Fairway
Playbook§101.655

The 2027 deadline playbook

For the 5–50 boat operator and the mid-size terminal: what is due, in what order, and what an inspector can ask to see. No delay for vessels was ever enacted — the date below is the date.

The wall

CySO designated, assessment complete, plan submitted for approval — all due July 16, 2027. §101.655

The rule does not name a finish line before the deadline. We do: plan finished and staged to file by Friday, Apr 16, 2027 — three months early, one full return-and-revise cycle in hand.

—days
—hours
—minutes
—seconds
The order of work

Five moves, in sequence

Now — the two live obligations
Get everyone with system access trained and the records compliant (§101.650(d) — due January 12, 2026, already passed), and write the one-page NRC reporting script (§101.650(g)(1) — in force since July 2025). Days of work. Do this before anything else.
Next 60 days — the assessment
Run the Cybersecurity Assessment per Policy Letter 01-26: inventory every IT and OT system, make the criticality calls against the TSI test, analyze the risks. Every path — full program or waiver — runs through a completed assessment.
The fork — waiver or program
Genuinely low-tech operation? A waiver request for the technical measures may be legitimate compliance, and the waiver lane is open now. Real systems, real connectivity? You are writing the fourteen-section plan. The assessment answers this honestly; decide on evidence, not hope.
Months 3–5 — the plan build
Write the plan from your assessment, remediate the control gaps it exposed — MFA, backups, segmentation, vendor access — designate the CySO in writing with 24/7 coverage, and run your first drill so the cadence is real before it is inspected.
Months 6+ — submission-ready, then the calendar
Stage the plan for the day the Coast Guard reopens submissions; file the waiver now if that was the fork. Then run the permanent calendar: two drills, the exercise, the annual audit, the assessment refresh, training anniversaries.
The artifact checklist

What done looks like

Compliance is an evidence standard. On July 16, 2027 — and at every inspection after — this is the set an operator must be able to produce:

Governance
Approved (or submission-ready) 14-section plan, SSI-marked · current assessment report · written CySO designation + alternate with 24/7 contact · audit reports with independence evidence · waiver filings, if pursued.
Operations
Training records with dates, duration, topics, attendees · drill and exercise records with corrective actions · exercised incident response plan · incident log with NRC report numbers · asset inventory, network map, approved hardware/software list.
Technical evidence
MFA and account-lifecycle documentation · backup configuration and restore-test records · vendor remote-access logs and notification terms · OT physical access logs and port-blocking records · amendment correspondence.

Everything retained at least two years §101.650(c) and producible on demand. Penalties for non-compliance run to $43,527 per violation, per day under 46 U.S.C. 70119.

The math

Why waiting costs more

6–8 wksa real program build
≥60 daysa returned plan’s revision cycle
~3,400owners in the same queue

Roughly 3,400 unique owners face the same date, served by a delivery market that cannot absorb them all in the final quarter. The operators who wait for the submission window to open will be buying the expensive version of this rule — rushed, priced at panic, and behind a queue.

Printable

The NRC call-script card, the training-records template and the CySO chooser

Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.

Get them —

Want the playbook run for you?

The readiness call is thirty minutes and free: which obligations already apply to you, whether the waiver fork is real for your fleet, and a fixed quote for the rest.

Or call 303-848-9352 or email aaron@fairway.systems — a person answers within one business day.

Book a readiness callRead the requirements first