Drills and exercises: two drills and one exercise, every year, forever
Once your plan exists, the rule requires you to practice it: two drills per calendar year, and one exercise per year spaced no more than eighteen months apart. Both produce records, and both feed corrective actions back into the plan.
A drill tests one element — can the crew recognize and report a suspicious email, can the office execute the backup restoration procedure. An exercise tests the program: a tabletop, live, or port-wide scenario with the CySO actively participating.
Drills may be combined with existing MTSA drills you already run, and phishing simulations can count as drills — though not exclusively.
What the rule requires
- Two drills per calendar year
- Each testing a different element of the plan, documented with scenario, participants, and outcomes.
- One exercise per year, ≤18 months apart
- A full test of the program — tabletop, live, or port-wide — with active CySO participation.
- Documented corrective actions
- Findings from drills and exercises become corrective actions, and material gaps become plan amendments on the 30-day clock.
- Records
- After-action documentation retained and producible, like every other record in the program. After-action reports frequently carry SSI.
The calendar is the hard part, not the scenario
No single drill is difficult. What operators miss is the cadence — two drills and an exercise, every year, across crew changes and busy seasons, with the paperwork done. Missed cadence is visible at inspection years later, because the records simply are not there.
This is the clearest example of why the rule is an operating condition rather than a project: the obligation never closes. It renews every January.
Straight answers
- Can we combine cyber drills with our existing MTSA security drills?
- Yes, explicitly. If you already run MTSA drills under your security plan, a cyber element can ride the same schedule — which is usually the cheapest way to hit the cadence.
- What counts as an exercise?
- A tabletop, a live exercise, or participation in a port-wide exercise — with the CySO actively involved and the outcomes documented. An annual tabletop walking your incident response plan against a realistic scenario satisfies most small operations.
- Do drills start now or after our plan is approved?
- The drill and exercise cadence anchors to the rule's effective date and hardens once a plan is in place. Practically: build the habit now, because 2027 will not leave room to start from zero.