Three documents for the duties in force and the decision ahead
Incident reporting has been required since July 16, 2025. Training was due January 12, 2026. And the Cybersecurity Officer must be named, in writing, by July 16, 2027. These are the pieces of paper that cover them — free, printable, and written to what the Coast Guard actually checks.
- Wheelhouse card§101.650(g)(1)
The NRC call-script card
Two cards to a sheet, cut and laminate. The four questions that decide whether something is reportable, the National Response Center number, what they will ask, who gets called next, and where the report number is logged. Made for the person who answers the phone at two in the morning.
- Records template§101.650(d)
The cybersecurity training-records template
A record sheet built to the fields the Coast Guard's training-verification job aid checks during routine inspections: date and duration, the topic outline mapped to each required element, the attendee list, the five-day new-hire clock, and the third-party content evaluation.
- Decision guide§101.625
Choosing your Cybersecurity Officer
Two pages for the designation every covered company must make by Jul 16, 2027. Page one compares the four realistic paths — port captain, office manager, outside firm, the owner — and carries the designation-letter checklist. Page two is the rule's twelve knowledge areas as a tick-box self-assessment for the person you have in mind.
Start with what is inspected today, then make the decision that unlocks the rest
Everything about the 2027 deadline is still ahead of you. The first two obligations are not. Reportable cyber incidents have had to go to the National Response Center without delay since the rule took effect, and the Coast Guard now verifies training records during routine inspections. A towing company that cannot produce either is out of compliance this afternoon, not in 2027.
The third document faces the deadline itself. Naming the Cybersecurity Officer is the decision that unlocks the assessment and the plan, and the four realistic ways to make it deserve an honest comparison on paper before anyone is designated.
All three documents are deliberately plain. The card is meant to live next to the VHF. The templates are meant to be filled in by a port captain, not an IT department.