and the surveyor with a laptop on the boat are inside the requirement.

One generic module for everyone

A single office-security video does not address OT users or key personnel, and a reviewer comparing your outline to the rule will see the gaps immediately.

Records that show completion but not content

"All hands completed cyber training 3/14" proves attendance and nothing else. Inspectors verify against a job aid that asks what was covered.

Missing the five-day clock entirely

Most plans state the annual cadence and omit the new-hire clock, which is the one that is violated most often and easiest to check against a crew list.

The January 2026 deadline passed and we did nothing. What now?

Train everyone now and record it properly. The obligation is continuing, not a one-time event you missed — the exposure grows with every inspection that finds no records, and it shrinks the day you can produce them.

Does our MSP need this training?

If they have access to your IT or OT systems, yes. The requirement follows access, not employment status.

Can we buy a course off the shelf?

Yes. Evaluate it against the topics the rule requires, document that evaluation, and fill any gaps yourself. The evaluation is the part people skip and the part a reviewer asks for.