The CySO: designated in writing, reachable 24/7, and outsourcing is allowed
Every regulated owner or operator must designate a Cybersecurity Officer by name, in writing, by July 16, 2027. The CySO owns the whole program: the assessment, the plan, audits, training, drills, incident reporting, patching, and amendments.
The rule is deliberately flexible about who holds the role. The CySO may hold other duties, may cover multiple vessels and facilities, and — critically — may be outsourced to a third party. The Coast Guard wrote the fractional-CySO model into the regulation itself, acknowledging that small operators would rely on outside providers for all cybersecurity needs.
No license or certification is required. Qualification is knowledge acquired through training or equivalent job experience.
What the rule asks of the CySO
- Written designation
- Named in the plan, with contact information the Coast Guard can use at any hour. An alternate is standard practice for coverage.
- 24/7 reachability
- The Coast Guard must be able to reach your CySO around the clock. A six-week consulting engagement cannot staff a permanent post — this duty is why the role is a subscription, not a project.
- Owns the annual calendar
- The annual assessment refresh, the annual audit, two drills and an exercise, the training program, KEV patching without delay, and every amendment clock all run through the CySO.
- Cannot audit their own work
- The annual plan audit must be done by someone independent of the measures being audited — which means a one-person program cannot audit itself, and a two-firm structure satisfies the rule by design.
The port captain question
Many operators plan to name their port captain or operations manager. The rule allows it. The honest question is whether that person can carry a 24/7 federal reachability duty, run two drills and an exercise a year, keep training records that survive inspection, and patch known-exploited vulnerabilities without delay — on top of their actual job.
A fractional CySO of record, with your own people running day-to-day operations, is the model the rule was written to permit. It is also the difference between compliance that depends on one person's calendar and compliance that survives crew change.
Straight answers
- Does the CySO need a certification like CISSP?
- No. §101.625 requires no license or certification. Qualification is knowledge through training or equivalent job experience. What matters is that the program actually runs — and that the designation, contact chain, and records hold up at inspection.
- Can one CySO cover our whole fleet?
- Yes. The rule explicitly allows one CySO to cover multiple vessels and facilities, with no cap.
- Can we outsource the role entirely?
- Yes. Outsourcing to a third party is explicitly permitted. The obligation that stays with you is cooperation — the CySO can only be as reachable and as informed as your operation lets them be.
- What happens when our CySO leaves?
- A CySO change starts a 96-hour clock to notify and amend. That clock is one of the strongest arguments for a named alternate and for records that do not live in one person's head.