A training program that survives inspection
Training is the requirement most operators are already violating — the deadline was January 12, 2026 — and the cheapest one to fix. This is the whole program: who trains, on what, when, and what the record must show.
Five clocks, one program
- All hands, annually
- Everyone with IT or OT access, including contractors: threat recognition, how to report, and the plan provisions relevant to their role. Due for the first time January 12, 2026 — a date that has already passed — and every year after.
- New hires: 5 days from system access
- The clock starts when the login is granted, not when the person is hired. A deckhand who boards Monday and gets a TMS login Tuesday must be trained by the following Sunday.
- Key personnel
- People with designated cyber responsibilities get deeper training. Designate them in writing — the designation itself is a record the job aid checks.
- OT users
- Anyone operating engine monitoring, cargo transfer, SCADA or similar systems gets OT-specific content, not just the office phishing module.
- After plan approval: 60 days
- Once your plan is approved, personnel must be trained on its provisions within 60 days.
What inspectors actually verify
Coast Guard inspectors verify training against a job aid during regular vessel and facility inspections. It does not ask whether your crews are security-aware. It asks for specific record fields:
- Date and duration
- When the session ran and how long it lasted. "Completed" without a duration is a gap.
- Topic outline, mapped to the rule
- The topics covered, traceable to §101.650(d)'s content requirements — threat recognition, reporting, plan provisions.
- Full attendee list
- Every person, by name. The inspector's job aid checks the roster against the crew list, which is how missing contractors get found.
- Key-personnel designations
- Who holds designated cyber responsibilities, in writing.
- Third-party content evaluation
- If you bought the training, the record that you evaluated it against the rule's requirements.
Records are retained at least two years §101.650(c)and produced on demand. A gap draws a deficiency finding — and a deficiency history is what your insurer’s underwriter reads.
The program in practice
Run the annual cycle on a fixed anniversary so it survives crew change, and put the 5-day clock on whoever grants system access — IT or the office manager — not on the training calendar. The clock is an onboarding step, like a drug test: no training, no login.
Third-party e-learning is fine and usually right for a small fleet; a maritime-specific course beats a generic office module for the OT track. Evaluate it once against the rule's content list, write that evaluation down, and keep your own attendance records rather than relying on the vendor's dashboard.
If you are starting from zero today: train everyone now, document it properly, and set the anniversary. An operator with completed training and clean records is in a categorically better position at inspection than one still deciding — and it takes days, not months.
The NRC call-script card, the training-records template and the CySO chooser
Three documents for the duties in force and the designation ahead — built to what the Coast Guard checks. Free; we ask for a name.
Get them —