The 14-section Cybersecurity Plan, annotated
What each section of a compliant plan contains, and — from the reviewer's side of the desk — what gets template plans returned. One plan may cover a fleet of similar vessels; it is marked SSI and never emailed.
This outline is not a template to fill in. A Cybersecurity Plan must reflect the measures appropriate to the risks in your own Cybersecurity Assessment — a reviewer is specifically looking for the thread between what your assessment found and what your plan does about it. Use this to understand the shape of the document and to interrogate anyone offering to write yours.
- 01
Cybersecurity organization and identity of the CySO
Who owns the program: the CySO designation by name, the alternate, 24/7 contact information, and how cyber responsibility maps onto your existing chain of command.
- 02
Personnel training
The annual all-hands program, key-personnel and OT-user tracks, the 5-day new-hire clock, and how third-party content was evaluated.
- 03
Drills and exercises
The two-drill, one-exercise annual cadence, scenario selection, CySO participation in exercises, and how corrective actions feed amendments.
- 04
Records and documentation
What is retained, where, for the two-year minimum, and how it is produced on demand at inspection.
- 05
Communications
How cyber information moves: who is told what during an incident, vendor notification obligations, and how SSI material is handled and never emailed.
- 06
Cybersecurity systems and equipment, with associated maintenance
Patching cadence, KEV remediation without delay, approved hardware and software, and how changes to critical systems are controlled.
- 07
Cybersecurity measures for access control, including the computer, IT, and OT access areas
Account lifecycle, MFA coverage on IT and remotely accessible OT, least privilege, separate credentials for critical systems, and revocation on departure.
- 08
Physical security controls for IT and OT systems
Who can touch what: locked spaces, logged HMI access, blocked or disabled unused ports, and the no-unauthorized-media rule.
- 09
Cybersecurity measures for monitoring
What is watched and by whom: log capture with restricted access, IT-to-OT connections logged and monitored, and alerting that reaches a human.
- 10
Audits and amendments to the Cybersecurity Plan
The annual independent audit, auditor-independence evidence, and the amendment clocks: 30 days owner-initiated, 60 days Coast Guard-directed, 96 hours on CySO or ownership change.
- 11
Reports of all cybersecurity audits and inspections, to include documentation of resolution or mitigation of all identified vulnerabilities
Every audit and inspection report, and for each finding it raised, what was done about it. §101.650(e) puts risk-management documentation here and in Section 12; §101.630(f)(1) requires the CySO's certifying audit report be attached to the plan.
- 12
Documentation of all identified, unresolved vulnerabilities, to include those that are intentionally unresolved due to owner or operator risk acceptance
The open findings register, including anything the owner has decided to accept rather than fix — with the rationale. Risk acceptance is explicitly lawful; undocumented risk acceptance is not.
- 13
Cyber incident reporting procedures in accordance with part 101 of this subchapter
The NRC script with 1-800-424-8802, what §101.615 defines as reportable, the without-delay duty (§101.650(g)(1)), the parallel CISA notice for Part 6 entities, and where the incident record lives (§101.640).
- 14
Cybersecurity Assessment
The assessment report itself, or a summary with a reference to where it is kept — marked SSI, current within the year, and the thing every other section is supposed to rest on.
An outline is not a plan
The Coast Guard is currently holding full plan submissions while it finalizes review procedures, and it has seen template plans before — the return-for-revision cycle gives you at least 60 days to fix a returned plan, which is time the calendar may not have in mid-2027.
A plan worth submitting is grounded in a real assessment of your boats and your terminal, written in your operation's own facts. That is six to eight weeks of real work for a cooperative operator — not an afternoon with a document generator.
The NRC call-script card, the training-records template and the CySO chooser
Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.
Get them —