The Cybersecurity Assessment: first by July 16 2027, then every year
The Cybersecurity Assessment is where compliance starts. It is required before your plan can mean anything, it is required before a waiver request will even be read, and it repeats every year — and on any change of ownership.
The Coast Guard published its assessment methodology in Policy Letter 01-26: a three-stage method — prepare, conduct, document. The core of it is an asset inventory with criticality designations, followed by threat, vulnerability, likelihood and impact analysis for the systems that matter.
Criticality turns on one question: could compromise of this system lead to a Transportation Security Incident? The Coast Guard's guidance is blunt — if the answer is yes or maybe, designate it critical.
What the assessment must produce
- An asset inventory
- Every IT and OT system, with critical systems flagged and the reasoning recorded. On a towboat that means the ECDIS and engine monitoring alongside the office network; at a terminal it means SCADA and cargo transfer systems.
- Risk analysis per Policy Letter 01-26
- Threat, vulnerability, likelihood and impact, per asset, using the three-stage method — not a generic scan report.
- Validation of the plan
- The assessment checks that the plan's measures actually address the risks found. Gaps between the two are exactly what an auditor and a reviewer look for.
- KEV remediation without delay
- Vulnerabilities on CISA's Known Exploited Vulnerabilities list must be patched without delay, and the disposition documented.
- An SSI-marked report
- The assessment report is Sensitive Security Information. It is kept with the plan, producible to the Coast Guard on demand — it is not filed routinely.
Year two is a diff, not a do-over
The first assessment is the heavy one: building the inventory, mapping the network, making the criticality calls. The annual refresh clones last year's inventory and findings and works the differences — new systems assessed fresh, resolved findings closed, new vulnerabilities dispositioned.
Operators who keep the assessment in a living system rather than a binder do the refresh in a fraction of the time. That is most of the argument for running the program on a platform instead of a file share.
Straight answers
- We have almost no technology on our boats. Do we still need an assessment?
- Yes. The Coast Guard confirmed in July 2026 that even operators with little or no IT must complete a Cybersecurity Assessment first — relief comes only through the waiver process afterward, and a waiver request without a completed assessment attached is returned unread.
- Is the assessment a penetration test?
- No. A penetration test is not required for initial submission — it is required at the five-year plan renewal. A vendor insisting you need one now is selling you the renewal requirement three years early.
- Who can perform the assessment?
- The rule does not require an outside firm. It requires the method and the documentation. In practice, most small operators outsource it because criticality judgment against the TSI test is where inexperience shows.