The Cybersecurity Plan: fourteen sections, approved once, valid five years
The Cybersecurity Plan is the central deliverable of 33 CFR Part 101 Subpart F. It is a fourteen-section document that describes how your operation meets every cybersecurity measure in the rule, and it must be submitted to the Coast Guard for approval no later than July 16, 2027.
Vessels submit to the Marine Safety Center; facilities submit to their cognizant Captain of the Port. Transmission is electronic, via the DoD SAFE portal. One plan may cover a fleet of similar vessels, which matters enormously for towing companies — you are writing one document, not one per boat.
The plan is marked Sensitive Security Information under 49 CFR 1520. That is a legal handling category, not a stamp: access is limited to covered persons with a need to know, and the plan is never sent as an email attachment.
What the plan must contain
- The fourteen sections
- The plan addresses organization and identity of the Cybersecurity Officer, personnel training, drills and exercises, records and documentation, communications, systems maintenance, access control, physical security of IT and OT, monitoring, audits and amendments, reporting procedures, unresolved vulnerabilities, and incorporates the Cybersecurity Assessment.
- Grounded in your assessment
- The plan must reflect the measures appropriate to the risks identified in your Cybersecurity Assessment — a template that ignores your actual systems is exactly what a reviewer is trained to return.
- Approved once, valid five years
- There is no routine annual re-filing. What goes back to the Coast Guard: amendments as they are triggered, and the full renewal at year five — which is also when a penetration test is required.
- The amendment clocks
- Owner-initiated amendments go in at least 30 days ahead. Coast Guard-directed amendments run on 60 days. A change of Cybersecurity Officer or ownership starts a 96-hour clock.
- Operate while under review
- A written acknowledgment from the Coast Guard lets you keep operating under the submitted plan while review continues — the mechanism that will matter if a review backlog builds against roughly five thousand owner-level submissions.
The current posture: hold your submission, finish your plan
As of June 4, 2026, the Coast Guard has asked industry to refrain from submitting full Cybersecurity Plans while it finishes its review procedures. Waiver and equivalency requests are being accepted and processed now.
That is not a reason to wait. The deadline has not moved, the work has not shrunk, and whoever holds a queue of submission-ready plans when the window opens files first. The operators in trouble in 2027 will be the ones who treated the pause as a delay.
Straight answers
- Does every vessel need its own Cybersecurity Plan?
- No. One plan may cover a fleet of similar vessels. A ten-boat towing company writes one fleet-level plan with per-vessel variance noted where systems genuinely differ.
- Do we re-submit the plan every year?
- No. The plan is approved once and stays valid five years. Only amendments and the year-five renewal go back to the Coast Guard. What repeats every year is the work — the assessment refresh, the audit, drills, an exercise, and training.
- What happens if the Coast Guard returns our plan?
- You get at least 60 days to revise and resubmit. A returned plan is a schedule problem, not a penalty — but a returned template plan in mid-2027, with the deadline standing, is a real one.
- Is the plan a public document?
- No. It is Sensitive Security Information under 49 CFR 1520 — access-controlled, marked on every page, and never distributed by email.