Records and documentation

Also governed by§101.640§101.650(c)§101.650(d)§101.650(f)

The record set

Training, drills, exercises, threat information received, reportable cyber incidents, and audits. Each with enough detail to show what happened, not merely that something did.

At least two years

The retention floor. Some records are worth keeping longer for your own sake — the audit trail on a control you removed, for instance.

Protected from deletion and amendment

Electronic records need integrity protection. A shared folder anyone can edit does not meet the standard, and a reviewer will ask how you would know if a record changed.

Produced on demand

The practical test is time. Everything for drills, for the last two years, with corrective actions, in one export — not reconstructed from three inboxes.

Approvals carry names and timestamps

An approval nobody can attribute is not an approval a reviewer credits.

• A records index that maps each required record type to where it lives and who owns it
• Retention set explicitly, with the deletion rule written down rather than implied
• Access controls stated — who can write, who can only read
• A stated procedure for producing records on request, with a rehearsed example
• Log capture and storage described concretely: what is logged, where it goes, who can reach it

Records required under §101.640 are held in the compliance system of
record, with write access limited to the CySO and the office manager
and version history retained. Retention is set to seven years,
exceeding the two-year minimum.

Production standard: on request, the CySO can export all records of
a given type for the preceding two years within one business day.
This standard is tested during the annual exercise; the [date]
exercise produced the full drill record set in eleven minutes.

• The records themselves, organized by type and date
• The retention and integrity configuration — versioning, immutability, or the compensating procedure
• Access-control list for the evidence store
• A sample export produced during a drill, proving the procedure works

Records are kept at least two years and produced on demand §101.640, at the same vessel and facility inspections you already receive.

Records that live in email

Inboxes are neither protected from amendment nor searchable under pressure. This is the single most common gap in small operations.

Retention stated but not implemented

A plan that says two years, on a system whose default is ninety days, is worse than saying nothing — it documents the gap.

No named owner

Every record type needs someone responsible for it existing. Where nobody owns it, the record is missing in the year it matters.

Treating this section as filing

Section 4 is where a plan proves the rest of itself. The other thirteen sections describe intentions; this one holds the proof.

Who actually inspects these records?

Your regular Coast Guard inspectors, during the vessel and facility inspections you already receive, using a verification job aid. There is no separate cyber inspection team.

Is a shared drive good enough?

Only with integrity controls — version history, restricted write access, and a retention setting that matches what the plan claims. The requirement is protection from deletion and unauthorized amendment, however you achieve it.

How long do we really need to keep things?

Two years is the floor in the rule. Approvals tied to plan content are worth keeping for the life of the plan, which runs five years.